x(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x74000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:25 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192316834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 333.066676][ T7923] binder: send failed reply for transaction 596 to 14476:14478 [ 333.075107][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:25 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fba00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:26 executing program 5: connect(0xffffffffffffffff, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r0}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:26 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192317834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x7a000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fbb00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fbc00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0xfdfdffff, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:26 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192318834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 333.491263][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 333.629917][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fbd00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0xfffffdfd, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:26 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 333.945112][ T2991] binder: release 14524:14525 transaction 608 out, still active [ 333.956279][ T2991] binder: unexpected work type, 4, not freed [ 333.962522][ T2991] binder: send failed reply for transaction 608, target dead 21:13:26 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:26 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192319834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:26 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(0xffffffffffffffff, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fbe00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x100000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:26 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019231a834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fbf00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:27 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019231b834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc000001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x200000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) [ 334.430639][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:27 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019231c834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:27 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:27 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc100001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:27 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(0xffffffffffffffff, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x300000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:27 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019231d834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc200001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc300001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:28 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019231e834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x400000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) [ 335.278448][ T2991] binder: release 14588:14599 transaction 620 out, still active 21:13:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc400001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 335.319278][ T2991] binder: unexpected work type, 4, not freed [ 335.341125][ T2991] binder_release_work: 7 callbacks suppressed [ 335.341131][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 335.359156][ T2991] binder: send failed reply for transaction 620, target dead 21:13:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x500000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) [ 335.437849][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:28 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 335.646677][ T2991] binder_send_failed_reply: 5 callbacks suppressed [ 335.646689][ T2991] binder: send failed reply for transaction 628 to 14618:14621 [ 335.661859][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:28 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc500001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:28 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(0xffffffffffffffff, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x600000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:28 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192321834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc600001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc700001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:28 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192322834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x700000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc800001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 336.157700][ T7923] binder: send failed reply for transaction 632 to 14635:14647 [ 336.171866][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:13:28 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192323834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:29 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 336.347405][ T7923] binder: send failed reply for transaction 636 to 14657:14665 [ 336.365103][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:13:29 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc900001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:29 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0xa00000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:29 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192324834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fca00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fcb00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:29 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192325834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x1000000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fcc00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 336.993429][ T2991] binder: send failed reply for transaction 640 to 14682:14693 [ 337.011155][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 337.034141][ T2991] binder_release_work: 5 callbacks suppressed [ 337.034147][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fcd00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:30 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 337.228987][ T2991] binder: send failed reply for transaction 644 to 14700:14706 [ 337.239100][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 337.253722][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:30 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:30 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192326834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:30 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x2000000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fce00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:30 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192327834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fcf00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x3f00000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:30 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192328834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 337.845412][ T2991] binder: send failed reply for transaction 648 to 14727:14737 [ 337.859989][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd000001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 337.891595][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd100001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:30 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 338.126151][ T7923] binder: send failed reply for transaction 652 to 14745:14754 [ 338.147593][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 338.175462][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:31 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x4800000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) [ 338.342090][ T7923] binder: send failed reply for transaction 656 to 14766:14767 [ 338.350179][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 338.373979][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:31 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd200001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:31 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192329834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x4c00000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd300001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:31 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019232a834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x6000000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd400001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 338.758124][ T7923] binder: send failed reply for transaction 660 to 14775:14787 [ 338.785064][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:31 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019232b834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 338.980848][ T2991] binder: send failed reply for transaction 664 to 14795:14800 [ 338.989135][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:31 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:31 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd500001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:32 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x6800000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:32 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019232c834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd600001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd700001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x6c00000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) [ 339.556787][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd800001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:32 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019232d834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd900001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 339.773121][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:32 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:32 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x7400000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) [ 339.989890][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:33 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:33 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019232e834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fda00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x7a00000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fdb00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:33 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019232f834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0xfdfdffff00000000, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:13:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fdc00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 340.476716][ T2991] binder_release_work: 5 callbacks suppressed [ 340.476722][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fdd00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 340.676913][ T2991] binder_send_failed_reply: 4 callbacks suppressed [ 340.676924][ T2991] binder: send failed reply for transaction 684 to 14887:14895 [ 340.691644][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:33 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:33 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192330834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fde00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:33 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:33 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\vc\x00\x00'], 0x0, 0x0, 0x0}) 21:13:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fdf00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:33 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192331834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe000001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 341.264737][T14926] binder: 14915:14926 ERROR: BC_REGISTER_LOOPER called without request 21:13:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe100001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\fc\x00\x00'], 0x0, 0x0, 0x0}) [ 341.393702][ T2991] binder: send failed reply for transaction 688 to 14915:14926 [ 341.419806][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe200001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:34 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:34 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192332834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe300001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 341.585143][ T7923] binder: send failed reply for transaction 692 to 14935:14941 [ 341.604266][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:13:34 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\rc\x00\x00'], 0x0, 0x0, 0x0}) 21:13:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe400001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:34 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192333834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:34 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe500001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02630440"], 0x0, 0x0, 0x0}) 21:13:34 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192334834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 342.171813][ T2991] binder: send failed reply for transaction 696 to 14960:14961 [ 342.180545][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe600001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 342.226254][ T2991] binder_release_work: 4 callbacks suppressed [ 342.226261][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 342.317096][T14986] binder: BC_ACQUIRE_RESULT not supported [ 342.331383][T14986] binder: 14977:14986 ioctl c0306201 20000040 returned -22 [ 342.384390][ T2991] binder: send failed reply for transaction 700 to 14977:14986 [ 342.393553][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 342.405663][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:35 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe700001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) [ 342.579673][ T2991] binder: send failed reply for transaction 704 to 14993:15001 [ 342.587725][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 342.595524][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:35 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:35 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192335834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe800001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 21:13:35 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe900001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:35 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192336834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 343.014775][T15018] binder: 15010:15018 DecRefs 0 refcount change on invalid ref 0 ret -22 21:13:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03630840"], 0x0, 0x0, 0x0}) 21:13:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fea00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 343.091054][ T2991] binder: send failed reply for transaction 709 to 15010:15018 [ 343.112866][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 343.138853][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 343.242634][T15036] binder: 15028:15036 BC_FREE_BUFFER u0000000000000000 no match [ 343.273357][ T2991] binder: send failed reply for transaction 713 to 15028:15036 [ 343.281540][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 343.288883][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:36 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:36 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192337834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1feb00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:36 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\nc\b@'], 0x0, 0x0, 0x0}) 21:13:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fec00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:36 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192338834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:36 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fed00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:36 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192339834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 343.879632][T15063] binder: BC_ATTEMPT_ACQUIRE not supported [ 343.902924][T15063] binder: 15055:15063 ioctl c0306201 20000040 returned -22 21:13:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fee00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10630840"], 0x0, 0x0, 0x0}) [ 343.995828][ T2991] binder: send failed reply for transaction 717 to 15055:15063 [ 344.020591][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 344.051779][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 344.123308][T15081] binder: 15074:15081 BC_DEAD_BINDER_DONE 0000000000000000 not found 21:13:36 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fef00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:36 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019233a834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 344.184962][ T2991] binder: release 15074:15081 transaction 721 out, still active [ 344.192754][ T2991] binder: unexpected work type, 4, not freed [ 344.237175][ T2991] binder: send failed reply for transaction 721, target dead 21:13:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) 21:13:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff000001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:37 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019233b834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:37 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff100001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:37 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019233c834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 344.761727][T15109] binder: 15100:15109 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 21:13:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff200001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) [ 344.872804][ T2991] binder: send failed reply for transaction 725 to 15100:15109 [ 344.888618][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 344.996399][T15127] binder: 15122:15127 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 21:13:37 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff300001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:37 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019233d834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 345.048942][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:38 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02631040"], 0x0, 0x0, 0x0}) 21:13:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff400001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:38 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019233e834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:38 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff500001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:38 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80023f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 345.620300][T15156] binder: 15142:15156 unknown command 1074815746 [ 345.653293][T15156] binder: 15142:15156 ioctl c0306201 20000040 returned -22 21:13:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff600001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03631040"], 0x0, 0x0, 0x0}) [ 345.713160][ T7923] binder_send_failed_reply: 1 callbacks suppressed [ 345.713172][ T7923] binder: send failed reply for transaction 733 to 15142:15156 [ 345.728059][ T7923] binder_release_work: 3 callbacks suppressed [ 345.728064][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 345.767198][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 345.817186][T15172] binder: 15166:15172 unknown command 1074815747 [ 345.828915][T15172] binder: 15166:15172 ioctl c0306201 20000040 returned -22 21:13:38 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:38 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80063f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff700001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 345.885567][ T2991] binder: send failed reply for transaction 737 to 15166:15172 [ 345.893456][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 345.900511][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:39 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="04631040"], 0x0, 0x0, 0x0}) 21:13:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff800001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:39 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b800a3f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:39 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff900001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:39 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b800c3f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 346.488304][T15202] binder: 15187:15202 unknown command 1074815748 [ 346.507589][T15202] binder: 15187:15202 ioctl c0306201 20000040 returned -22 21:13:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ffa00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05631040"], 0x0, 0x0, 0x0}) [ 346.596851][ T7923] binder: send failed reply for transaction 741 to 15187:15202 [ 346.629443][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 346.753369][T15221] binder: 15215:15221 unknown command 1074815749 [ 346.764386][T15221] binder: 15215:15221 ioctl c0306201 20000040 returned -22 [ 346.790231][ T2991] binder: send failed reply for transaction 745 to 15215:15221 21:13:39 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ffb00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:39 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80103f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 346.798644][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:40 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="06631040"], 0x0, 0x0, 0x0}) 21:13:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ffc00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:40 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a02ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:40 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ffd00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 347.362330][T15249] binder: 15238:15249 unknown command 1074815750 [ 347.371965][T15249] binder: 15238:15249 ioctl c0306201 20000040 returned -22 21:13:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ffe00001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:40 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a03ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="07631040"], 0x0, 0x0, 0x0}) [ 347.470822][ T7923] binder: send failed reply for transaction 749 to 15238:15249 [ 347.489143][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 347.512158][ T7923] binder_release_work: 2 callbacks suppressed [ 347.512165][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 347.593214][T15261] binder: 15260:15261 unknown command 1074815751 [ 347.600291][T15261] binder: 15260:15261 ioctl c0306201 20000040 returned -22 21:13:40 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:40 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a04ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 347.648124][ T7923] binder: send failed reply for transaction 753 to 15260:15261 [ 347.656318][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 347.671707][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:40 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09631040"], 0x0, 0x0, 0x0}) 21:13:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:40 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a05ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:40 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:40 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a06ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 348.213603][T15294] binder: 15284:15294 BC_ACQUIRE_DONE u0000000000000000 no match 21:13:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a631040"], 0x0, 0x0, 0x0}) 21:13:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 348.313699][ T2991] binder: send failed reply for transaction 757 to 15284:15294 [ 348.330436][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 348.372137][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 348.425566][T15314] binder: 15308:15314 unknown command 1074815754 [ 348.440475][T15314] binder: 15308:15314 ioctl c0306201 20000040 returned -22 21:13:41 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:41 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a07ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 348.487798][ T7923] binder: send failed reply for transaction 761 to 15308:15314 [ 348.506266][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 348.512951][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0b631040"], 0x0, 0x0, 0x0}) 21:13:41 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a08ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:41 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:41 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 349.081172][T15344] binder: 15333:15344 unknown command 1074815755 [ 349.117713][T15344] binder: 15333:15344 ioctl c0306201 20000040 returned -22 21:13:41 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a09ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c631040"], 0x0, 0x0, 0x0}) 21:13:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 349.183899][ T2991] binder: send failed reply for transaction 765 to 15333:15344 [ 349.200000][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 349.200016][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 349.291464][T15362] binder: 15351:15362 unknown command 1074815756 [ 349.317699][T15362] binder: 15351:15362 ioctl c0306201 20000040 returned -22 21:13:42 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0a01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:42 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a0aff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0d631040"], 0x0, 0x0, 0x0}) [ 349.371242][ T7923] binder: send failed reply for transaction 769 to 15351:15362 [ 349.384574][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 349.402434][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0b01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 349.534702][T15380] binder: 15369:15380 unknown command 1074815757 [ 349.572822][T15380] binder: 15369:15380 ioctl c0306201 20000040 returned -22 [ 349.637142][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:42 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:42 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a0bff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0c01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e631040"], 0x0, 0x0, 0x0}) 21:13:42 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0d01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 349.921362][T15402] binder: 15390:15402 unknown command 1074815758 [ 349.948925][T15402] binder: 15390:15402 ioctl c0306201 20000040 returned -22 21:13:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0e01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 350.048019][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:43 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10631040"], 0x0, 0x0, 0x0}) 21:13:43 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a0cff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0f01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 350.376222][T15428] binder: 15416:15428 unknown command 1074815760 [ 350.394570][T15428] binder: 15416:15428 ioctl c0306201 20000040 returned -22 [ 350.503450][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:43 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:43 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a0dff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11631040"], 0x0, 0x0, 0x0}) 21:13:43 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:43 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a0eff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 350.819297][T15451] binder: 15442:15451 unknown command 1074815761 [ 350.836097][T15451] binder: 15442:15451 ioctl c0306201 20000040 returned -22 [ 350.933656][ T7923] binder_send_failed_reply: 3 callbacks suppressed [ 350.933667][ T7923] binder: send failed reply for transaction 785 to 15442:15451 [ 350.948965][ T7923] binder_release_work: 3 callbacks suppressed [ 350.948970][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 350.956594][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:43 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="12631040"], 0x0, 0x0, 0x0}) 21:13:43 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a0fff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 351.262385][T15476] binder: 15466:15476 unknown command 1074815762 [ 351.273964][T15476] binder: 15466:15476 ioctl c0306201 20000040 returned -22 [ 351.340856][ T7923] binder: send failed reply for transaction 789 to 15466:15476 [ 351.352360][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:13:44 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:44 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a2cff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2f631040"], 0x0, 0x0, 0x0}) 21:13:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:44 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:44 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff02804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 351.658488][T15497] binder: 15488:15497 unknown command 1074815791 [ 351.682229][T15497] binder: 15488:15497 ioctl c0306201 20000040 returned -22 [ 351.772776][ T2991] binder: send failed reply for transaction 793 to 15488:15497 [ 351.794250][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:44 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="56631040"], 0x0, 0x0, 0x0}) 21:13:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:44 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff04804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 352.079600][T15511] binder: 15510:15511 unknown command 1074815830 [ 352.087921][T15511] binder: 15510:15511 ioctl c0306201 20000040 returned -22 [ 352.178533][ T7923] binder: send failed reply for transaction 797 to 15510:15511 [ 352.199561][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:13:45 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:45 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff0a804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) 21:13:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:45 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1a01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 352.551980][T15540] binder: 15530:15540 got new transaction with bad transaction stack, transaction 801 has target 15530:0 [ 352.587408][T15540] binder: 15530:15540 transaction failed 29201/-71, size 0-0 line 3044 21:13:45 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff0e804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 352.664130][ T7923] binder: send failed reply for transaction 801 to 15530:15540 [ 352.672466][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 352.695022][ T7923] binder_release_work: 3 callbacks suppressed [ 352.695028][ T7923] binder: undelivered TRANSACTION_ERROR: 29201 [ 352.755800][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:45 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) 21:13:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1b01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:45 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff0f804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1c01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 352.950609][T15569] binder: 15561:15569 got reply transaction with bad transaction stack, transaction 806 has target 15561:0 [ 352.990749][T15569] binder: 15561:15569 transaction failed 29201/-71, size 0-0 line 2914 [ 353.051397][ T7923] binder: send failed reply for transaction 806 to 15561:15569 [ 353.059476][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 353.073194][ T7923] binder: undelivered TRANSACTION_ERROR: 29201 [ 353.081009][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:46 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:46 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff10804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1d01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 21:13:46 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1e01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 353.395739][T15587] binder: 15579:15587 got new transaction with bad transaction stack, transaction 811 has target 15579:0 21:13:46 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff60804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 353.461356][T15587] binder: 15579:15587 transaction failed 29201/-71, size 0-0 line 3044 [ 353.543240][ T7923] binder: send failed reply for transaction 811 to 15579:15587 [ 353.561171][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 353.567312][ T7923] binder: undelivered TRANSACTION_ERROR: 29201 [ 353.573750][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1f01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:46 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00801324ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:46 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 21:13:46 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640294000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 353.796176][T15613] binder: 15603:15613 got reply transaction with bad transaction stack, transaction 816 has target 15603:0 [ 353.823399][T15613] binder: 15603:15613 transaction failed 29201/-71, size 0-0 line 2914 [ 353.891160][ T2991] binder: send failed reply for transaction 816 to 15603:15613 [ 353.902146][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 353.913385][ T2991] binder: undelivered TRANSACTION_ERROR: 29201 [ 353.926030][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:46 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="080a1040"], 0x0, 0x0, 0x0}) 21:13:46 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640494000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:47 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640a94000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:47 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 354.246403][T15635] binder: 15627:15635 unknown command 1074792968 [ 354.268217][T15635] binder: 15627:15635 ioctl c0306201 20000040 returned -22 21:13:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08231040"], 0x0, 0x0, 0x0}) 21:13:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 354.361897][ T7923] binder: send failed reply for transaction 821 to 15627:15635 [ 354.382098][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 354.414863][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 354.481014][T15649] binder: 15648:15649 unknown command 1074799368 [ 354.495555][T15649] binder: 15648:15649 ioctl c0306201 20000040 returned -22 21:13:47 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:47 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640e94000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 354.549049][ T2991] binder: send failed reply for transaction 825 to 15648:15649 [ 354.556978][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 354.564202][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:47 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08251040"], 0x0, 0x0, 0x0}) 21:13:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:47 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640f94000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 355.096314][T15678] binder: 15667:15678 unknown command 1074799880 [ 355.111603][T15678] binder: 15667:15678 ioctl c0306201 20000040 returned -22 21:13:47 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:47 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f641094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="082a1040"], 0x0, 0x0, 0x0}) [ 355.367259][T15694] binder: 15693:15694 unknown command 1074801160 [ 355.375321][T15694] binder: 15693:15694 ioctl c0306201 20000040 returned -22 21:13:48 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:48 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f646094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:48 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="082b1040"], 0x0, 0x0, 0x0}) 21:13:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:48 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094020500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:48 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094040500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 355.948528][T15724] binder: 15712:15724 unknown command 1074801416 [ 355.958937][T15724] binder: 15712:15724 ioctl c0306201 20000040 returned -22 [ 356.036953][ T7923] binder_send_failed_reply: 2 callbacks suppressed [ 356.036964][ T7923] binder: send failed reply for transaction 837 to 15712:15724 [ 356.052966][ T7923] binder_release_work: 2 callbacks suppressed [ 356.052972][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:13:48 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="082d1040"], 0x0, 0x0, 0x0}) 21:13:48 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f6400940a0500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 356.221530][T15743] binder: 15735:15743 unknown command 1074801928 [ 356.244064][T15743] binder: 15735:15743 ioctl c0306201 20000040 returned -22 21:13:49 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2a01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:49 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f6400940e0500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 356.290495][ T2991] binder: send failed reply for transaction 841 to 15735:15743 [ 356.316366][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:49 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="082e1040"], 0x0, 0x0, 0x0}) 21:13:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2b01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:49 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f6400940f0500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2c01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 356.808531][T15771] binder: 15759:15771 unknown command 1074802184 [ 356.824477][T15771] binder: 15759:15771 ioctl c0306201 20000040 returned -22 [ 356.900072][ T2991] binder: send failed reply for transaction 845 to 15759:15771 [ 356.908442][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:49 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:49 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094100500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08301040"], 0x0, 0x0, 0x0}) 21:13:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2d01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 357.083227][T15787] binder: 15780:15787 unknown command 1074802696 [ 357.097425][T15787] binder: 15780:15787 ioctl c0306201 20000040 returned -22 21:13:49 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094600500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:49 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2e01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 357.188970][ T7923] binder: send failed reply for transaction 849 to 15780:15787 [ 357.201345][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:13:50 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08581040"], 0x0, 0x0, 0x0}) 21:13:50 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094001f00289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2f01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 357.666738][T15811] binder: 15810:15811 unknown command 1074812936 [ 357.673565][T15811] binder: 15810:15811 ioctl c0306201 20000040 returned -22 [ 357.720436][ T2991] binder: send failed reply for transaction 853 to 15810:15811 [ 357.735578][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 357.761892][ T2991] binder_release_work: 6 callbacks suppressed [ 357.761899][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:50 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:50 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094002000289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08641040"], 0x0, 0x0, 0x0}) 21:13:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 357.993381][T15834] binder: 15828:15834 unknown command 1074816008 [ 358.019992][T15834] binder: 15828:15834 ioctl c0306201 20000040 returned -22 21:13:50 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:50 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094004000289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 358.112229][ T2991] binder: send failed reply for transaction 857 to 15828:15834 [ 358.120741][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 358.132256][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:51 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08691040"], 0x0, 0x0, 0x0}) 21:13:51 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094001000289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 358.548461][T15862] binder: 15851:15862 unknown command 1074817288 [ 358.567887][T15862] binder: 15851:15862 ioctl c0306201 20000040 returned -22 [ 358.640350][ T7923] binder: send failed reply for transaction 861 to 15851:15862 [ 358.648446][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 358.654867][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:51 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:51 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050c109d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="086c1040"], 0x0, 0x0, 0x0}) 21:13:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 358.846580][T15878] binder: 15869:15878 unknown command 1074818056 [ 358.866793][T15878] binder: 15869:15878 ioctl c0306201 20000040 returned -22 21:13:51 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:51 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050d249d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 358.948240][ T7923] binder: send failed reply for transaction 865 to 15869:15878 [ 358.963693][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 358.971302][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:52 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="086f1040"], 0x0, 0x0, 0x0}) 21:13:52 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000502289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 359.408329][T15901] binder: 15895:15901 unknown command 1074818824 [ 359.415224][T15901] binder: 15895:15901 ioctl c0306201 20000040 returned -22 [ 359.452795][ T2991] binder: send failed reply for transaction 869 to 15895:15901 [ 359.468243][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 359.486167][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:52 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08701040"], 0x0, 0x0, 0x0}) 21:13:52 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000504289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3a01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 359.718390][T15924] binder: 15913:15924 unknown command 1074819080 [ 359.745934][T15924] binder: 15913:15924 ioctl c0306201 20000040 returned -22 21:13:52 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050a289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08731040"], 0x0, 0x0, 0x0}) [ 359.838284][ T2991] binder: send failed reply for transaction 873 to 15913:15924 [ 359.850914][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 359.870066][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 359.968062][T15934] binder: 15933:15934 unknown command 1074819848 [ 359.975592][T15934] binder: 15933:15934 ioctl c0306201 20000040 returned -22 [ 360.018438][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:52 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:52 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3b01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:52 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050e289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08751040"], 0x0, 0x0, 0x0}) [ 360.265821][T15956] binder: 15943:15956 unknown command 1074820360 [ 360.280507][T15956] binder: 15943:15956 ioctl c0306201 20000040 returned -22 [ 360.352072][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:53 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3c01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:53 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050f289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08781040"], 0x0, 0x0, 0x0}) 21:13:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3d01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 360.589090][T15973] binder: 15963:15973 unknown command 1074821128 [ 360.617825][T15973] binder: 15963:15973 ioctl c0306201 20000040 returned -22 21:13:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3e01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08630240"], 0x0, 0x0, 0x0}) [ 360.683536][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 360.791695][T15987] binder: 15981:15987 unknown command 1073898248 [ 360.798765][T15987] binder: 15981:15987 ioctl c0306201 20000040 returned -22 [ 360.833639][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:53 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:53 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000510289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3f01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08630340"], 0x0, 0x0, 0x0}) 21:13:53 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 361.153388][T16005] binder: 15992:16005 unknown command 1073963784 [ 361.164530][T16005] binder: 15992:16005 ioctl c0306201 20000040 returned -22 [ 361.211441][ T7923] binder_send_failed_reply: 4 callbacks suppressed [ 361.211452][ T7923] binder: send failed reply for transaction 893 to 15992:16005 [ 361.226991][ T7923] binder_release_work: 4 callbacks suppressed [ 361.226997][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:13:54 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08630440"], 0x0, 0x0, 0x0}) 21:13:54 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000560289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:54 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050e389d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 361.448373][T16023] binder: 16010:16023 unknown command 1074029320 21:13:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 361.493223][T16023] binder: 16010:16023 ioctl c0306201 20000040 returned -22 [ 361.575616][ T2991] binder: send failed reply for transaction 897 to 16010:16023 [ 361.592917][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:54 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08630540"], 0x0, 0x0, 0x0}) 21:13:54 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500409d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:54 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 362.040777][T16038] binder: 16037:16038 unknown command 1074094856 [ 362.062823][T16038] binder: 16037:16038 ioctl c0306201 20000040 returned -22 [ 362.108486][ T7923] binder: send failed reply for transaction 901 to 16037:16038 [ 362.116504][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:13:54 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:54 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050c6c9d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08630640"], 0x0, 0x0, 0x0}) 21:13:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:55 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050d809d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 362.301267][T16067] binder: 16057:16067 unknown command 1074160392 [ 362.331878][T16067] binder: 16057:16067 ioctl c0306201 20000040 returned -22 [ 362.430647][ T2991] binder: send failed reply for transaction 905 to 16057:16067 [ 362.446079][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:13:55 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\bc\a@'], 0x0, 0x0, 0x0}) 21:13:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:55 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050e949d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:55 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 362.911429][T16093] binder: 16083:16093 unknown command 1074225928 [ 362.953064][T16093] binder: 16083:16093 ioctl c0306201 20000040 returned -22 [ 362.986527][ T2991] binder: send failed reply for transaction 909 to 16083:16093 21:13:55 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\bc\b@'], 0x0, 0x0, 0x0}) [ 363.011378][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 363.023984][ T2991] binder_release_work: 4 callbacks suppressed [ 363.023991][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:55 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050bb49d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:55 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050cc89d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 363.160340][T16112] binder: 16101:16112 unknown command 1074291464 [ 363.173535][T16112] binder: 16101:16112 ioctl c0306201 20000040 returned -22 21:13:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4a01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 363.262934][ T2991] binder: send failed reply for transaction 913 to 16101:16112 [ 363.276170][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 363.302505][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:56 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050ddc9d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:56 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4b01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\bc\t@'], 0x0, 0x0, 0x0}) 21:13:56 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 363.802555][T16142] binder: 16134:16142 unknown command 1074357000 [ 363.818628][T16142] binder: 16134:16142 ioctl c0306201 20000040 returned -22 21:13:56 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, 0x0}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4c01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:56 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa020000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\bc\n@'], 0x0, 0x0, 0x0}) [ 363.865258][ T7923] binder: send failed reply for transaction 917 to 16134:16142 [ 363.873097][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 363.883584][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4d01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:56 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa040000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 364.004773][T16159] binder: 16149:16159 unknown command 1074422536 [ 364.029499][T16159] binder: 16149:16159 ioctl c0306201 20000040 returned -22 21:13:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4e01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\bc\v@'], 0x0, 0x0, 0x0}) [ 364.103999][ T7923] binder: send failed reply for transaction 921 to 16149:16159 [ 364.111713][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 364.129647][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 364.236285][T16171] binder: 16170:16171 unknown command 1074488072 [ 364.242690][T16171] binder: 16170:16171 ioctl c0306201 20000040 returned -22 [ 364.269187][ T2991] binder: send failed reply for transaction 925 to 16170:16171 [ 364.277048][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 364.285184][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:57 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:57 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0a0000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4f01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\bc\f@'], 0x0, 0x0, 0x0}) [ 364.648288][T16189] binder: 16180:16189 unknown command 1074553608 [ 364.669697][T16189] binder: 16180:16189 ioctl c0306201 20000040 returned -22 21:13:57 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, 0x0}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:57 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:57 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0e0000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\bc\r@'], 0x0, 0x0, 0x0}) [ 364.722643][ T7923] binder: send failed reply for transaction 929 to 16180:16189 [ 364.745599][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 364.754549][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 364.868755][T16208] binder: 16197:16208 unknown command 1074619144 [ 364.895109][T16208] binder: 16197:16208 ioctl c0306201 20000040 returned -22 21:13:57 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0f0000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 365.001394][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:58 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08630e40"], 0x0, 0x0, 0x0}) 21:13:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:58 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa100000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 365.510249][T16234] binder: 16223:16234 unknown command 1074684680 [ 365.524332][T16234] binder: 16223:16234 ioctl c0306201 20000040 returned -22 [ 365.585858][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:58 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, 0x0}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:58 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa600000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631140"], 0x0, 0x0, 0x0}) 21:13:58 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 365.731896][T16251] binder: 16240:16251 unknown command 1074881288 [ 365.753032][T16251] binder: 16240:16251 ioctl c0306201 20000040 returned -22 21:13:58 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaaf00000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 365.844894][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:13:59 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631240"], 0x0, 0x0, 0x0}) 21:13:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:59 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa170200000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 366.376095][T16281] binder: 16273:16281 unknown command 1074946824 [ 366.382482][T16281] binder: 16273:16281 ioctl c0306201 20000040 returned -22 [ 366.465426][ T7923] binder_send_failed_reply: 3 callbacks suppressed [ 366.465435][ T7923] binder: send failed reply for transaction 945 to 16273:16281 [ 366.484281][ T7923] binder_release_work: 3 callbacks suppressed [ 366.484286][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 366.491981][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:13:59 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={0x0}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:59 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000a00000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\bc/@'], 0x0, 0x0, 0x0}) 21:13:59 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, 0x0}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:59 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000e00000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 366.632617][T16299] binder: 16289:16299 unknown command 1076847368 [ 366.652535][T16299] binder: 16289:16299 ioctl c0306201 20000040 returned -22 21:13:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\bcV@'], 0x0, 0x0, 0x0}) [ 366.720185][ T7923] binder: send failed reply for transaction 949 to 16289:16299 [ 366.748865][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 366.866452][T16312] binder: 16310:16312 unknown command 1079403272 [ 366.872917][T16312] binder: 16310:16312 ioctl c0306201 20000040 returned -22 [ 366.896218][ T7923] binder: send failed reply for transaction 953 to 16310:16312 [ 366.904305][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:13:59 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:13:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5a01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:13:59 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaac00e00000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:13:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631056"], 0x0, 0x0, 0x0}) [ 367.250616][T16330] binder: 16321:16330 unknown command 1443914504 [ 367.268052][T16330] binder: 16321:16330 ioctl c0306201 20000040 returned -22 [ 367.322227][ T7923] binder: send failed reply for transaction 957 to 16321:16330 [ 367.330442][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:00 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={0x0}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5b01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:00 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000f00000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x2, 0x0, 0x0}) 21:14:00 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, 0x0}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5c01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:00 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa021700000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 367.510221][T16347] binder: 16339:16347 BC_INCREFS_DONE u0000000000000000 no match [ 367.541752][T16347] binder: 16339:16347 ioctl c0306201 20000040 returned -14 21:14:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5d01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 367.645262][ T2991] binder: send failed reply for transaction 961 to 16339:16347 [ 367.665955][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:00 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x3, 0x0, 0x0}) 21:14:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5e01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:00 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa001f00000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 368.120588][T16376] binder: 16367:16376 BC_INCREFS_DONE u0000000000000000 no match [ 368.145421][T16376] binder: 16367:16376 ioctl c0306201 20000040 returned -14 [ 368.186273][ T7923] binder: release 16367:16376 transaction 965 out, still active [ 368.199922][ T7923] binder: unexpected work type, 4, not freed [ 368.206428][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 368.212398][ T7923] binder: send failed reply for transaction 965, target dead 21:14:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={0x0}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:01 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa002000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5f01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x4, 0x0, 0x0}) 21:14:01 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, 0x0}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 368.374200][T16392] binder: 16381:16392 BC_INCREFS_DONE u0000000000000000 no match [ 368.400190][T16392] binder: 16381:16392 ioctl c0306201 20000040 returned -14 21:14:01 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa003f00000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x5, 0x0, 0x0}) [ 368.476823][ T7923] binder: send failed reply for transaction 969 to 16381:16392 [ 368.485183][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 368.546679][ T7923] binder_release_work: 4 callbacks suppressed [ 368.546687][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 368.583406][T16404] binder: 16403:16404 BC_INCREFS_DONE u0000000000000000 no match [ 368.591598][T16404] binder: 16403:16404 ioctl c0306201 20000040 returned -14 [ 368.636284][ T2991] binder: send failed reply for transaction 973 to 16403:16404 [ 368.656296][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 368.662125][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:01 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:01 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa004000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x6, 0x0, 0x0}) [ 368.949601][T16423] binder: 16415:16423 BC_INCREFS_DONE u0000000000000000 no match [ 368.973319][T16423] binder: 16415:16423 ioctl c0306201 20000040 returned -14 [ 369.018788][ T7923] binder: send failed reply for transaction 977 to 16415:16423 [ 369.026939][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 369.035325][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x0, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x7, 0x0, 0x0}) 21:14:01 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa006000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:02 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={0x0}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:02 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0ec000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 369.234448][T16441] binder: 16432:16441 BC_INCREFS_DONE u0000000000000000 no match [ 369.263020][T16441] binder: 16432:16441 ioctl c0306201 20000040 returned -14 21:14:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 369.400385][ T2991] binder: send failed reply for transaction 981 to 16432:16441 [ 369.415485][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 369.431260][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:02 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0xa, 0x0, 0x0}) 21:14:02 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00f000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 369.830749][T16470] binder: 16457:16470 BC_INCREFS_DONE u0000000000000000 no match [ 369.859691][T16470] binder: 16457:16470 ioctl c0306201 20000040 returned -14 [ 369.894962][ T2991] binder: send failed reply for transaction 985 to 16457:16470 [ 369.910384][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:02 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x0, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:02 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa004003000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x10, 0x0, 0x0}) [ 370.093490][T16487] binder: 16474:16487 BC_INCREFS_DONE u0000000000000000 no match [ 370.109771][T16487] binder: 16474:16487 ioctl c0306201 20000040 returned -14 21:14:02 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={0x0}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x48, 0x0, 0x0}) [ 370.153673][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.278385][T16498] binder: 16490:16498 BC_INCREFS_DONE u0000000000000000 no match [ 370.291438][T16498] binder: 16490:16498 ioctl c0306201 20000040 returned -14 21:14:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x4c, 0x0, 0x0}) [ 370.323273][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.424658][T16506] binder: 16500:16506 BC_INCREFS_DONE u0000000000000000 no match [ 370.432484][T16506] binder: 16500:16506 ioctl c0306201 20000040 returned -14 [ 370.463387][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:03 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:03 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000340000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x60, 0x0, 0x0}) [ 370.666146][T16521] binder: 16510:16521 ioctl c0306201 20000040 returned -14 [ 370.729097][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:03 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x0, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:03 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaafffff0000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x68, 0x0, 0x0}) [ 370.962728][T16537] binder: 16525:16537 ioctl c0306201 20000040 returned -14 21:14:03 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={0x0}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6a01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:03 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000010000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x6c, 0x0, 0x0}) [ 371.009307][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.138194][T16552] binder: 16544:16552 ioctl c0306201 20000040 returned -14 21:14:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6b01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x74, 0x0, 0x0}) 21:14:04 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:04 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000020000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 371.521787][T16570] binder: 16561:16570 ioctl c0306201 20000040 returned -14 [ 371.559953][ T2991] binder_send_failed_reply: 6 callbacks suppressed [ 371.559965][ T2991] binder: send failed reply for transaction 1013 to 16561:16570 [ 371.576336][ T2991] binder_release_work: 7 callbacks suppressed [ 371.576342][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:04 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6c01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:04 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000040000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x7a, 0x0, 0x0}) [ 371.799479][T16586] binder: 16574:16586 ioctl c0306201 20000040 returned -14 21:14:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6d01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:04 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000a0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:04 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x0, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x300, 0x0, 0x0}) [ 371.870907][ T7923] binder: send failed reply for transaction 1017 to 16574:16586 [ 371.879077][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:04 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000e0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6e01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 371.995879][T16601] binder: 16592:16601 ioctl c0306201 20000040 returned -14 [ 372.103225][ T2991] binder: send failed reply for transaction 1021 to 16592:16601 [ 372.126274][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:05 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0), 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:05 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000f0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:05 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x500, 0x0, 0x0}) 21:14:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6f01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:05 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000100000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 372.671166][T16632] binder_thread_write: 6 callbacks suppressed [ 372.671178][T16632] binder: 16624:16632 BC_INCREFS_DONE u0000000000000000 no match [ 372.691889][T16632] binder: 16624:16632 ioctl c0306201 20000040 returned -14 21:14:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x600, 0x0, 0x0}) [ 372.738661][ T2991] binder: send failed reply for transaction 1025 to 16624:16632 [ 372.750079][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:05 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x0, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:05 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000002170000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 372.859947][T16650] binder: 16639:16650 BC_INCREFS_DONE u0000000000000000 no match 21:14:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 372.907316][T16650] binder: 16639:16650 ioctl c0306201 20000040 returned -14 [ 372.979903][ T7923] binder: send failed reply for transaction 1029 to 16639:16650 [ 372.993690][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:05 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, 0x0}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:05 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000001f0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:06 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x700, 0x0, 0x0}) 21:14:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:06 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000200000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 373.501726][T16677] binder: 16668:16677 BC_INCREFS_DONE u0000000000000000 no match [ 373.522563][T16677] binder: 16668:16677 ioctl c0306201 20000040 returned -14 21:14:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 373.590633][ T2991] binder: send failed reply for transaction 1033 to 16668:16677 [ 373.602905][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 373.621063][ T2991] binder_release_work: 6 callbacks suppressed [ 373.621070][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:06 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x0, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0xa00, 0x0, 0x0}) 21:14:06 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000003f0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 373.770391][T16700] binder: 16691:16700 BC_INCREFS_DONE u0000000000000000 no match [ 373.792190][T16700] binder: 16691:16700 ioctl c0306201 20000040 returned -14 [ 373.850541][ T7923] binder: send failed reply for transaction 1037 to 16691:16700 [ 373.858628][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 373.864893][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:06 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, 0x0}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:06 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000400000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:07 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x2000, 0x0, 0x0}) 21:14:07 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000600000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:07 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 374.365402][T16724] binder: 16716:16724 BC_INCREFS_DONE u0000000000000000 no match [ 374.373187][T16724] binder: 16716:16724 ioctl c0306201 20000040 returned -14 [ 374.465114][ T7923] binder: send failed reply for transaction 1041 to 16716:16724 [ 374.473214][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:07 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:07 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaaffffff9e0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x3f00, 0x0, 0x0}) 21:14:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 374.514295][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 374.628220][T16747] binder: 16736:16747 BC_INCREFS_DONE u0000000000000000 no match [ 374.660021][T16747] binder: 16736:16747 ioctl c0306201 20000040 returned -14 [ 374.698533][ T2991] binder: send failed reply for transaction 1045 to 16736:16747 [ 374.706640][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 374.712469][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:07 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, 0x0}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:07 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7a01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:07 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000ec00000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x4800, 0x0, 0x0}) 21:14:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7b01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:07 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) [ 374.873609][T16764] binder: 16754:16764 BC_INCREFS_DONE u0000000000000000 no match [ 374.901147][T16764] binder: 16754:16764 ioctl c0306201 20000040 returned -14 21:14:07 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaafffffff00000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 375.030981][ T2991] binder: send failed reply for transaction 1049 to 16754:16764 [ 375.048484][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 375.068329][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:08 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7c01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x4c00, 0x0, 0x0}) 21:14:08 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) [ 375.490338][T16792] binder: 16780:16792 BC_INCREFS_DONE u0000000000000000 no match [ 375.507356][T16792] binder: 16780:16792 ioctl c0306201 20000040 returned -14 [ 375.553389][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:08 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={0x0}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:08 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00f0ffff0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7d01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:08 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) 21:14:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x6000, 0x0, 0x0}) 21:14:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7e01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:08 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) [ 375.716487][T16807] binder: 16800:16807 BC_INCREFS_DONE u0000000000000000 no match [ 375.766963][T16807] binder: 16800:16807 ioctl c0306201 20000040 returned -14 21:14:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7f01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 375.870120][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:09 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:09 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) 21:14:09 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa9effffff0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x6800, 0x0, 0x0}) [ 376.349979][T16830] binder: 16828:16830 BC_INCREFS_DONE u0000000000000000 no match [ 376.360254][T16830] binder: 16828:16830 ioctl c0306201 20000040 returned -14 [ 376.412547][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:09 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={0x0}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:09 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaaf0ffffff0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:09 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) 21:14:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x6c00, 0x0, 0x0}) 21:14:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:09 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000200000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 376.574332][T16854] binder: 16843:16854 ioctl c0306201 20000040 returned -14 21:14:09 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x0, 0xb1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0x1bac, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000013d000/0x18000)=nil, 0x0, 0x0, 0x10, 0x0, 0x0) [ 376.678686][ T7923] binder_send_failed_reply: 3 callbacks suppressed [ 376.678697][ T7923] binder: send failed reply for transaction 1065 to 16843:16854 [ 376.718256][ T7923] binder_release_work: 3 callbacks suppressed [ 376.718263][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 376.740074][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:09 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x7400, 0x0, 0x0}) 21:14:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:09 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000400000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 377.211984][T16879] binder: 16876:16879 ioctl c0306201 20000040 returned -14 [ 377.265475][ T7923] binder: send failed reply for transaction 1069 to 16876:16879 [ 377.274637][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 377.280707][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:10 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={0x0}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:10 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = dup(r0) ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f0000000140)) exit_group(0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000001c0)=0xff) getsockopt$inet_mreqsrc(r2, 0x0, 0x28, &(0x7f0000000240)={@local, @rand_addr, @local}, &(0x7f0000000440)=0xc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0x4e22}, {0x2, 0x4e1d, @dev}, {0x2, 0x4e25, @loopback}, 0x45, 0x8, 0x5, 0x46a, 0x0, 0x0, 0x0, 0x2000000000003}) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/rtc0\x00', 0x50000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000005800110727bd7000fcdbdf250008208e65e240e50ace75b300010004000000000000ec9cbb91caf84def9e84ba1aad9c8db991df5cd3505718dc095b204664ac40cf9af39d786708dded9d09442d93a945a4352c33e985e73f221c951c4fae76da4a90fa359e6288e04c9c1a7baec9e3536710e73a56f86bafbd969ce363dbad551ddcb1b85493d4c7fe036c46750617a045d56df7eaabe39391826f4e4ce0f7e2137010a53d0647217d7c8e14cb0c1360c926e3558fb4c5dc4d44fabc80d266f55f22848d9130abe364a08df439f6bad91dffd94d8a8928d4cb79ee334cd88a36dffa502bcab4e6cd8b709b049d415300dc3acab774b525f99285d45be5d5b605481afd79fecd2ca95ac76856ef82cca6740e2cbe879dac53bf7d06248210fdeb731ec02b0bd591378c470668c36544f9c1629fe6c8042d47ca779087627022a418b3fd4f8c26fa9c00"], 0x1}, 0x1, 0x0, 0x0, 0x20040000}, 0x1) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) ioctl$KDSKBLED(r3, 0x4b65, 0x5) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000680)={{{@in6=@local, @in=@broadcast}}, {{@in6=@local}, 0x0, @in=@multicast2}}, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000c00)={'filter\x00'}, &(0x7f0000000480)=0x78) ioctl$TCSBRK(r3, 0x5409, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000280)='TIPC\x00') getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, &(0x7f00000003c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000040)=0xca9, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1e, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f00004d2000/0x4000)=nil, 0x4000, 0x0) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000200)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r2, 0x0, 0x42, &(0x7f0000000140)={'icmp\x00'}, &(0x7f0000000180)=0x1e) 21:14:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:10 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:10 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000a00000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x7a00, 0x0, 0x0}) 21:14:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:10 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 377.441274][T16902] binder: 16892:16902 ioctl c0306201 20000040 returned -14 21:14:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:10 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000e00000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x1000000, 0x0, 0x0}) 21:14:10 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) [ 377.647675][ T7923] binder: send failed reply for transaction 1073 to 16892:16902 [ 377.670232][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 377.807277][T16928] binder_thread_write: 3 callbacks suppressed [ 377.807289][T16928] binder: 16921:16928 BC_INCREFS_DONE u0000000000000000 no match [ 377.824020][T16928] binder: 16921:16928 ioctl c0306201 20000040 returned -14 [ 378.010659][ T2991] binder: send failed reply for transaction 1077 to 16921:16928 [ 378.024011][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:11 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x0, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:12 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = dup(r0) ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f0000000140)) exit_group(0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000001c0)=0xff) getsockopt$inet_mreqsrc(r2, 0x0, 0x28, &(0x7f0000000240)={@local, @rand_addr, @local}, &(0x7f0000000440)=0xc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0x4e22}, {0x2, 0x4e1d, @dev}, {0x2, 0x4e25, @loopback}, 0x45, 0x8, 0x5, 0x46a, 0x0, 0x0, 0x0, 0x2000000000003}) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/rtc0\x00', 0x50000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000005800110727bd7000fcdbdf250008208e65e240e50ace75b300010004000000000000ec9cbb91caf84def9e84ba1aad9c8db991df5cd3505718dc095b204664ac40cf9af39d786708dded9d09442d93a945a4352c33e985e73f221c951c4fae76da4a90fa359e6288e04c9c1a7baec9e3536710e73a56f86bafbd969ce363dbad551ddcb1b85493d4c7fe036c46750617a045d56df7eaabe39391826f4e4ce0f7e2137010a53d0647217d7c8e14cb0c1360c926e3558fb4c5dc4d44fabc80d266f55f22848d9130abe364a08df439f6bad91dffd94d8a8928d4cb79ee334cd88a36dffa502bcab4e6cd8b709b049d415300dc3acab774b525f99285d45be5d5b605481afd79fecd2ca95ac76856ef82cca6740e2cbe879dac53bf7d06248210fdeb731ec02b0bd591378c470668c36544f9c1629fe6c8042d47ca779087627022a418b3fd4f8c26fa9c00"], 0x1}, 0x1, 0x0, 0x0, 0x20040000}, 0x1) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) ioctl$KDSKBLED(r3, 0x4b65, 0x5) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000680)={{{@in6=@local, @in=@broadcast}}, {{@in6=@local}, 0x0, @in=@multicast2}}, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000c00)={'filter\x00'}, &(0x7f0000000480)=0x78) ioctl$TCSBRK(r3, 0x5409, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000280)='TIPC\x00') getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, &(0x7f00000003c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000040)=0xca9, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1e, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f00004d2000/0x4000)=nil, 0x4000, 0x0) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000200)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r2, 0x0, 0x42, &(0x7f0000000140)={'icmp\x00'}, &(0x7f0000000180)=0x1e) 21:14:12 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:12 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000f00000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:12 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) 21:14:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x2000000, 0x0, 0x0}) 21:14:12 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x0, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:12 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa001000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:12 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:12 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) [ 379.724536][T16950] binder: 16949:16950 BC_INCREFS_DONE u0000000000000000 no match [ 379.732336][T16950] binder: 16949:16950 ioctl c0306201 20000040 returned -14 21:14:12 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x3000000, 0x0, 0x0}) [ 379.935992][ T2991] binder: release 16949:16950 transaction 1081 out, still active 21:14:12 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) [ 379.980658][ T2991] binder: unexpected work type, 4, not freed [ 380.025290][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 380.062164][T16978] binder: BINDER_SET_CONTEXT_MGR already set [ 380.104790][T16978] binder: 16973:16978 ioctl 40046207 0 returned -16 [ 380.105705][ T2991] binder: send failed reply for transaction 1081, target dead [ 380.161467][T16974] binder: 16973:16974 transaction failed 29189/-22, size 40-8 line 2994 [ 380.203564][T16974] binder: 16973:16974 ioctl c0306201 20000040 returned -14 [ 380.240624][ T2991] binder_release_work: 2 callbacks suppressed [ 380.240634][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:14 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = dup(r0) ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f0000000140)) exit_group(0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000001c0)=0xff) getsockopt$inet_mreqsrc(r2, 0x0, 0x28, &(0x7f0000000240)={@local, @rand_addr, @local}, &(0x7f0000000440)=0xc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0x4e22}, {0x2, 0x4e1d, @dev}, {0x2, 0x4e25, @loopback}, 0x45, 0x8, 0x5, 0x46a, 0x0, 0x0, 0x0, 0x2000000000003}) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/rtc0\x00', 0x50000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000005800110727bd7000fcdbdf250008208e65e240e50ace75b300010004000000000000ec9cbb91caf84def9e84ba1aad9c8db991df5cd3505718dc095b204664ac40cf9af39d786708dded9d09442d93a945a4352c33e985e73f221c951c4fae76da4a90fa359e6288e04c9c1a7baec9e3536710e73a56f86bafbd969ce363dbad551ddcb1b85493d4c7fe036c46750617a045d56df7eaabe39391826f4e4ce0f7e2137010a53d0647217d7c8e14cb0c1360c926e3558fb4c5dc4d44fabc80d266f55f22848d9130abe364a08df439f6bad91dffd94d8a8928d4cb79ee334cd88a36dffa502bcab4e6cd8b709b049d415300dc3acab774b525f99285d45be5d5b605481afd79fecd2ca95ac76856ef82cca6740e2cbe879dac53bf7d06248210fdeb731ec02b0bd591378c470668c36544f9c1629fe6c8042d47ca779087627022a418b3fd4f8c26fa9c00"], 0x1}, 0x1, 0x0, 0x0, 0x20040000}, 0x1) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) ioctl$KDSKBLED(r3, 0x4b65, 0x5) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000680)={{{@in6=@local, @in=@broadcast}}, {{@in6=@local}, 0x0, @in=@multicast2}}, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000c00)={'filter\x00'}, &(0x7f0000000480)=0x78) ioctl$TCSBRK(r3, 0x5409, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000280)='TIPC\x00') getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, &(0x7f00000003c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000040)=0xca9, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1e, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f00004d2000/0x4000)=nil, 0x4000, 0x0) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000200)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r2, 0x0, 0x42, &(0x7f0000000140)={'icmp\x00'}, &(0x7f0000000180)=0x1e) 21:14:14 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:14 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa006000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:14 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) 21:14:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x4000000, 0x0, 0x0}) 21:14:14 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x0, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:14 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) 21:14:14 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8a01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 381.796370][T17002] binder: 16987:17002 BC_INCREFS_DONE u0000000000000000 no match 21:14:14 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00f000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 381.867873][T17002] binder: 16987:17002 ioctl c0306201 20000040 returned -14 21:14:14 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400)='/dev/rfkill\x00', 0x0, 0x0) 21:14:14 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8b01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x5000000, 0x0, 0x0}) [ 382.091630][ T2991] binder: send failed reply for transaction 1086 to 16987:17002 [ 382.135865][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 382.166419][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 382.230454][T17028] binder: 17023:17028 BC_INCREFS_DONE u0000000000000000 no match [ 382.242452][T17028] binder: 17023:17028 ioctl c0306201 20000040 returned -14 [ 382.312511][ T7923] binder: send failed reply for transaction 1090 to 17023:17028 [ 382.320785][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 382.333339][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:16 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000), 0x10) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/tcp\x00') sendfile(r0, r1, &(0x7f00000001c0)=0xdf, 0x200) 21:14:16 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) getrandom(0x0, 0x318, 0x0) getpeername(r0, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000040)=0x80) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup2(r0, r1) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm], 0x1) 21:14:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8c01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:16 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa001702000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x6000000, 0x0, 0x0}) 21:14:16 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8d01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:16 executing program 4: perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syslog(0x9, 0x0, 0x0) eventfd(0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0) [ 383.850831][T17050] binder: 17036:17050 BC_INCREFS_DONE u0000000000000000 no match [ 383.863952][T17050] binder: 17036:17050 ioctl c0306201 20000040 returned -14 21:14:16 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000a000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8e01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:16 executing program 2: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000a00000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x7000000, 0x0, 0x0}) 21:14:16 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000e000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 384.067524][ T2991] binder: send failed reply for transaction 1094 to 17036:17050 21:14:16 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) [ 384.111446][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f8f01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 384.152711][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:16 executing program 2: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00f0ffff0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 384.221364][T17086] binder: 17075:17086 BC_INCREFS_DONE u0000000000000000 no match 21:14:17 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) [ 384.268613][T17086] binder: 17075:17086 ioctl c0306201 20000040 returned -14 [ 384.419274][ T7923] binder: send failed reply for transaction 1098 to 17075:17086 [ 384.438325][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 384.447378][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:17 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:17 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00c00e000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:17 executing program 2: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000001f0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:17 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa004003000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0xa000000, 0x0, 0x0}) 21:14:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 384.684638][T17116] binder: 17108:17116 BC_INCREFS_DONE u0000000000000000 no match [ 384.692452][T17116] binder: 17108:17116 ioctl c0306201 20000040 returned -14 21:14:17 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000f000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:17 executing program 2: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa004000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:17 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050e949d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x10000000, 0x0, 0x0}) 21:14:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 384.884310][ T2991] binder: send failed reply for transaction 1102 to 17108:17116 [ 384.901452][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 384.935945][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 385.024313][T17141] binder: 17133:17141 BC_INCREFS_DONE u0000000000000000 no match [ 385.035280][T17141] binder: 17133:17141 ioctl c0306201 20000040 returned -14 [ 385.086601][ T2991] binder: send failed reply for transaction 1106 to 17133:17141 [ 385.095517][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 385.101348][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:18 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:18 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:18 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f64009400050e949d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:18 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000217000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:18 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x20000000, 0x0, 0x0}) 21:14:18 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:18 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00001f000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:18 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000f000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 385.555022][T17161] binder: 17154:17161 BC_INCREFS_DONE u0000000000000000 no match [ 385.574606][T17161] binder: 17154:17161 ioctl c0306201 20000040 returned -14 21:14:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x3f000000, 0x0, 0x0}) [ 385.684792][ T7923] binder: send failed reply for transaction 1110 to 17154:17161 [ 385.714002][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:18 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:18 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000020000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 385.742181][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 385.816238][T17182] binder: 17173:17182 BC_INCREFS_DONE u0000000000000000 no match [ 385.861386][T17182] binder: 17173:17182 ioctl c0306201 20000040 returned -14 [ 385.952578][ T7923] binder: send failed reply for transaction 1114 to 17173:17182 [ 385.961540][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 385.968730][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:19 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:19 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000f000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x48000000, 0x0, 0x0}) 21:14:19 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00003f000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:19 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 386.421474][T17209] binder: 17202:17209 BC_INCREFS_DONE u0000000000000000 no match 21:14:19 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:19 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:19 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000040000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 386.480059][T17209] binder: 17202:17209 ioctl c0306201 20000040 returned -14 21:14:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x4c000000, 0x0, 0x0}) [ 386.622901][ T7923] binder: send failed reply for transaction 1118 to 17202:17209 [ 386.639332][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:19 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:19 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000060000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 386.664797][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9a01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 386.750788][T17236] binder: 17228:17236 BC_INCREFS_DONE u0000000000000000 no match [ 386.780570][T17236] binder: 17228:17236 ioctl c0306201 20000040 returned -14 21:14:19 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) [ 386.941171][ T2991] binder: send failed reply for transaction 1122 to 17228:17236 [ 386.974430][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 387.000463][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:19 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9b01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x60000000, 0x0, 0x0}) [ 387.232383][T17264] binder: 17256:17264 BC_INCREFS_DONE u0000000000000000 no match [ 387.251084][T17264] binder: 17256:17264 ioctl c0306201 20000040 returned -14 [ 387.299225][ T2991] binder: send failed reply for transaction 1126 to 17256:17264 [ 387.313404][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 387.328151][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:20 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000ec0000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:20 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9c01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:20 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) 21:14:20 executing program 2: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640294000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x68000000, 0x0, 0x0}) 21:14:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9d01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:20 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) 21:14:20 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000f0000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 387.506585][T17283] binder: 17270:17283 BC_INCREFS_DONE u0000000000000000 no match [ 387.536705][T17283] binder: 17270:17283 ioctl c0306201 20000040 returned -14 21:14:20 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) 21:14:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9e01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x6c000000, 0x0, 0x0}) [ 387.719278][ T7923] binder: send failed reply for transaction 1130 to 17270:17283 [ 387.738817][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 387.769229][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 387.846703][T17309] binder: 17303:17309 ioctl c0306201 20000040 returned -14 [ 387.898645][ T7923] binder: send failed reply for transaction 1134 to 17303:17309 [ 387.906735][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 387.913145][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:21 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:21 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) 21:14:21 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f9f01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:21 executing program 2: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff0e804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:21 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000040030000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x74000000, 0x0, 0x0}) 21:14:21 executing program 2: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a0cff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:21 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fa001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:21 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000003400000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 388.359764][T17328] binder: 17318:17328 ioctl c0306201 20000040 returned -14 21:14:21 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) 21:14:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x7a000000, 0x0, 0x0}) [ 388.498180][ T7923] binder: send failed reply for transaction 1138 to 17318:17328 [ 388.515387][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:21 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) [ 388.552425][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 388.629719][T17351] binder: 17343:17351 ioctl c0306201 20000040 returned -14 [ 388.723384][ T7923] binder: send failed reply for transaction 1142 to 17343:17351 [ 388.733187][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 388.745122][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:21 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:21 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fa101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:21 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) 21:14:21 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00fffff00000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:21 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0xfdfdffff, 0x0, 0x0}) 21:14:21 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940), 0x0, 0x0, 0x0) 21:14:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fa201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 389.272416][T17372] binder_thread_write: 3 callbacks suppressed [ 389.272428][T17372] binder: 17363:17372 BC_INCREFS_DONE u0000000000000000 no match [ 389.284896][T17372] binder: 17363:17372 ioctl c0306201 20000040 returned -14 21:14:22 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000100008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fa301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:22 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000200008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:22 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 389.461843][ T7923] binder: send failed reply for transaction 1146 to 17363:17372 [ 389.505809][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 389.542603][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:22 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019232d834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0xfffffdfd, 0x0, 0x0}) 21:14:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fa401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:22 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000400008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:22 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fa501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 390.157531][T17409] binder: 17398:17409 BC_INCREFS_DONE u0000000000000000 no match [ 390.168130][T17409] binder: 17398:17409 ioctl c0306201 20000040 returned -14 21:14:22 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000a00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:22 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019232c834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fa601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x100000000000000, 0x0, 0x0}) 21:14:23 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 390.338876][ T2991] binder: send failed reply for transaction 1150 to 17398:17409 [ 390.372593][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:23 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192328834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:23 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000e00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fa701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 390.452828][T17433] binder: 17426:17433 BC_INCREFS_DONE u0000000000000000 no match [ 390.509249][T17433] binder: 17426:17433 ioctl c0306201 20000040 returned -14 21:14:23 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192326834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fa801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 390.686760][ T7923] binder: send failed reply for transaction 1154 to 17426:17433 [ 390.721417][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 390.745067][ T7923] binder_release_work: 1 callbacks suppressed [ 390.745074][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:23 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:23 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000f00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x200000000000000, 0x0, 0x0}) 21:14:23 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192326834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fa901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1faa01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 390.980290][T17465] binder: 17455:17465 BC_INCREFS_DONE u0000000000000000 no match [ 391.040285][T17465] binder: 17455:17465 ioctl c0306201 20000040 returned -14 [ 391.120672][ T7923] binder: send failed reply for transaction 1158 to 17455:17465 [ 391.129225][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 391.136334][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:24 executing program 5: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019231b834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:24 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192325834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x300000000000000, 0x0, 0x0}) 21:14:24 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fab01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:24 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000001000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:24 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fac01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 391.343325][T17490] binder: 17480:17490 BC_INCREFS_DONE u0000000000000000 no match [ 391.375469][T17490] binder: 17480:17490 ioctl c0306201 20000040 returned -14 [ 391.524080][ T2991] binder: send failed reply for transaction 1162 to 17480:17490 [ 391.540853][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 391.558360][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:24 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:24 executing program 4: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="58000000140019230f834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:24 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fad01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:24 executing program 5: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192309834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:24 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000021700008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x400000000000000, 0x0, 0x0}) 21:14:24 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fae01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:24 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 391.931265][T17521] binder: 17504:17521 BC_INCREFS_DONE u0000000000000000 no match 21:14:24 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:24 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1faf01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 392.010992][T17521] binder: 17504:17521 ioctl c0306201 20000040 returned -14 21:14:24 executing program 5: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192309834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:24 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x500000000000000, 0x0, 0x0}) [ 392.214404][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fb001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:25 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000001f00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:25 executing program 5: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000021700008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fb101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 392.385650][T17552] binder: 17540:17552 BC_INCREFS_DONE u0000000000000000 no match [ 392.402989][T17552] binder: 17540:17552 ioctl c0306201 20000040 returned -14 21:14:25 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000002000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x600000000000000, 0x0, 0x0}) 21:14:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fb201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 392.525483][ T2991] binder_send_failed_reply: 1 callbacks suppressed [ 392.525495][ T2991] binder: send failed reply for transaction 1170 to 17540:17552 [ 392.577819][ T2991] binder_release_work: 1 callbacks suppressed [ 392.577825][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 392.632076][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 392.684632][T17570] binder: 17569:17570 BC_INCREFS_DONE u0000000000000000 no match [ 392.692716][T17570] binder: 17569:17570 ioctl c0306201 20000040 returned -14 [ 392.742782][ T7923] binder: send failed reply for transaction 1174 to 17569:17570 [ 392.751586][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 392.782730][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:25 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:25 executing program 5: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000021700008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fb301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:25 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x700000000000000, 0x0, 0x0}) 21:14:25 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000003f00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fb401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:25 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fb501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 393.182681][T17599] binder: 17587:17599 BC_INCREFS_DONE u0000000000000000 no match 21:14:25 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000004000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 393.223120][T17599] binder: 17587:17599 ioctl c0306201 20000040 returned -14 21:14:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0xa00000000000000, 0x0, 0x0}) 21:14:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fb601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 393.292880][ T7923] binder: send failed reply for transaction 1178 to 17587:17599 [ 393.306253][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 393.349009][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.406512][T17611] binder: 17610:17611 BC_INCREFS_DONE u0000000000000000 no match [ 393.419576][T17611] binder: 17610:17611 ioctl c0306201 20000040 returned -14 [ 393.502304][ T2991] binder: send failed reply for transaction 1182 to 17610:17611 [ 393.510423][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 393.516808][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:26 executing program 2: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000004000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fb701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:26 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000006000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:26 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x1000000000000000, 0x0, 0x0}) 21:14:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fb801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:26 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00ffffff9e00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:26 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) bind$can_raw(0xffffffffffffffff, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:26 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fb901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:26 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 394.061014][T17649] binder: 17640:17649 ioctl c0306201 20000040 returned -14 21:14:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fba01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:26 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000ec000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x2000000000000000, 0x0, 0x0}) [ 394.200627][ T7923] binder: send failed reply for transaction 1186 to 17640:17649 [ 394.239035][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fbb01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 394.262190][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 394.331712][T17667] binder_thread_write: 1 callbacks suppressed [ 394.331726][T17667] binder: 17666:17667 BC_INCREFS_DONE u0000000000000000 no match [ 394.346916][T17667] binder: 17666:17667 ioctl c0306201 20000040 returned -14 [ 394.397395][ T7923] binder: send failed reply for transaction 1190 to 17666:17667 [ 394.410375][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 394.430265][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:27 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:27 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00fffffff000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fbc01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x3f00000000000000, 0x0, 0x0}) 21:14:27 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fbd01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:27 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000f0ffff00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 394.929251][T17692] binder: 17680:17692 BC_INCREFS_DONE u0000000000000000 no match [ 394.959683][T17692] binder: 17680:17692 ioctl c0306201 20000040 returned -14 21:14:27 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fbe01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x4800000000000000, 0x0, 0x0}) [ 395.077581][ T2991] binder: send failed reply for transaction 1194 to 17680:17692 [ 395.099127][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fbf01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:27 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa009effffff00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 395.214622][T17715] binder: 17707:17715 BC_INCREFS_DONE u0000000000000000 no match [ 395.235395][T17715] binder: 17707:17715 ioctl c0306201 20000040 returned -14 [ 395.301097][ T2991] binder: send failed reply for transaction 1198 to 17707:17715 [ 395.331216][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:28 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x4c00000000000000, 0x0, 0x0}) 21:14:28 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00f0ffffff00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:28 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:28 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:28 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000002000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 395.821186][T17738] binder: 17728:17738 BC_INCREFS_DONE u0000000000000000 no match [ 395.855798][T17738] binder: 17728:17738 ioctl c0306201 20000040 returned -14 21:14:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x6000000000000000, 0x0, 0x0}) 21:14:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 395.986151][ T7923] binder: send failed reply for transaction 1202 to 17728:17738 [ 395.994836][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 396.000803][ T7923] binder_release_work: 2 callbacks suppressed [ 396.000809][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:28 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000004000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 396.104576][T17759] binder: 17753:17759 BC_INCREFS_DONE u0000000000000000 no match [ 396.130802][T17759] binder: 17753:17759 ioctl c0306201 20000040 returned -14 [ 396.212319][ T2991] binder: send failed reply for transaction 1206 to 17753:17759 [ 396.221019][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 396.232456][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:29 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x6800000000000000, 0x0, 0x0}) 21:14:29 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000a000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:29 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 396.702665][T17781] binder: 17768:17781 BC_INCREFS_DONE u0000000000000000 no match [ 396.714378][T17781] binder: 17768:17781 ioctl c0306201 20000040 returned -14 21:14:29 executing program 2 (fault-call:8 fault-nth:0): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:29 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000e000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x6c00000000000000, 0x0, 0x0}) [ 396.803130][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:29 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000f000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 396.926027][T17800] binder: 17795:17800 BC_INCREFS_DONE u0000000000000000 no match [ 396.950497][T17800] binder: 17795:17800 ioctl c0306201 20000040 returned -14 [ 397.049581][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:30 executing program 4: 21:14:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x7400000000000000, 0x0, 0x0}) 21:14:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:30 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000010000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:30 executing program 5: 21:14:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fc901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 397.591831][T17826] binder: 17819:17826 BC_INCREFS_DONE u0000000000000000 no match 21:14:30 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:30 executing program 5: 21:14:30 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000060000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:30 executing program 4: [ 397.672499][T17826] binder: 17819:17826 ioctl c0306201 20000040 returned -14 21:14:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fca01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:30 executing program 5: 21:14:30 executing program 4: 21:14:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x7a00000000000000, 0x0, 0x0}) 21:14:30 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000f0000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 397.840416][ T7923] binder_send_failed_reply: 2 callbacks suppressed [ 397.840426][ T7923] binder: send failed reply for transaction 1218 to 17819:17826 [ 397.903998][ T7923] binder_release_work: 2 callbacks suppressed [ 397.904004][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:30 executing program 4: 21:14:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fcb01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 397.962897][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 397.995892][T17859] binder: 17853:17859 BC_INCREFS_DONE u0000000000000000 no match [ 398.003671][T17859] binder: 17853:17859 ioctl c0306201 20000040 returned -14 21:14:30 executing program 5: [ 398.201091][ T7923] binder: send failed reply for transaction 1222 to 17853:17859 [ 398.209335][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 398.215272][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:31 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000004, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:31 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000017020000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:31 executing program 4: 21:14:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fcc01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:31 executing program 5: 21:14:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0xfdfdffff00000000, 0x0, 0x0}) 21:14:31 executing program 4: 21:14:31 executing program 5: 21:14:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fcd01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 398.670373][T17887] binder: 17876:17887 BC_INCREFS_DONE u0000000000000000 no match 21:14:31 executing program 4 (fault-call:7 fault-nth:0): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:31 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000a0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 398.732642][T17887] binder: 17876:17887 ioctl c0306201 20000040 returned -14 21:14:31 executing program 5 (fault-call:7 fault-nth:0): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 398.891050][ T2991] binder: send failed reply for transaction 1226 to 17876:17887 [ 398.901913][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 398.908458][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:32 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000010, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fce01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x2, 0x0}) 21:14:32 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000e0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fcf01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:32 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000c00e0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 399.539186][T17921] binder: 17910:17921 BC_INCREFS_DONE u0000000000000000 no match [ 399.611682][T17897] FAULT_INJECTION: forcing a failure. [ 399.611682][T17897] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 399.625694][T17897] CPU: 0 PID: 17897 Comm: syz-executor.4 Not tainted 5.1.0-rc2+ #37 [ 399.633686][T17897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 399.643743][T17897] Call Trace: [ 399.647045][T17897] dump_stack+0x172/0x1f0 [ 399.651384][T17897] should_fail.cold+0xa/0x15 [ 399.655992][T17897] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 399.661889][T17897] should_fail_alloc_page+0x50/0x60 [ 399.667099][T17897] __alloc_pages_nodemask+0x1a1/0x7e0 [ 399.672472][T17897] ? find_held_lock+0x35/0x130 [ 399.677248][T17897] ? __alloc_pages_slowpath+0x28b0/0x28b0 [ 399.682982][T17897] ? lock_downgrade+0x880/0x880 [ 399.688537][T17897] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 399.694792][T17897] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 399.701043][T17897] alloc_pages_current+0x107/0x210 [ 399.706165][T17897] __get_free_pages+0xc/0x40 [ 399.710814][T17897] __tlb_remove_page_size+0x2ee/0x510 [ 399.716198][T17897] unmap_page_range+0xedf/0x2330 [ 399.721179][T17897] ? kernel_text_address+0x73/0xf0 [ 399.726316][T17897] ? vm_normal_page_pmd+0x400/0x400 [ 399.731514][T17897] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 399.737798][T17897] ? uprobe_munmap+0xad/0x2b0 [ 399.742481][T17897] ? __kasan_slab_free+0x102/0x150 [ 399.747595][T17897] unmap_single_vma+0x19d/0x300 [ 399.752449][T17897] unmap_vmas+0x115/0x250 [ 399.756779][T17897] ? zap_vma_ptes+0x110/0x110 [ 399.761453][T17897] ? kasan_check_write+0x14/0x20 [ 399.766395][T17897] ? kasan_check_write+0x14/0x20 [ 399.771333][T17897] exit_mmap+0x2c2/0x530 [ 399.775574][T17897] ? __ia32_sys_munmap+0x80/0x80 [ 399.780511][T17897] ? __sanitizer_cov_trace_const_cmp4+0x9/0x20 [ 399.786741][T17897] ? rcu_read_lock_sched_held+0x110/0x130 [ 399.792469][T17897] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 399.798708][T17897] ? __khugepaged_exit+0xcf/0x400 [ 399.803786][T17897] mmput+0x15f/0x4c0 [ 399.807726][T17897] do_exit+0x816/0x2fa0 [ 399.811918][T17897] ? get_signal+0x331/0x1d50 [ 399.816519][T17897] ? mm_update_next_owner+0x640/0x640 [ 399.821893][T17897] ? kasan_check_write+0x14/0x20 [ 399.826828][T17897] ? _raw_spin_unlock_irq+0x28/0x90 [ 399.832105][T17897] ? get_signal+0x331/0x1d50 [ 399.836696][T17897] ? _raw_spin_unlock_irq+0x28/0x90 [ 399.841906][T17897] do_group_exit+0x135/0x370 [ 399.846496][T17897] get_signal+0x399/0x1d50 [ 399.850926][T17897] ? ___sys_recvmsg+0x5a0/0x5a0 [ 399.855857][T17897] do_signal+0x87/0x1940 [ 399.860135][T17897] ? setup_sigcontext+0x7d0/0x7d0 [ 399.865242][T17897] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 399.871482][T17897] ? __sys_recvmmsg+0x131/0x270 [ 399.876330][T17897] ? exit_to_usermode_loop+0x43/0x2c0 [ 399.881697][T17897] ? do_syscall_64+0x52d/0x610 [ 399.886457][T17897] ? exit_to_usermode_loop+0x43/0x2c0 [ 399.891826][T17897] ? lockdep_hardirqs_on+0x418/0x5d0 [ 399.897178][T17897] ? trace_hardirqs_on+0x67/0x230 [ 399.902207][T17897] exit_to_usermode_loop+0x244/0x2c0 [ 399.907491][T17897] do_syscall_64+0x52d/0x610 [ 399.912082][T17897] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 399.917997][T17897] RIP: 0033:0x458209 [ 399.921887][T17897] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 399.941485][T17897] RSP: 002b:00007f6c281d0c78 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 399.949891][T17897] RAX: 000000000000001a RBX: 00007f6c281d0c90 RCX: 0000000000458209 21:14:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 399.957857][T17897] RDX: 0000000000000500 RSI: 0000000020001940 RDI: 0000000000000004 [ 399.965825][T17897] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 399.973789][T17897] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6c281d16d4 [ 399.981758][T17897] R13: 00000000004c4ea5 R14: 00000000004d89f8 R15: 0000000000000006 21:14:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x3, 0x0}) [ 400.018529][ T2991] binder: send failed reply for transaction 1230 to 17910:17921 [ 400.054282][T17902] FAULT_INJECTION: forcing a failure. [ 400.054282][T17902] name failslab, interval 1, probability 0, space 0, times 0 [ 400.055752][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 400.094383][T17902] CPU: 0 PID: 17902 Comm: syz-executor.5 Not tainted 5.1.0-rc2+ #37 [ 400.102238][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.102401][T17902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 400.118587][T17902] Call Trace: [ 400.118613][T17902] dump_stack+0x172/0x1f0 [ 400.118635][T17902] should_fail.cold+0xa/0x15 [ 400.118653][T17902] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 400.118687][T17902] ? ___might_sleep+0x163/0x280 [ 400.118706][T17902] __should_failslab+0x121/0x190 [ 400.118726][T17902] should_failslab+0x9/0x14 [ 400.118741][T17902] kmem_cache_alloc+0x2b2/0x6f0 [ 400.118760][T17902] ? kasan_check_write+0x14/0x20 [ 400.118779][T17902] taskstats_exit+0x6c8/0xcf0 [ 400.118798][T17902] ? taskstats_user_cmd+0xce0/0xce0 [ 400.118818][T17902] ? _raw_spin_unlock_irq+0x5e/0x90 [ 400.131096][T17902] ? acct_collect+0x699/0x860 [ 400.131117][T17902] do_exit+0x3d4/0x2fa0 [ 400.185207][T17902] ? get_signal+0x331/0x1d50 [ 400.189807][T17902] ? find_held_lock+0x35/0x130 [ 400.194576][T17902] ? mm_update_next_owner+0x640/0x640 [ 400.199965][T17902] ? kasan_check_write+0x14/0x20 [ 400.204911][T17902] ? _raw_spin_unlock_irq+0x28/0x90 [ 400.204926][T17902] ? get_signal+0x331/0x1d50 [ 400.204939][T17902] ? _raw_spin_unlock_irq+0x28/0x90 [ 400.204968][T17902] do_group_exit+0x135/0x370 [ 400.204987][T17902] get_signal+0x399/0x1d50 [ 400.205006][T17902] ? ___sys_recvmsg+0x5a0/0x5a0 [ 400.205035][T17902] do_signal+0x87/0x1940 [ 400.205058][T17902] ? setup_sigcontext+0x7d0/0x7d0 21:14:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:32 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 400.205079][T17902] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 400.214859][T17902] ? __sys_recvmmsg+0x131/0x270 [ 400.214878][T17902] ? exit_to_usermode_loop+0x43/0x2c0 [ 400.214893][T17902] ? do_syscall_64+0x52d/0x610 [ 400.214907][T17902] ? exit_to_usermode_loop+0x43/0x2c0 [ 400.214923][T17902] ? lockdep_hardirqs_on+0x418/0x5d0 [ 400.214939][T17902] ? trace_hardirqs_on+0x67/0x230 [ 400.214967][T17902] exit_to_usermode_loop+0x244/0x2c0 [ 400.214987][T17902] do_syscall_64+0x52d/0x610 21:14:33 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000f0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 400.215006][T17902] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 400.215023][T17902] RIP: 0033:0x458209 [ 400.299870][T17902] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 400.316604][T17938] binder: 17934:17938 transaction failed 29189/-22, size 40-8 line 2994 [ 400.319483][T17902] RSP: 002b:00007fa79cf12c78 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 400.336201][T17902] RAX: 0000000000000018 RBX: 00007fa79cf12c90 RCX: 0000000000458209 21:14:33 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 400.344175][T17902] RDX: 0000000000000500 RSI: 0000000020001940 RDI: 0000000000000004 [ 400.352146][T17902] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 400.352156][T17902] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa79cf136d4 [ 400.352164][T17902] R13: 00000000004c4ea5 R14: 00000000004d89f8 R15: 0000000000000006 21:14:33 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000003f00, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 400.414668][T17936] binder: 17934:17936 BC_INCREFS_DONE u0000000000000000 no match 21:14:33 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000002170000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x4, 0x0}) [ 400.502635][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:33 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000001f0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 400.653646][T17974] binder: 17967:17974 BC_INCREFS_DONE u0000000000000000 no match 21:14:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 400.817442][ T7923] binder: send failed reply for transaction 1235 to 17967:17974 [ 400.831823][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 400.864101][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:33 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000004, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x5, 0x0}) [ 401.123751][T17991] binder: 17990:17991 BC_INCREFS_DONE u0000000000000000 no match [ 401.147725][ T2991] binder: send failed reply for transaction 1239 to 17990:17991 [ 401.155809][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 401.161703][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:33 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000004, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:34 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000004000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:34 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000200000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x6, 0x0}) 21:14:34 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000003f0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 401.489706][T18017] binder: 18006:18017 BC_INCREFS_DONE u0000000000000000 no match 21:14:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fd901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x7, 0x0}) [ 401.603698][ T7923] binder: send failed reply for transaction 1243 to 18006:18017 [ 401.629114][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fda01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 401.657244][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 401.750076][T18036] binder: 18031:18036 BC_INCREFS_DONE u0000000000000000 no match [ 401.792273][ T2991] binder: send failed reply for transaction 1247 to 18031:18036 [ 401.801800][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 401.807710][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:34 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000040000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:34 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000400000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:34 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000040000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:35 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000040000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fdb01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0xa, 0x0}) 21:14:35 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000600000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fdc01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 402.384680][T18065] binder: 18054:18065 BC_INCREFS_DONE u0000000000000000 no match 21:14:35 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000ec00000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fdd01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x10, 0x0}) [ 402.509530][ T2991] binder: send failed reply for transaction 1251 to 18054:18065 [ 402.529678][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fde01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 402.569656][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.662067][T18085] binder: 18078:18085 BC_INCREFS_DONE u0000000000000000 no match 21:14:35 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:35 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000f00000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 402.723843][ T2991] binder: send failed reply for transaction 1255 to 18078:18085 [ 402.731861][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 402.754152][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fdf01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:35 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f000000003665c4, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x48, 0x0}) 21:14:35 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:35 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000400300008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 403.292174][T18117] binder: 18108:18117 BC_INCREFS_DONE u0000000000000000 no match 21:14:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x4c, 0x0}) 21:14:36 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000034000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 403.389205][ T2991] binder: send failed reply for transaction 1259 to 18108:18117 [ 403.413694][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 403.453195][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 403.507946][T18133] binder: 18127:18133 BC_INCREFS_DONE u0000000000000000 no match [ 403.575959][ T2991] binder: send failed reply for transaction 1263 to 18127:18133 [ 403.584729][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 403.590779][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:36 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:36 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000fffff000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:36 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000001000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x60, 0x0}) 21:14:36 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000001008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:36 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:37 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000002008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 404.389938][ T7923] binder: send failed reply for transaction 1267 to 18152:18166 [ 404.417368][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 404.445943][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:37 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x68, 0x0}) 21:14:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 404.587201][T18193] binder_thread_write: 1 callbacks suppressed [ 404.587214][T18193] binder: 18185:18193 BC_INCREFS_DONE u0000000000000000 no match [ 404.623491][ T2991] binder: send failed reply for transaction 1271 to 18185:18193 [ 404.631591][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 404.644497][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:37 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000010000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:37 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000004008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fe901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x6c, 0x0}) 21:14:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:37 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000000a008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fea01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 405.145558][T18213] binder: 18201:18213 BC_INCREFS_DONE u0000000000000000 no match 21:14:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1feb01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:38 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000000e008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 405.260860][ T7923] binder: send failed reply for transaction 1275 to 18201:18213 [ 405.294098][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 405.318643][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:38 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x4, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x74, 0x0}) 21:14:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fec01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 405.467208][T18243] binder: 18234:18243 BC_INCREFS_DONE u0000000000000000 no match [ 405.542035][ T2991] binder: send failed reply for transaction 1279 to 18234:18243 [ 405.567615][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:38 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f0000003f000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fed01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:38 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000000f008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:38 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x40000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x7a, 0x0}) 21:14:38 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x4, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fee01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 406.014212][T18269] binder: 18255:18269 BC_INCREFS_DONE u0000000000000000 no match 21:14:38 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x4000000000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:38 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x40000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x300, 0x0}) 21:14:38 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000010008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 406.146618][ T2991] binder: send failed reply for transaction 1283 to 18255:18269 [ 406.164596][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:38 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x4000000000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 406.187029][ T2991] binder_release_work: 1 callbacks suppressed [ 406.187035][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 406.318256][T18296] binder: 18285:18296 BC_INCREFS_DONE u0000000000000000 no match [ 406.380678][ T2991] binder: send failed reply for transaction 1287 to 18285:18296 [ 406.389312][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 406.404896][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:39 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000040000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1fef01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:39 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x4}}], 0x500, 0x0, 0x0) 21:14:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x500, 0x0}) 21:14:39 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000217008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:39 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x4}}], 0x500, 0x0, 0x0) 21:14:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff001001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 406.941660][T18316] binder: 18313:18316 BC_INCREFS_DONE u0000000000000000 no match 21:14:39 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000001f008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x600, 0x0}) [ 407.000994][ T2991] binder: send failed reply for transaction 1291 to 18313:18316 [ 407.009282][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 407.038892][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff101001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff201001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 407.113521][T18338] binder: 18329:18338 BC_INCREFS_DONE u0000000000000000 no match 21:14:39 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000020008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 407.199449][ T7923] binder: send failed reply for transaction 1295 to 18329:18338 [ 407.215779][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 407.240457][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:40 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f000000c4653600, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x700, 0x0}) 21:14:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff301001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:40 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000003f008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:40 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x40000}}], 0x500, 0x0, 0x0) 21:14:40 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x40000}}], 0x500, 0x0, 0x0) 21:14:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff401001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 407.867204][T18371] binder: 18356:18371 BC_INCREFS_DONE u0000000000000000 no match 21:14:40 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000040008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0xa00, 0x0}) 21:14:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff501001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 407.953344][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff601001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:40 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000060008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 408.084436][T18388] binder: 18383:18388 BC_INCREFS_DONE u0000000000000000 no match [ 408.206780][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:41 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff701001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x2000, 0x0}) 21:14:41 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000ffffff9e008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:41 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x4000000000000}}], 0x500, 0x0, 0x0) 21:14:41 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x4000000000000}}], 0x500, 0x0, 0x0) 21:14:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff801001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 408.762143][T18419] binder: 18406:18419 BC_INCREFS_DONE u0000000000000000 no match 21:14:41 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000ec0008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x3f00, 0x0}) [ 408.870467][ T7923] binder_send_failed_reply: 2 callbacks suppressed [ 408.870477][ T7923] binder: send failed reply for transaction 1307 to 18406:18419 21:14:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ff901001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 408.913306][ T7923] binder_release_work: 2 callbacks suppressed [ 408.913312][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ffa01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 408.963587][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:41 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000fffffff0008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 409.052382][ T2991] binder: send failed reply for transaction 1311 to 18430:18432 [ 409.081950][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 409.101640][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:42 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x4800, 0x0}) 21:14:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ffb01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:42 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000f0ffff008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:42 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x0}}], 0x500, 0x0, 0x0) 21:14:42 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x0}}], 0x500, 0x0, 0x0) 21:14:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ffc01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:42 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00009effffff008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 409.703415][T18473] binder_thread_write: 1 callbacks suppressed [ 409.703427][T18473] binder: 18465:18473 BC_INCREFS_DONE u0000000000000000 no match 21:14:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ffd01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x4c00, 0x0}) [ 409.815999][ T2991] binder: send failed reply for transaction 1315 to 18465:18473 [ 409.828890][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 409.843251][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1ffe01001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 409.969777][T18492] binder: 18485:18492 BC_INCREFS_DONE u0000000000000000 no match 21:14:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0102001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 410.125846][ T2991] binder: send failed reply for transaction 1319 to 18485:18492 [ 410.139405][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 410.163153][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:43 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x6000, 0x0}) 21:14:43 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000f0ffffff008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0202001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:43 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x0}}], 0x500, 0x0, 0x0) 21:14:43 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x0}}], 0x500, 0x0, 0x0) 21:14:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0302001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:43 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000020000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 410.586855][T18522] binder: 18512:18522 BC_INCREFS_DONE u0000000000000000 no match 21:14:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x6800, 0x0}) 21:14:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0402001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 410.666416][ T2991] binder: send failed reply for transaction 1323 to 18512:18522 [ 410.688722][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0502001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:43 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000040000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 410.784359][T18537] binder: 18530:18537 BC_INCREFS_DONE u0000000000000000 no match [ 410.872317][ T7923] binder: send failed reply for transaction 1327 to 18530:18537 [ 410.880709][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:44 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x6c00, 0x0}) 21:14:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0602001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:44 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000a0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:44 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x0}}], 0x500, 0x0, 0x0) 21:14:44 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x0}}], 0x500, 0x0, 0x0) 21:14:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0702001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 411.529477][T18571] binder: 18555:18571 BC_INCREFS_DONE u0000000000000000 no match 21:14:44 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000e0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0802001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x7400, 0x0}) 21:14:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0902001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 411.649753][ T7923] binder: send failed reply for transaction 1331 to 18555:18571 [ 411.674140][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:44 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000f0000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 411.703213][ T7923] binder_release_work: 2 callbacks suppressed [ 411.703220][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 411.782378][T18591] binder: 18583:18591 BC_INCREFS_DONE u0000000000000000 no match [ 411.873135][ T2991] binder: send failed reply for transaction 1335 to 18583:18591 [ 411.881593][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 411.905771][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:45 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0a02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:45 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000100000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x7a00, 0x0}) 21:14:45 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x4}], 0x500, 0x0, 0x0) 21:14:45 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x4}], 0x500, 0x0, 0x0) 21:14:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0b02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:45 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000600000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 412.426017][T18606] binder: 18605:18606 BC_INCREFS_DONE u0000000000000000 no match [ 412.462766][ T7923] binder: send failed reply for transaction 1339 to 18605:18606 21:14:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x1000000, 0x0}) [ 412.480469][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 412.500877][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0c02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 412.592869][T18633] binder: 18628:18633 BC_INCREFS_DONE u0000000000000000 no match 21:14:45 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000f00000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x2000000, 0x0}) [ 412.677336][ T2991] binder: send failed reply for transaction 1343 to 18628:18633 [ 412.706781][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 412.726839][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.800195][T18649] binder: 18642:18649 BC_INCREFS_DONE u0000000000000000 no match [ 412.830606][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:46 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0d02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:46 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000170200008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x3000000, 0x0}) 21:14:46 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x40000}], 0x500, 0x0, 0x0) 21:14:46 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x40000}], 0x500, 0x0, 0x0) 21:14:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0e02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:46 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000a00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 413.371370][T18676] binder: 18660:18676 BC_INCREFS_DONE u0000000000000000 no match 21:14:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f0f02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x4000000, 0x0}) [ 413.484697][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1002001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:46 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000e00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 413.663254][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:46 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1102001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x5000000, 0x0}) 21:14:46 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000c00e00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:46 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x4000000000000}], 0x500, 0x0, 0x0) 21:14:46 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x4000000000000}], 0x500, 0x0, 0x0) 21:14:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1202001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x6000000, 0x0}) 21:14:47 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000f00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 414.268167][ T2991] binder_send_failed_reply: 3 callbacks suppressed [ 414.268179][ T2991] binder: send failed reply for transaction 1359 to 18712:18713 [ 414.296140][ T2991] binder_release_work: 3 callbacks suppressed [ 414.296146][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1302001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 414.348826][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1402001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x7000000, 0x0}) [ 414.502112][ T2991] binder: send failed reply for transaction 1363 to 18730:18736 [ 414.520364][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 414.549909][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 414.647450][ T2991] binder: send failed reply for transaction 1367 to 18746:18747 [ 414.656309][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 414.662482][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:47 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:47 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000021700008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1502001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0xa000000, 0x0}) 21:14:47 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x0}], 0x500, 0x0, 0x0) 21:14:47 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x0}], 0x500, 0x0, 0x0) [ 415.164521][T18776] binder_thread_write: 4 callbacks suppressed [ 415.164534][T18776] binder: 18763:18776 BC_INCREFS_DONE u0000000000000000 no match 21:14:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1602001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x10000000, 0x0}) [ 415.225059][ T7923] binder: send failed reply for transaction 1371 to 18763:18776 [ 415.241879][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:48 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000001f00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1702001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 415.335281][T18787] binder: 18782:18787 BC_INCREFS_DONE u0000000000000000 no match 21:14:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1802001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1902001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 415.482303][ T2991] binder: send failed reply for transaction 1375 to 18782:18787 [ 415.496258][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:48 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x20000000, 0x0}) 21:14:48 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000002000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1a02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:48 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x0}], 0x500, 0x0, 0x0) 21:14:48 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x0}], 0x500, 0x0, 0x0) 21:14:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1b02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:48 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000003f00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 416.095175][T18827] binder: 18817:18827 BC_INCREFS_DONE u0000000000000000 no match 21:14:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1c02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x3f000000, 0x0}) 21:14:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1d02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 416.211773][ T7923] binder: send failed reply for transaction 1379 to 18817:18827 [ 416.236641][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 416.334331][T18846] binder: 18838:18846 BC_INCREFS_DONE u0000000000000000 no match 21:14:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1e02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 416.468955][ T2991] binder: send failed reply for transaction 1383 to 18838:18846 [ 416.488618][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:49 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:49 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000004000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x48000000, 0x0}) 21:14:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f1f02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:49 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x0}], 0x500, 0x0, 0x0) 21:14:49 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}, 0x0}], 0x500, 0x0, 0x0) 21:14:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2002001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:49 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000006000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 417.031378][T18880] binder: 18864:18880 BC_INCREFS_DONE u0000000000000000 no match 21:14:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2102001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x4c000000, 0x0}) [ 417.144745][ T7923] binder: send failed reply for transaction 1387 to 18864:18880 [ 417.160930][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 417.183265][ T7923] binder_release_work: 4 callbacks suppressed 21:14:49 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000ec000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 417.183272][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2202001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 417.277234][T18901] binder: 18891:18901 BC_INCREFS_DONE u0000000000000000 no match [ 417.344930][ T2991] binder: send failed reply for transaction 1391 to 18891:18901 [ 417.404392][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 417.410258][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:50 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2302001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x60000000, 0x0}) 21:14:50 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000f000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:50 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x4, 0x0) 21:14:50 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x4, 0x0) 21:14:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2402001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:50 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000004003008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 417.927742][T18924] binder: 18922:18924 BC_INCREFS_DONE u0000000000000000 no match 21:14:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2502001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x68000000, 0x0}) [ 418.007075][ T7923] binder: send failed reply for transaction 1395 to 18922:18924 [ 418.023134][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:50 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000340008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 418.061537][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2602001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 418.150368][T18949] binder: 18943:18949 BC_INCREFS_DONE u0000000000000000 no match [ 418.265910][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:51 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:51 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000fffff0008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2702001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x6c000000, 0x0}) 21:14:51 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x40000, 0x0) 21:14:51 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x40000, 0x0) 21:14:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2802001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 418.810082][T18980] binder: 18968:18980 BC_INCREFS_DONE u0000000000000000 no match 21:14:51 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000018449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x74000000, 0x0}) 21:14:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2902001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 418.943325][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:51 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000028449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2a02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 419.099295][T19005] binder: 18996:19005 BC_INCREFS_DONE u0000000000000000 no match [ 419.201162][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:52 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2b02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:52 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000048449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x7a000000, 0x0}) 21:14:52 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x4000000000000, 0x0) 21:14:52 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x4000000000000, 0x0) 21:14:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2c02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:52 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000000a8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2d02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0xfdfdffff, 0x0}) [ 419.844990][ T2991] binder_send_failed_reply: 3 callbacks suppressed [ 419.845002][ T2991] binder: send failed reply for transaction 1411 to 19022:19035 [ 419.887207][ T2991] binder_release_work: 3 callbacks suppressed [ 419.887213][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 419.922298][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2e02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:52 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000000e8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 420.038114][ T7923] binder: send failed reply for transaction 1415 to 19044:19051 [ 420.054336][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 420.084065][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:53 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0xfffffdfd, 0x0}) 21:14:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f2f02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:53 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000000f8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:53 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0xfffffffffffffe01) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)=ANY=[@ANYBLOB="01060000030000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100000000000000000000008e15adecfc04aba1"], 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:53 executing program 4: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x20000, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r1, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r3, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3002001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:53 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000108449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 420.666097][T19075] binder_thread_write: 2 callbacks suppressed [ 420.666111][T19075] binder: 19073:19075 BC_INCREFS_DONE u0000000000000000 no match 21:14:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x100000000000000, 0x0}) [ 420.746112][ T2991] binder: send failed reply for transaction 1419 to 19073:19075 [ 420.755825][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3102001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 420.786748][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:53 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000002178449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 420.876902][T19092] binder: 19091:19092 BC_INCREFS_DONE u0000000000000000 no match 21:14:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x200000000000000, 0x0}) [ 420.927903][ T2991] binder: send failed reply for transaction 1423 to 19091:19092 [ 420.940369][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 420.958287][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 421.038743][T19110] binder: 19104:19110 BC_INCREFS_DONE u0000000000000000 no match [ 421.080566][ T7923] binder: send failed reply for transaction 1427 to 19104:19110 [ 421.088834][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:14:54 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3202001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:54 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000001f8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x300000000000000, 0x0}) 21:14:54 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x8000, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f00000000c0)={r3, 0x81}, &(0x7f0000000140)=0x8) r4 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r4, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r4, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:54 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x6, 0x40) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r1, 0xc0305616, &(0x7f0000000040)={0x0, {0x8, 0xfffffffffffffffa}}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r3, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3302001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:54 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000208449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 421.597551][T19138] binder: 19125:19138 BC_INCREFS_DONE u0000000000000000 no match 21:14:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x400000000000000, 0x0}) 21:14:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3402001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 421.677297][ T2991] binder: send failed reply for transaction 1431 to 19125:19138 [ 421.698588][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:54 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000003f8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 421.781248][T19153] binder: 19147:19153 BC_INCREFS_DONE u0000000000000000 no match 21:14:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3502001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 421.887203][ T2991] binder: send failed reply for transaction 1435 to 19147:19153 [ 421.901877][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:55 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x500000000000000, 0x0}) 21:14:55 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000408449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3602001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:55 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@local, @multicast2}, &(0x7f0000000040)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000100)=0x14) accept4$packet(r0, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14, 0x80000) recvmmsg(r0, &(0x7f00000027c0)=[{{&(0x7f00000017c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f00000018c0)=[{&(0x7f0000001840)=""/123, 0x7b}], 0x1, &(0x7f0000001900)=""/30, 0x1e}, 0xfffffffffffffffb}, {{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001980)=""/158, 0x9e}, {&(0x7f0000001a40)=""/243, 0xf3}, {&(0x7f0000001b40)=""/42, 0x2a}], 0x3, &(0x7f0000001bc0)=""/4, 0x4}, 0x8}, {{&(0x7f0000001c00)=@alg, 0x80, &(0x7f0000001e80)=[{&(0x7f0000001c80)=""/108, 0x6c}, {&(0x7f0000001d00)=""/231, 0xe7}, {&(0x7f0000001e00)=""/66, 0x42}], 0x3, &(0x7f0000001ec0)=""/64, 0x40}, 0x4000000000000}, {{&(0x7f0000001f00)=@ethernet={0x0, @link_local}, 0x80, &(0x7f0000002140)=[{&(0x7f0000001f80)=""/69, 0x45}, {&(0x7f0000002080)=""/113, 0x71}, {&(0x7f0000002100)=""/62, 0x3e}], 0x3, &(0x7f0000002180)}, 0x86}, {{&(0x7f00000021c0)=@tipc, 0x80, &(0x7f00000025c0)=[{&(0x7f0000003000)=""/4096, 0x1000}, {&(0x7f0000002240)=""/97, 0x61}, {&(0x7f00000022c0)=""/161, 0xa1}, {&(0x7f0000002380)=""/116, 0x74}, {&(0x7f0000002400)=""/251, 0xfb}, {&(0x7f0000002500)=""/186, 0xba}, {&(0x7f0000004000)=""/4096, 0x1000}], 0x7, &(0x7f0000002640)=""/29, 0x1d}, 0x9}, {{&(0x7f0000002680)=@x25, 0x80, &(0x7f0000002700)=[{&(0x7f0000005000)=""/4096, 0x1000}], 0x1, &(0x7f0000002740)=""/95, 0x5f}, 0x800}], 0x6, 0x40000040, &(0x7f0000002940)) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000001780)={'vcan0\x00', r1}) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) r4 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x3, 0x2) write$P9_RWSTAT(r4, &(0x7f0000000140)={0x7, 0x7f, 0x1}, 0x7) recvmmsg(r3, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:55 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = add_key(&(0x7f0000000000)='blacklist\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="0483c8fe027e149c", 0x8, 0xfffffffffffffff9) keyctl$assume_authority(0x10, r2) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r3, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:55 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000608449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3702001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 422.528130][T19189] binder: 19182:19189 BC_INCREFS_DONE u0000000000000000 no match 21:14:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3802001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x600000000000000, 0x0}) 21:14:55 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000ffffff9e8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 422.659224][ T2991] binder: send failed reply for transaction 1439 to 19182:19189 [ 422.682232][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3902001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 422.704122][ T2991] binder_release_work: 3 callbacks suppressed [ 422.704129][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 422.785326][T19209] binder: 19202:19209 BC_INCREFS_DONE u0000000000000000 no match [ 422.883863][ T7923] binder: send failed reply for transaction 1443 to 19202:19209 [ 422.891999][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 422.908345][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:14:56 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:56 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) ioctl$VT_GETSTATE(r0, 0x5603, &(0x7f00000000c0)={0x4, 0x400, 0x5}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0xff, 0x10000) getsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000100)=ANY=[@ANYBLOB="08000000000000000000320b067060658b6a0b000000005cfd41aa15f6000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100000000000000000000008e15adecfc04aba1"], 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3a02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x700000000000000, 0x0}) 21:14:56 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000000ec08449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:56 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) sendmsg$xdp(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="6afa1515aed69d90d1bc92354418fb5870ac8837e1bad1ad6bf260fe954b674c177c42c0fca921d78e68d9c3d44c47ca3cb792758a64efda386481d5abec46f0f11d482eb57abd5b594305a18242f998c38eac04d57dd4883a2aacb18f369035349bf688afd329805ec4ef27f06a09c505319e8a7ea5c512d92e11e40c6d934ae7904bf5fe9b8bb3a6aafaa19c886a2548157771e7ed3cb1c11c0d92111f596b6b6216568c06e01ed78b3d35a80cf90ff0b6048c921de9a16f4c8e2463361efdbeb5cf22f8a046a792a7cbd84d172c5712ce5040100d044f70d1", 0xda}], 0x1}, 0x40) 21:14:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3b02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 423.444493][T19236] binder: 19221:19236 BC_INCREFS_DONE u0000000000000000 no match 21:14:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0xa00000000000000, 0x0}) 21:14:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3c02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 423.528356][ T2991] binder: send failed reply for transaction 1447 to 19221:19236 [ 423.540364][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:56 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000fffffff08449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 423.577705][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3d02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3e02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 423.674210][T19254] binder: 19248:19254 BC_INCREFS_DONE u0000000000000000 no match [ 423.776889][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:57 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000f0ffff8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x1000000000000000, 0x0}) 21:14:57 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:57 executing program 4: socketpair(0x5, 0xa, 0xe96, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000340)={0x3, {{0xa, 0x4e20, 0xb3, @empty, 0x5}}, 0x0, 0x3, [{{0xa, 0x4e20, 0x4a, @empty}}, {{0xa, 0x4e23, 0xa1f, @loopback, 0x6ae6}}, {{0xa, 0x4e22, 0x1ff, @rand_addr="27e5d237b9f051296edb61d81831a9ce"}}]}, 0x210) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VIDIOC_S_JPEGCOMP(r1, 0x408c563e, &(0x7f0000000200)={0x7, 0x2, 0x0, "ef50c7c384432308b6ee44467e93002e5e310669eb45ee407da168f862614dec1c621ffb362f5f4c233b81874b3b71019371ebc326ba66708cc91c06", 0x2c, "02ae00e437267fd993525369477c3a65eca38a2afa800a9e879f2751a0177792d7c2d94766114f973bb310bbc48493b4b07e2862dbc3474d9825a3c7", 0x8}) modify_ldt$write(0x1, &(0x7f0000000000)={0x10001, 0xffffffffffffffff, 0x0, 0x383800000000, 0x4, 0xfffffffffffffc01, 0x3f, 0x100000000, 0xe3ff, 0x8000}, 0x10) bind$can_raw(r3, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r1, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000040)=ANY=[@ANYBLOB="01000000030000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00000000010000000000000000000100000000000000aba1efcbbb75f037f216fbcf1d90ba013cdde144913b1a499d4d9ef0b58ea83cbc2effc50b7b7692537a312f8ed1f76f9a89dabba69ef9456573c0ed043b154f"], 0x48}}, 0x0) r4 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x1, 0x101000) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r4, 0x4008af23, &(0x7f0000000180)={0x2, 0x3}) recvmmsg(r3, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:57 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) flock(r0, 0x2) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x4f22, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000040)=0x0) write$P9_RGETLOCK(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1e000000370100000700000000000000ff01000000000000", @ANYRES32=r4, @ANYBLOB="0000b76071d642b76c6a0822d05f15a05c029a84c489e1cd0300ceae99a215463abaf935e58682ded07eabee60c09c234f9d80c064b23c73f345e4f137117b2d109bd26e591af1ebd0077aa6e031cee675037da84a8ae5bd6f291b499a72e63b05b646a73b3e1668f4d9582ff8ce114b97d05831dd43931347aa7f3fbb975287cdf72ba6984d0392f6b5e5ffe4dc5e3d0e74ebcfb5c8cc9ab21c0d7b1f736527eea53321bddfdc0500000000000000fde40fec6578353fd3e4c015b1b7ec3bad7ef51b77a4e9a1288210c69857d1f659c2326cc57eead55ef03917e914a96ff5518186853e08b69456e6bb05ddd30c03b08aa6b3c4f0774c5d75af9770f54d132d9666e35ccce96c776218136aacb338c68e96c7e29b8d6a9e08c96d849d343903ae9a18b8f33ad4989b1731207e6cbc73ec2ce2d2b49f3275dc5cee691e1798a63291fa5b9fc13f6edc1c47dc04e663a56cd82b27940b02dca2d7f0b9e0221464723c5405391af1d02bc8c7de37882d58b8bb0a28090eaa8e32ab2ce8890abb52aef484bf85ff5e9eb13d5600c8a6888636a81d0a31d643c06f953fe6837ece3caaf8337163265dc86be01ddde4e7959650e85e8a955e924add6bd7817fce86c3eb2f8f3af293a4e6ce5f9cbcd65fd3959dca57d56e7a8a1ac91ccc3f934e0ed4191a8a67c540304ca24e80ce9a7744773bad37a263d9bab7900d3855427840d3e5ca0d68e800000000000600000000000000000000000000000000000000"], 0x1e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000340)={&(0x7f0000000280)={0x1d, r1}, 0xfffffdd2, &(0x7f0000002ff0)={&(0x7f0000000200)={0x1, 0x1000000003, 0x0, {r5, r6/1000+30000}, {r7, r8/1000+30000}, {}, 0x1, @canfd={{0x1, 0x5, 0x80000000, 0x4}, 0x19, 0x3, 0x0, 0x0, "c0fcac7e73593cd3f0759c6a4f10e1e8bf3fd91ebd8465e1aad4cb4ab90e10051e85c3a3acbf625c409f9df528e7b253dfcbb8ea8e354253d334404ee8cb1627"}}, 0x80}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f3f02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4002001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 424.378314][T19287] binder: 19270:19287 BC_INCREFS_DONE u0000000000000000 no match 21:14:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4102001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x2000000000000000, 0x0}) 21:14:57 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000009effffff8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4202001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 424.471806][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4302001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:57 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000f0ffffff8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x3f00000000000000, 0x0}) [ 424.687275][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 [ 424.846648][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:57 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x4, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4402001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:57 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000200008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x4800000000000000, 0x0}) 21:14:57 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) getitimer(0x0, &(0x7f0000000000)) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:57 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x400000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x117, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r4, 0x30, 0x0, @in={0x2, 0x4e24, @broadcast}}}, 0x90) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4502001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:58 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x10, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:58 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000400008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4602001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x4c00000000000000, 0x0}) [ 425.441304][ T2991] binder_send_failed_reply: 4 callbacks suppressed [ 425.441315][ T2991] binder: send failed reply for transaction 1467 to 19337:19349 [ 425.502413][ T2991] binder_release_work: 4 callbacks suppressed [ 425.502419][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4702001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:58 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x3f00, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:58 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000a00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 425.557225][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4802001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x6000000000000000, 0x0}) [ 425.689204][ T7923] binder: send failed reply for transaction 1471 to 19367:19371 [ 425.725747][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 425.758002][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 425.857331][T19394] binder_thread_write: 4 callbacks suppressed [ 425.857344][T19394] binder: 19389:19394 BC_INCREFS_DONE u0000000000000000 no match [ 425.933459][ T2991] binder: send failed reply for transaction 1475 to 19389:19394 [ 425.950024][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 425.973503][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:14:58 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@ethernet={0x306, @local}, 0xffffffffffffff22) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:58 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000e00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4902001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x6800000000000000, 0x0}) 21:14:58 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x4000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:58 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x2) ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000340)={0x3580000, 0x1000, "e15a44a8e50fe5c988cd722ba951ce8e604d2ecdcf366be1a57d1778a5f99ceb7e79c0bc22818f39a0c363dd4721d42fe0489da25d17421f24bd6c7258039f5a478a3a0cdb65806be3db31c0302561cafcf4b98b54b62aa20e3eb6c243827597fc649d03f3371ee82ca1a3e7397ccd94b16aada97e672f7d8dd25fa9b26cd26cba0306d6a32d5ae036c66d1f43d1f8bc137d7e451481a8a9f65e31399c4d1c483413d6ee06df97734c5dc5021815fd3e16c1c5c0ce3d332c24f13f3ac7721dd879c829c2b3c23320498919f2d6826b5c8a115312403ed8bf8611eb86aaf798f4004f27a73dbcaae02c8e0b3a56e0ea92db1a8b46fc2eefc8b01ae721bbd7b69d80fa28a156f81f1c48399bf085fa8d5260592f7713ddc189993d3b17d7e3c7655c170e801d57b42dc1ba0858cb701f11777ec4e5813271e0016347a60150d8c27327c731a38b7574268ea9b160988040c240ed9c5ac781e28ade1161207c499c4b8440f5fc554a9c8dd1657029b30e3eb402e0d8be2f217f7aa991a5963a6005bb314440fcd2d176f9c8384c4d3c96cdecc4a28e75ca7efaf7ad5945e21d195fcd6215baf9253d6c2d8912e2b7c4aff70b7b606f13a9a6c556469306ba5ed6f73231c10fee9acc5832a0a4e5028d5be6d986f0f0c26e7283fed4a81e42dea094a5be975cf0fd6310ec465b549cb81e88de7b4175a203436d5aff113467213b70fc940ea460e7dd5f00ad99173aa51c85102700a717e29d197ce0079cbd4cf8c2973779d082cbed9f847cc1f8fc932b414b9b9f63c0ee1c222724d1949d126bd2c1da36505e22d5c39c95c7f677cc9919fac25451745efb96de6c44454f14b4629a07e9d2ab3f910ab0fd0abbb2ee0baaea79510f2b6737ef1aa54a0b69c69e8cb874bf035a4d68c143de87d9c76b6a414d58d4a2583ff2f534663a904fec96de5727d17df3f63661d6296e896b43e7165487ee6a7123c84babe34c55642d5cab5ca97f54a63192d366f92ecd8287f28861e0da40771d175a2a924a5651d5fa15e9e05c931e1c4ea8496cf3ecf03a9bb4122403acde98a65a6e1e7ff7a1b800539bb56947553a778fcb1f022a4a65605232c154dce2941302513fe86089577e954e39e9b3694a03e6a295d2de1e28a982d3eb4aba0f5a8a74b170026cf094872b907242dc1f6acf48b0325f277588a447ed4d20327f4eeb86dd83b683ce2e691a132263aa49947b43d0795dc93fdc6614bcca7efcaf6cc82b47eb14e19e795467c1f8fa6f66e095f9a922fe157b89d7160b7d5a4135cb2e69258a8488299f2ddd681589772dceb31884dd179b28cf2c591f45c32b4575d8c040e78a8e06b4e0329a947ceac0bbc0561d10537509736c11ae3d813d83c8b10d7cf89fc408e38cadbaa621d7134894112263df9793e8a2e6da8b6ed25e9c174655a2b2d509099a681728defcd11b05d4e3800037bc50b00ccefb257cf1fbffced55e26bc88205c9283f3d14376aeec46a2f524eaeee53d571b3e2aac22dcce01ba4bb414bdbfbc4f406b483ab8736a77ba0cc49e240e1c66a6d2e8e5e063d82948c267c749b1f9a1dbfbf2811a5cadeb33779af129eab4794113c97b8ce7adf824d8161a16379ffe4b369b00c79d0c4ca708e41074c9bb9f02605bbb5e8302bc1d7bb79b27e65b99f042cdb9630b8ecaffec81fc54c3b827a0bc67fed629649285c82367afdc32c76008176f6bd77f89bd4aa33d7d115ecaabeca3a852f8abdafb681cbd3ba80025866d40db8aec8af4eb03d1662f7225da058e487917063ec9775df32e832ac7fa0eac0962c895feed70c42c1d18f020eef0059250209967b1b730d6656518fc0db54d50ccae83cf65c8032ba9447ba9bd725e3448618e0817d9ec4c76c0e8fb263778d248c87084176eae38a54f5873cf73441826d35fcdd9953a0365572561b71c0f1a3d1f58f3a3494aedb12caa042b6230d7d4152e5ffe2a1cd72448a78002b32bc733c58fce508df6b63442c0ba72e995f0aa5b5211bdbcaa75d4a4fcf54c12453c7b252dcbb3ef7da32d23cc2d49e611744c074f916c4eb6704f2abeddcc4a0466b093516d350be292624416f1ee91de04c7dc3302c674d22c41b6d1781fc3a65b0a88e7f155fdf97e974713bf0ba2e0af76a7b956af7f708cfb065d508df08f057647ca1fc2a68ff81cfeb083e63fd1d74ed7a1553fd5fa5233d1f923ba826def530ce0ef84c20ba6dfd8d129aa4a378ad39460904b5d68c8338cd128636493364891f69f2a7ab884e05f62cfd6b2a64b31e5e0b7daba208341afe9c18af75141ea41d933b1599672c0b5073230b3418c0b391e26c8026f0776d2883c871f33744d82027501f44f07c60985ff9c40ddd8e90f9491889c420b73f4ff0ffbde32d0a91ec6caccc9814999e3c0639b1efb2a1cdffd5613755644edde1c6d0944d8938fa9b53ac5e3e9a7993adf371fdf1380f3974049910d21fda99ae3143d242ddfcc64e880a9cf58e2a10b72717b7f1f61b98d8aa40fd1b495a67ea3acb04d709a12813583559c006ce0bebf85f149578edb9fac5ca48bc9f7a8f93077e4ee56414325562a138a7837d04430c3cfa62615424bb7bbebeddec9e287d8f7af188a1315c01e547c4f2fcef7a6b2ac2ef1ac0d4d4ed0bf17886ee6070b275ddd82bb0814c6e3cd279fe73e9c32cfd8b18f8aa26184a88aebe130fbd7d8b114e77e030e3b8f0883efcc2e184bf17b46afe6537cd6db8b194eee41c6c7ae05ac37151225a15a94ac0037d4e75acc67cf823ff658a309eb9f5f06cde6a0bf457880ab39384974d2a1a05e62087097e248d03a1bada9bd08b465e1bb0def41bae1ea4aa74746826591d788c45640695556fed215d83b1f75a53d54442d879d00be84c0bc9b87e7593d948c74e1b972abec93c1c2bda16113a2d10b0c50979e9c8bcff5b008212d0de168871e2c3bbeea1e09c2f31d1e76281d9fe5b6baeea2bd4f867502319d2a3c0db8e56b7510f547e39990c700bace16ced4ecdb2ad555f63f9cbef62254186d9366a7808ae5b88e0d9caf5a0ae0b61c23a222f21a109555895b1e7fddae42742d4cf7870fd3a9025c5e1f09d7a29b2054e1579562a51c19deaa431c9c0ecc7bb694067222262a7edb5fde60440a81126f6621bb1696448df2c6d480e09a7c3d9cf8f5798d9ca7f1752cc2384472679b9ba40f65d9daf8d46a6704ae6930ab320aa9b5e8821775405622c7229156da14ee2d1993384b4078503530a3bef601e9416fbe9dde1048019cdc7fead97a853e6db3ead061c0d6e0b5306c555167569cd886bbb2a68a76d6bb6be375a39f62779eee8a85c7c61fd2274337a2bf8206f7d1edf7c857c5601339cfa5d7bbbe28cf4bde6c7a12f3b3a2f7300a2bda82f0526c6bd458bce994dae789f44cd2c20175121e2f9e2984153072fcf3f09d2f37e02fad1b59c25f4059242f8234c22866fd5f1b2ac06997aca0b274e9331f97c1f09ca310268d0857c848cf56506aeade8c923e02ed792d4d875b5d1ae7740aee4e3a0e4e5f5749651c3e825076e2654207287d29f150664ebbd9f430d073d47beb8b68d227b1ca553e8351bb818544bbc581f8ea7bb0301c22786c34edc4ebea8615250201ee04b30ffb902c8846c7e1a048483ca43d9d55c0814716b8344e4d27decb15f341f9a21eb1ef4b19fe0f6f0b01ba41c8a2e74557c106132abc2605f34f27b3e1c5301c76d1fa580fdddff7ac342532254ff5c61e97f98c415ea2186563d8534e33859f9f35b8f3c7cc3b959324777825f05a8520aadd39fc6e00d0e2dd993c5bdae86f343a35ef110e1457547f1563d548641c90e09a31b3d1ec6473b544869fd05fde8f3a433ce9eeedae90c4897e3bfbe2ff966506c679a5825772f239bf8dd232bc5b230ab725c72a2611f15c00686fed9eee785d022e2424d970531f0538c4f969aa1af8fd07730ff4cfcce2fd34cdcee433e9c76e578f52c07259876a0da2daaef78156cc79f845fe59ed36e018973291a5d6cf110d23c3047e993ec1ca41e48fcbed44805a2a9be9e8cbed31eecd39cd0d86b59eb54aa9427ab4b6a3c3e017279c798929a481963bf32168baeb2c06a96dac019d1706dec8391bf2c3103597f762fb16e465bbe4e185184ea9b50e0a6554d0a20d442f23d86e19df2a1eb06631408c8d53dd9cd0776fd1681f0422fabb977771d8af93150b294177debb9ba87855608671ed72f9bbb05222bf99938401d6c0446e166cde401afb99e23a2490bce6205953983ca6f76a9022d8e811e8622f5717fb5555fe0b56be0cb6c2c7b046c31efa91c4568a21388b7de06fd0719a1c1f032b1d9f34009172dd098a3d24962c034017d8426ede53b15c75e43bef610a559c3d4183e69338683b963861fc4fd0282746f47266cb2dfcc22f11308fa068c01d14f42fa58775509d15e2b92378515f423623f9066ec3729f3253f4fd39a008ae76ed906c1c5019236aa8efdf16a5fed88ae4dfe87e1181589700ae8b5878aa11ce18b3080bbf512e41eaaeb12816441bbc0c549e2fd9285aa8cc05f5bef2479fb80f03a1c4c6968449e4343f708c91d081b68e8bc13f4f739c2eb161c70f4fecc7d0908a5f1e89a570f21e3223378fb40c3b520272649273bfd295aab166c45956c1990d88d504cd7eb2d1801c9c6546280a69ad538b6b22e2fe27e440275e50ad63b0bbfed77d121db0ceaf01d45f5ced1a0b4dc4c51af118046d3cbbfc33c9babc5b9ae0d18d70e94717f84b85140dc1056ca9f8859468a4052500ebc72e2a556b184bd61e4d01fbf40b9a3abb61be248703247554574ed2e2b09d566119cd99c676ba78c84bddacd42da3f5baf6d5276e328ec60986fa3c01db8185ec7510e5ada8e466184f4222d8e53d5745bd2a6cf9b49df1d6ad821d0e247cbeaecce2d006b59619e390cc1e88e32d91387b704339a53f94e52f506f76ebdeac1c8d2fe7879556c4dd321284d2c6a8c4c226345183b4710f776c325a7efc8387f3d99cf83b5f2a708b43bc926f39c6ea3df41736f292107c5a3d23d1a1ad8c17940e3ef5bc2074d6950249de7da79f3aa0add03e205d6b6c50f93cabb134d085c118ce735af84b68c05ffc2c3d952923db568762f662530471f46559fb307927a29c1062160378ffb6914b2b6cb56cc40ac2c0eeabf53a83629c2d70cc66a6b65abf8cdbc4bc04b5e83160d90f0747ca5aa230a6dc34550d2924c0c2e7c48fad4a563416aa55c6c62e451c329efe2a51ad14bb045713731162da7f54536886a51763d11f9b9f3b124274c265d6319dce1df10206ca0c245a8c82c21f13851dcd9ae6f25dd3a5c28fae0999f85f560184aaf51814c66f13674535c913325e1e216ed4f54d058cc03161a6ae1c092f259acb0f95a94dda8e0499e6eb899864f7b932dcac273a9356d712de870806e01e18a9648ff48447e1b426099f778fde6eaf898c74a0cfaabc8af5f6692ecae4580814752509c55c6baffb341ecec2e74690e735ac49fb03eb28083e72182a7b4c158de8c51bcbc357036bd9744a5350f693225a6f239e67f4110075bade3f7b677a15b6aca6e61281c9d0d94a65464cc344fe245ced017615279a9a0e08d9df0f14c257183983544d4b5b96e922589eeaf27fd869261da2ea925f64d57460eda24206d6875923bf148f6a9046a5157388ffe7eb8ac97c8484eda56a2e974db67ad7c46f0e6090616bcc16a8459bd4e0dcedf9badac5bdaad62cb78857a2f870b564de9940ee02a37d96dee3c3bd4186eed466ade0"}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {0x0, 0x0, 0x4}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r3, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4a02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:59 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x40000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 426.222728][T19418] binder: 19408:19418 BC_INCREFS_DONE u0000000000000000 no match 21:14:59 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000f00008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4b02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x6c00000000000000, 0x0}) [ 426.352280][ T2991] binder: send failed reply for transaction 1479 to 19408:19418 [ 426.381560][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:59 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x3665c4, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 426.463934][T19439] binder: 19432:19439 BC_INCREFS_DONE u0000000000000000 no match [ 426.576152][ T2991] binder: send failed reply for transaction 1483 to 19432:19439 [ 426.600207][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:14:59 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) uname(&(0x7f0000000000)=""/35) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r0, &(0x7f0000001940), 0x3ffffffffffff67, 0x0, 0x0) 21:14:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4c02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:59 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000001000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:59 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x1000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x7400000000000000, 0x0}) [ 427.106843][T19468] binder: 19462:19468 BC_INCREFS_DONE u0000000000000000 no match 21:14:59 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) ioctl$sock_SIOCGIFCONF(r2, 0x8912, &(0x7f0000000040)=@req={0x28, &(0x7f0000000000)={'veth1_to_bridge\x00', @ifru_ivalue=0x4f9}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000200)=ANY=[@ANYBLOB="010000000300000000000000000000006b4ce1b16e6069f0cdf6f3b7c68d0889d28385ff6b9fdb0c8046662c1013c5b693e123cbde813b409aec06b4b7f1f1f28b9641f2998f810ad3450b3c216b1310012993e329079f317a4128cc0687fb706f9e9a85865350557b861bfff309385307b2b0d3ba2e3dfb5304dda6c255d8c562f4b43fc6151c57264c2e8dd5a1da06a3fc0193b14b152775fc", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100000000000000000000008e15adecfc04aba1"], 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='schedstat\x00') getsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 21:14:59 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x10000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:14:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4d02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:14:59 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000006000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:14:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x7a00000000000000, 0x0}) [ 427.235995][ T2991] binder: send failed reply for transaction 1487 to 19462:19468 21:15:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4e02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 427.283959][ T2991] binder: undelivered TRANSACTION_COMPLETE 21:15:00 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x3f000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 427.342359][T19492] binder: 19481:19492 BC_INCREFS_DONE u0000000000000000 no match [ 427.488249][ T7923] binder: send failed reply for transaction 1491 to 19481:19492 [ 427.500896][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:15:00 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18d}}], 0x1, 0xfffffffffffffffd, 0x0) 21:15:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f4f02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:00 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000f000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:00 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x40000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0xfdfdffff00000000, 0x0}) [ 428.008192][T19520] binder: 19510:19520 BC_INCREFS_DONE u0000000000000000 no match 21:15:00 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="01000000030000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000a1189167fed192ae12652c1659dd6400000000008e15adecfc04aba19a1133dae399fe328a01b5bf32d831bc380637ddaa0a7f16cdc7b0b8dc8d3db6c00aa14899efde540cc569b4aba8"], 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$void(r2, 0xc0045c78) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:15:00 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000001702008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5002001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:00 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0xc4653600, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:00 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 428.135392][ T7923] binder: send failed reply for transaction 1495 to 19510:19520 [ 428.143441][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 428.191530][ T7923] binder_release_work: 4 callbacks suppressed [ 428.191536][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:15:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5102001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 428.254456][T19537] binder: 19535:19537 BC_INCREFS_DONE u0000000000000000 no match 21:15:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x4000000000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000340)='/dev/dsp#\x00', 0x8, 0x8000) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000280), &(0x7f00000002c0)=0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) lsetxattr$security_evm(&(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='security.evm\x00', &(0x7f0000000380)=@ng={0x4, 0x6, "470596024af73396a494abe66901c37969"}, 0x13, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f00000000c0)={0x0, 0x4}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f0000000140)={r5, 0x9b, "e2da2c14bf6e51998d60861113868c0eaa3017e6d7dfd7f2f6b3d8be4d0f5dd0904860978b10db22cc4e07b3d626fb2c2143ca8c34ead34874f24604c9a5bb20b0d4da7074829881116b31cefa617aab6b85b41d363836ce1bb2d289f1d80bdff4b82388e822215158ed0a6177c78b94d57a56d65e3fa704f6bae9cdef3c2fe3c6eb8cf215b35b5a51c161b92f9122d4203c72c713f4f37ca6adca"}, &(0x7f0000000200)=0xa3) 21:15:01 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000000a008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 428.358992][ T7923] binder: send failed reply for transaction 1499 to 19535:19537 [ 428.396769][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:15:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5202001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x3665c4ffffffff, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 428.428999][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 428.510622][T19568] binder: 19560:19568 BC_INCREFS_DONE u0000000000000000 no match [ 428.619580][ T7923] binder: send failed reply for transaction 1503 to 19560:19568 [ 428.632088][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 428.657063][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:15:01 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000000e008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5302001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x100000000000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:01 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@llc={0x1a, 0x118, 0xe920, 0x7fffffff, 0xc59, 0x5, @remote}, 0xffffffffffffffe6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) ioctl(r0, 0x81, &(0x7f0000000040)="591105ca0be48316721bdaa5445a1851e8365c775abc3af7f567dcdf415ef2ff42045f3226a63331e39225ee3416f4e3ce3c45b3c063c81df4c1f6a62c47d05fa11523b593683a3e94c83b756beb4f6c18169fb8edef630ae1757547") r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) write$FUSE_ENTRY(r3, 0x0, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000eb3000/0x1000)=nil, 0x1000, 0x0, 0x20150, r1, 0x20000002) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:15:01 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/214, 0xd6}, {&(0x7f0000000200)=""/211, 0xd3}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000001340)=""/218, 0xda}, {&(0x7f0000001440)=""/149, 0x95}, {&(0x7f0000003000)=""/4096, 0x1000}, {&(0x7f0000001500)=""/210, 0xd2}], 0x8, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5402001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x1000000000000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:01 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000c00e008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 429.143201][T19599] binder_alloc: 19586: binder_alloc_buf, no vma [ 429.166656][T19599] binder: 19586:19599 transaction failed 29189/-3, size 40-8 line 3147 [ 429.199808][T19604] binder: 19586:19604 BC_INCREFS_DONE u0000000000000000 no match 21:15:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5502001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:02 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x3f00000000000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = semget(0x0, 0x2, 0x108) semctl$SEM_INFO(r2, 0x0, 0x13, &(0x7f00000000c0)=""/187) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x2400, 0x100000000) [ 429.331841][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:15:02 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000000f008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5602001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:02 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x4000000000000000, 0x0, 0x4000}}], 0x500, 0x0, 0x0) [ 429.477372][T19629] binder: 19623:19629 BC_INCREFS_DONE u0000000000000000 no match [ 429.575108][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:15:02 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x117}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r3, &(0x7f0000000180)={0xb, 0x10, 0xfa00, {&(0x7f0000000040), r4, 0x3}}, 0x18) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000180)='&\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x0, 0x100) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4040aea0, &(0x7f0000000100)={0x5, 0x3, 0x4, 0x0, 0x3f, 0x7, 0x100, 0x9, 0x8, 0x1ff, 0x5, 0xd59, 0x0, 0x2, 0xffffffffffffff7e, 0x6, 0x8001, 0x3, 0xffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:15:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5702001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:02 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000217008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:02 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0xffffffffc4653600, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:02 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000000000), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5802001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:02 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4010}}], 0x500, 0x0, 0x0) 21:15:02 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000001f008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5902001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) dup2(r0, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_DISABLE(r3, 0x2401, 0x100) [ 430.210815][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:15:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5a02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 430.398819][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:15:03 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) r3 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x6, 0x0) ioctl$TIOCCBRK(r3, 0x5428) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x101400, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc4c85513, &(0x7f0000000340)={{0x3, 0x0, 0x0, 0x1, 'syz1\x00', 0x400}, 0x1, [0x3, 0x2, 0xcc, 0x101, 0x40, 0x9, 0x7d0, 0x8, 0x7, 0x7, 0x8, 0x3, 0x3f, 0x6, 0x3, 0xed, 0x5, 0x4, 0x7fff, 0x1f, 0x6, 0x3, 0x9, 0x9, 0x1, 0x7fffffff, 0x4, 0x5, 0x9, 0x3ff, 0xffffffffffff9baa, 0x80000001, 0x1, 0x81, 0xfffffffffffff4e6, 0x7fffffff, 0x5, 0xffffffff, 0x401, 0x1b5d, 0x7, 0x400, 0x3, 0x8001, 0x2, 0x1, 0x1, 0xe0000, 0x5, 0x200, 0x100000001, 0x1, 0x2, 0x9, 0x9, 0x7, 0x3ff, 0x0, 0xfffffffffffffffc, 0x0, 0xab, 0xc2, 0xc7f5, 0xff, 0x80000001, 0x61, 0x9b9, 0x80, 0x1, 0x4eaa0552, 0x1, 0x8, 0x66e9, 0xfffffffffffffffd, 0x400000000, 0x3, 0xffffffff7fffffff, 0x8, 0x71, 0x5, 0x8, 0x9, 0x5, 0x10001, 0x4, 0x1c, 0xa9, 0x5, 0x1, 0x21, 0x0, 0x4, 0x401, 0x401, 0x3, 0x7, 0x1ff, 0x3, 0x7f, 0x5, 0x400, 0x0, 0x0, 0x7f, 0xfff, 0x100000001, 0x36, 0x0, 0x8001, 0x7fffffff, 0x2, 0x100000000000, 0x1, 0x4, 0x400, 0x0, 0xffffffff, 0x7f, 0xfffffffffffffff8, 0x1492, 0x3, 0x2, 0x6, 0x7f, 0x7, 0x1, 0x7, 0x400]}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:03 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000020008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5b02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x400000, 0x0) ioctl$RTC_UIE_OFF(r2, 0x7004) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="086310cb"], 0x0, 0x0, 0x0}) 21:15:03 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)=ANY=[@ANYBLOB="4dc60800030000020000000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100000000000000000000008e15adecfc04aba1"], 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5c02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:03 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x4}}], 0x500, 0x0, 0x0) [ 431.023652][T19720] binder: 19709:19720 unknown command -888118520 [ 431.045245][T19720] binder: 19709:19720 ioctl c0306201 20000040 returned -22 21:15:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5d02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:03 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000003f008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)="71b025b0821be618c10155e3971ac2260e31f53466463cdc49c3e77d88dd13f871c8236afafb6e61c157bf53236bbaf0847d4a80a40301aa733d8f6fe1eb2e52f7c181342a56bf52b5a6d051d600eaa94fa6b9b77e62c0fd54f2c49da29d33072e1f9488fbad1d6529e8e01fe7eb4fbf5581356e0a6e60c20f5218d4d27539c3d0d21c3d64c784ba6c9719c43df7ce9ae65f0418292ae45295cfef5728524339d3053786c2b97ce0adb664aa57d51d6e04ae3c7f19b20625b6d5b9d6651da0d00572f71fb18e4eb1d8a05095449fdd1f6c45ee4d07477052bdb877ba8a7e60dc35785c8db24d228649e266c88b63694d4a6f40e9d3ebfb5b86f771d207e750935e1b9a5a5f1df0387417d866bfa70aa12c052b696377bb580cf0b197bb3daa3f5c09bec3019bfcadc4075eff5dc077d24d03868b23d6b5572b7442ede3bb844ea703b48a4dc800ca931272adc611925143bd7053a64fd1bcdef382cb632834ab2a00747ee2f07bb5e97000f645155adef460e4c0daaa9cec33a4006be51f4d4422b305e717c8d73bdab7a76f2daa1624e6c4556e06fc935d9c823e36e9faba823feb830d87651d1de7a14fb96bf30f9bba670c68fe7a184ec5c0c30c9382b29b2dd2dfbe0b7e15ee4b3ee27130f197431365b574ff9ca34b2a71454be94132340ab6778ea14e823051e23b672056266acf27f3107490b0e1b75d95a73a13fe16c6501e37668b78127058ce362b7172eff9bddcd923f978f001b81e69bb42f6f22afa832e23bfec9f65e92a7c7475be66d051719c2c5c30382fc04c8525e82a29787a741de5d36649fe42368bec029bfe79ea92c7ede73b054652d7a2f83e840301696ef26e8d6892bd33d61ae5254f43dd1f34dac41fccc478d0ed88d3590ecca617cbdebb490b5d44f2f824d69f0fd1c16d33a9ea19734b796a27885b5bfd0de567f97fc4c64e49046dd31537d4a40a29f8a2017047627210ac3ff2569efa3dbb4eef08151be04237a5dfabf8e341081d6340ea2d6b4024416413b4e769b568162fa21a3c845610e244368242b7db19940fcfa0b885a017ff413a63ba6390fa6f07aeb5caf1715d981b08ed7d588103c503cf37e96cb12ee8292f3453cb427761f1dc8d6872ab5190524d62089961633719478b759311a957dca4b5fbd452f4de2ddf24ea4ee2791a9588d8e88f367498b8644808e12eec416f153e733d96fa1a1445f1e4de1faf1c1fb8964a02dfb1092cd2d16a29e574836ecb91588f65ab4c9be33675c0cc91ccd6d04b494b2b5bcf2da3eeb571a036d287e0dbe05beeb7d576f78072ebe3065deb17ed9aedac41cb55ba9fcf95822c3c8738363e6b7fce0a9d7685f2ebfc4be310a28507b17cee9e9f0fcab2b10813e73811c5ca452764bb224b58b205a71bdce8d4415ffd8d9b2d6b9da817cfe2f292217a1f7dfd3a1a04171c5705d6a288b94efaa557c9fe4b617c6fad2fe33f361e5c279c6f2ff3afd6a4c2dab6ff5bfc6dca9b6025eb0e55dc1765db290cbdd6c2d59d37a43bce6c1aaea8e8d9f7c4638c9244c40c213f221cd13d54b59b3099d7b03dc2ebe7a6fdc4b6f0cbd380f39e440fa540afe62c8fb7f6ee69eb5dce20673b8874d941f40aac8d5af69056c94b5daeeb3f0716f635fdbe380f93a6f9fc51185cf6347374a4d6434a88c21bba9e790812cdde7b5967a2673de567adf02958358e102b1ff1aeaa3948292c37283f6012a11e5b8dae5ced3f783ba4bfaf741cd19976de157e2206697ecb13bd0f4c06e05ce864da17e9d1eecc35712550208503712f9c5c0b730226eb626e6518e65f6636b1f321076313a7198c9e6749b334f84051445107ba99508585c9102677dcfd07207fb1371112168fef45f7239c61807f82c9da5324847f32a15f801ca01af858e0ee7f54627ce94e616e790fc3a4c6f6fe279d1baf2aca86084526f8c8b4e09ebb1b6deb6b0093eeda3785afdbc87443f90cf15e8e81938456db96ae5f73b59d910d3ba42c24f318cf8aa20020280163e7145a0bd463dce2225e75201491daf045856ae80c5d3a8c526af107fb0e8e46860a7476747ce85822c3875c0d4810ccd8130bd0fbda7d0bb35312ababae2ba4f9aec039fbf8d176edfc70507b4bec1ce2c10a714d50a957333db3f4e1d3e6bb3c435291ec5fc96f3e20542cae0c9df10b1c499dd7c9bdc5bbf7f192546d989c751d73ef12018a2c0b789bb22dc4d77d4803c03fa55aa91b3737d1230dafeec3d166a715f3335d6f42f4ec12ff8535c1df8057768090222749714173afc19518d5dd289a5979994054381102c9129f6b4dc826e87d2c9977b6ec855d1624dc7c0eea0f1cc110c26da5d993811da663d469e41b473ba5e66fae62996d713510ec41cddba8bedbccdcf2c74e058cb36cc57009547c27a5a13097bd8e0ff8c4cf9ddc2d2c67acc34d0660d35d904c0bb3cff66c36042d6a6a51438092a8c448d184a51a08157c8835749b091c5d095a996bab10a4f636b930e00994f56ca294a7e2505635ae48919a321a4ef8526deae6b39ab89dba34549daed7eb117e84e39aad1c2a0ef7481011e6f2f22030f3670fb6f803cccfdd5279c5d1ca2710cefe5d4e5c5e81e3460ed8742ef5461d29ed0cd627ab7e91e7e1ff93e067450c9803f7645e3b8ccb78a67b8496af8a28d315f8470bf7e58cad009226dfbb81c436c153f0af9fcfe182ceb11e41c612fc39142bfdfcc022202ed8a0b2b39cfd30e39e25e59e443740cbbad888cf2e7e39886a8df1dbc1213e24a8292d4b6cd712aa53aa6bed0d2503a6f12ba976beb656c4d8638ab84918986840b1283de5833858c04faddbe8cbc585c0efc02cda2ef11b79e66392e1be343970a105fe3d0a3d850bbe8180051b785a139c533e7fb409fe7c84ec68ba3e420c831ded9c0b55f460fc306cbd0f2e11361cacbf725e471ec795b073c027fb09d2c51bc43a049ecbdf1f0b0964b83cc7c8afc867c1411aa35bbb1a3f0f66d0ce33ef660bb1e2ea28f110a9491a7a3d6af0b0513eb43593f31835f40281a7d96394366c367b8742de966bb26d647ee7f78e372d9d9e7a6eae880e3f9cf370df743b2be9e85512ea1fac27d7fc63a4d515548c48e2a69faffdb618600466f6bab7d0ede221fa10a22efa1e8262cf045b7ab7bde97e655c6ea02449bef83313f6a22f4069e295fb1bcd7aa1557175c865daa82aae5601d167a0dfbb95b991f62f066a6c2f9d22c5489f262c6628306e897d0f064d93cd4c4396f1f2d12e8ad482421dfb443411cc8eaccece1960199422ea055a897dc0f99ba2ff14cb27d9f4145b7ca16ef03f05070b679819568dc93d78920839b7ce5762a825798bb71908af7381f98fd2fbb6aebd37029e6b9645151960ce22805aa9355712d7c34401b73572bf8e5e2829c5b318d7b3e3112d909f2174a51d5e299bb83546a521aa70304ec44907fdfe67c58b3dade55c9bfa7454258213a018de9c30140db8feffa8e135bcf7541f2849ecac4700ad7dbe40f2c1335e4c7179d084397544f2658e5ab490097b4ae3c839e720a461783a6e9802f47970e15faaa8a7f855e2a59e523198e994b349dd61f3fe024a3e04a133fdc936fbc043f5ffcca1ffd10ab41d41e952acad26393499ffa45feeea9c5dbe3cafd8293449a4baf3c82252853158d2a9322c8a2bb782c7634432f4624fc1a70fa4b99a1c6c619acb6ef622854dfcab374cfd77e9330d38f5d895e8b3e4fa0bbd358009861e4cce51afc0ad3abbef0625d488229c7ebbbe8bb09d96534343815330c96c8f6c4dd18771e47bad8726a439289971e7906a5763c867985552ae8663acf81674126ebf408269e6f8c7256c02cb438815e81f51fbc8c42124b701187ae64c266d4892d45ddddfc57df5afff6619565669ca83ed011263cfe1f660ca0c41ab1e41a8e88243a796a9b3a1142ede777630a459cab5bd93c7a47dbaa201f607ad3d21fb2b8301a2fbb8629e090729b88107e8a364ef0f6ed0faef8c17ec4545cd646b0fb79af56d458337a89490d23352086a9e2b3ab50f969cf3daa3ce9a0f0dd5b5d90e8399cae411aff709539d3faa24064c098360140e1d4eeb752c19c1c90d7d37c6da84386f86da851284df40779e05ca525e9adf5c8e7c541c099a48bf8d7c26fc7bb827529daa1f6a1c76688c460dfd5d8dd68e7c4b13c7ddb46d77a12b79204738afc5718d11e00ac78e121f7a1003e46a75ef40a0e99632bcb118e4a456386979fb3020d7f8e8fb03d0b0590bb4cb71bc9911f6b6786007dd8f053bcafb8629ad89b948a97402a1d0fb5b06f4263ea64f48cee4438f0f3d0fa2339df9434572a851eda7d55d7bba4be32cc4a5924124756fadeafc65df5d4afaebebdf545a1c347349e314ed541b71a0d64f48ae4fd7f1811612a6fc72162c92c7acc2e9c949d4e2ad647842922dd56683a4c01e923a01829b142316502b071cd43a6b67fb4bd52460e518d16c2d5f7ec66ff047b2d0c67fe326592237444f34b86aace7a9844626bd32e1bfd426c63bc7d3ea45feed5fc0eb1bb5ed6cc679c12f02a9b26e9728fcccb10298107315006bee8a5e87583c1144ae24710bebc7fc0f1ca6985cd13519359c7a5cd89c58903a3a812211f6f42a98c6741a3c6a4f349a1ce877029cf92d7d8ca33e9f0540062877225a66dd8c75f1519dfc2289047df3727a0795fde7d2b1b4dc0bb57b3fdae6bbb2e263966d71160ecb8c5f943531305231ee241582534f7267f115dfc363504155aad7481d47d618c50b4d1f28b24cf590f196d11b9818bfc54810a0f5a409f8511cb37e0667aa52e133e49423dc14c1c5bc49163ba47d5377c2205855bf9ddc230ecbeb5b43f45ad5a5e85972a54b2adafffe4cc534c4675e02b7c8178286c0d44a12e43a55bc5a26bb63a3c1d5489c89c454818629a5fdcbadf6bf64b86b5408f6bcf2f83d0aea00ee0e3c8cd6ca786cc12561dd7581ca89aa8490cb0874ad2170ebbb6c1575c419ce79e237a14fc8b6a71e8daf1c7c3671938459e0b7c1e12ae5d4907288a9c9a06b1b5373b8a754f143a19e8c52e67f637d06ea17179c6d827debff73d612529e733d712d57bf8a12ea4bdc919d91ed07b4886365e58a3b07fd5fe1af934905ebc8f9f26ec99f1b3ddbd384d2d78f808dc7ad1d1a83b8411bcf98e619e97d5b4fd5851f432941023b968e5cd0f30f7faf5dee2f7750a1b95306e0be86e98e7ab957206a5241ab7d307d2b005ea42709472ac05afa49f494d92ad7efcedb476b63d119e45bdf2e49aa9d93e7c7e8b9359cb8e93809457909bb1cff5504223dc8141bd8fddc39f3d7bb04419116582322bc6c1b6dbb5345babf1e91ece0c19cdaedc0eed3c583722094cbf531e229485784edf53f1dfe743a0db4957d4d9b383123dd5afe1a10b96a93987dfd8c3f39ac61b0de3153dea631b3789cdeb0d1000bf16e69cee727344306df4f2119a9738dae77109601679140ac23e140062a640508431ed797ff0273b3099a590e2d20ed448acd39f89741c175a3b95ffac3292d7caf50b19a0ef53348b0cd7fb9cb9e5a660450c4fa29e4f3e59e2cfbcde702db0c0ef22361a7a3d3a7781b6212d65cf56cce36e3cea382002707c6484834bdec159449e80c463e85856ffcf288e69b0cb374710f8864d77f655e1c994e713a9b68814c0c151e063fc504323afa8275b58b34742ebd7a1516e687ef9dd50bb3f8c8a5c68e13077d20babe6b5620a529fbdda58906554b44466ba7b02f869e836e13e791b715669bfdfe61", 0x1000, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001140)={0x0, 0x0}, &(0x7f0000001180)=0xc) getgroups(0x9, &(0x7f00000011c0)=[0x0, 0xee01, 0xee01, 0xee00, 0xffffffffffffffff, 0xee00, 0x0, 0x0, 0xffffffffffffffff]) keyctl$chown(0x4, r1, r2, r3) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000001200)) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r4, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socket$inet6(0xa, 0xa, 0x857c) setxattr$trusted_overlay_nlink(&(0x7f00000013c0)='./file0\x00', &(0x7f0000001400)='trusted.overlay.nlink\x00', &(0x7f0000001440)={'U-', 0x8}, 0x28, 0x0) r6 = syz_open_dev$media(&(0x7f0000001480)='/dev/media#\x00', 0xace, 0x404000) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB="05e12c5888990de1b8f6c0585fdd400204174246b2e1438caa829a68c8377c78b134b04155cb1d3ccda4757d1cbab4f7de307b00995ed5098f94715709ece3aad10759cbf65bdc47bd65c1a4ad28bec0dcfb8c9820d8b54ab4c2b2636cc58859551d5516dc05425df1eaf957b1c35db6d85a45a6c3b92488fc2f0cab9fc76f69f7459411884d42fd15fb2277ffc0d7089b564b91ae393267108dccf68ae4e58495eee4fe8e7718"], @ANYBLOB="011100000000000000000000400000000058860000000000"], @ANYPTR=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 431.121348][ T2991] binder_send_failed_reply: 3 callbacks suppressed [ 431.121360][ T2991] binder: send failed reply for transaction 1521 to 19709:19720 [ 431.186593][ T2991] binder_release_work: 3 callbacks suppressed [ 431.186600][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 431.194398][T19734] binder: 19732:19734 ioctl 81009431 20001200 returned -22 21:15:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5e02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 431.229222][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:15:04 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000040008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:04 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000000000), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f5f02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="109faba0f6f317b2ed34400000"], 0x0, 0x0, 0x0}) 21:15:04 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000060008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:04 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000340)='/dev/zero\x00', 0x101000, 0x0) perf_event_open(&(0x7f0000000280)={0x3, 0x70, 0x2, 0x10000, 0x3, 0x3886b638, 0x0, 0x1f, 0x240, 0x4, 0x1, 0x20, 0x8, 0x3, 0x5cb, 0xffff, 0x70, 0x7fffffff, 0x3, 0x901, 0xb9b, 0x6, 0xffff, 0x1f4000000000000, 0x3, 0x7b4b, 0x100, 0x4e3b, 0x4040000000, 0x7, 0xffffffff00000000, 0x7, 0x2, 0x2, 0x5, 0x3e42538a, 0x10000, 0x5, 0x0, 0x6, 0x0, @perf_bp={&(0x7f0000000240)}, 0x3200, 0x6e, 0x4, 0x6, 0x3, 0xb8e1, 0xfffffffffffff001}, 0xffffffffffffffff, 0xf, r0, 0x1) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) r2 = semget(0x1, 0x0, 0x440) semctl$SETALL(r2, 0x0, 0x11, &(0x7f0000000000)=[0x85, 0x200, 0x3, 0x153, 0x1ff]) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r4 = syz_open_dev$vbi(&(0x7f00000003c0)='/dev/vbi#\x00', 0x1, 0x2) ioctl$DRM_IOCTL_MARK_BUFS(r4, 0x40206417, &(0x7f0000000080)={0x9, 0x2f, 0x2, 0x8, 0x16}) r5 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r5, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$IOC_PR_RELEASE(r4, 0x401070ca, &(0x7f0000000040)={0x2, 0xde80}) sendmsg$can_bcm(r1, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r5, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000380)) sendmsg$IPVS_CMD_DEL_DAEMON(r4, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r6, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x40004) 21:15:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6002001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 431.890188][T19769] binder: 19754:19769 unknown command -1599365360 [ 431.900924][T19769] binder: 19754:19769 ioctl c0306201 20000040 returned -22 21:15:04 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x10}}], 0x500, 0x0, 0x0) 21:15:04 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000ec0008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x3, 0x200040) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) utimensat(r3, &(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={{}, {r4, r5/1000+30000}}, 0x100) mlockall(0x6) fstat(r1, &(0x7f0000000300)) r6 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0xc00, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f0000000140)={0x80, 0x3, 0x5, 0x0, 0x7fff, 0x8000, 0x7, 0x1, 0xffffffff, 0x4000000000000000, 0x89, 0x3ff, 0x0, 0x3, 0x0, 0x5, 0xfffffffffffffff8, 0xc4282f0, 0x2}) openat$vimc0(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="08631040570055caeac859ccb4dd3b77e5aefb611ac07082e8fe64dd4dae6c09570b5f97b46b6167f84582ac018b9eba3bee2e3464955a875c490531990498b0ab8f9c880a229c0efe7a5fa8ee32fd8fde1da04cba42f087d58f39fdf8eb7a136b008a80d26109d594807d68fe428f6d6af26a1f4d3ca4a9fb4827de64532e74f1bc8d595855b6f40d2573c815f7e32ccc51cd0649d3fd6aebadfb623838b7"], 0x0, 0x0, 0x0}) [ 431.978499][ T7923] binder: send failed reply for transaction 1525 to 19754:19769 [ 431.987089][ T7923] binder: undelivered TRANSACTION_COMPLETE 21:15:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6102001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 432.022202][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:15:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6202001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x4030, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x4400c0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0839b9e3"], 0x0, 0x0, 0x0}) [ 432.253523][T19797] binder_alloc: 19791: binder_alloc_buf, no vma [ 432.263546][T19797] binder: 19791:19797 transaction failed 29189/-3, size 40-8 line 3147 [ 432.312856][T19797] binder: BINDER_SET_CONTEXT_MGR already set [ 432.322563][T19797] binder: 19791:19797 ioctl 40046207 0 returned -16 [ 432.322616][T19800] binder_alloc: 19791: binder_alloc_buf, no vma [ 432.336197][T19800] binder: 19791:19800 transaction failed 29189/-3, size 40-8 line 3147 [ 432.344839][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 432.350648][T19797] binder: 19791:19797 unknown command -474400504 [ 432.358392][T19797] binder: 19791:19797 ioctl c0306201 20000040 returned -22 21:15:05 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000000000), 0xfffffffffffffe5d) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:05 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000f0008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6302001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYPTR=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:15:05 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) openat$mixer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/mixer\x00', 0x20002, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e22, 0x0, @ipv4={[], [], @rand_addr=0x81}, 0x6}}, 0x0, 0x3, 0x2, 0x5, 0x80}, &(0x7f00000000c0)=0x98) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000100)={r4, @in={{0x2, 0x4e22, @local}}, 0x0, 0x10000}, &(0x7f0000000200)=0x90) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6402001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 432.756280][T19821] binder_alloc: 19811: binder_alloc_buf size 9049805330317360 failed, no address space [ 432.817841][T19812] binder_thread_write: 2 callbacks suppressed [ 432.817854][T19812] binder: 19811:19812 BC_INCREFS_DONE u0000000000000000 no match [ 432.849064][T19821] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 432.873122][T19821] binder: 19811:19821 transaction failed 29201/-28, size 40-9049805330317320 line 3147 21:15:05 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x3f00}}], 0x500, 0x0, 0x0) 21:15:05 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000002008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6502001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x80, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000100)={0x7, 0x4d, 0x2}, 0x7) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto$packet(r1, &(0x7f0000000140)="566fd7d4ad72b74bb4c8aaec9c93d1c7a7f21b1f755dfdb4a60660e5288ddd483d405639313d8749f2c0016f5bce74d6986ea10d3f4bcf085c846b1f5552f46175cb7e62bbcd86f0f5a3bc4326adfd8ea574c55f844648d810e1ec292cc6ccd4419af3bf57d4d1c40517fe3aff7031aa5a854ebb34cb6b0b89db95c945f42f5cedb0e9874a88e776fe", 0x89, 0x20000001, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0000000017db756250c4ae6945a5628f4040ca607a05da2b3fdc9d0ba889fa25d05b9bfd815adf8ec4b574d836c10e66a26675113075e5f496ddb722e1e882eec547a80aa1aeb00186829fef0de37d973631876b5900a9bbf6dcc234f4f4e6cd014e26a03874807c3244c72d2a87fe2d6009db819210c2072c8b6ef5534b3189bcb8ace03c87085ea09d75f7e96bf997b69c53bb627a2324a1bb241b6d5cf591d0fefe44de47af42890afb3924db12d9614ccae0f128fb64be43fa4f6ad6a337e12f4e4b724eda67303cb5830ea67aa93162d5f03e51ef8bbfa6fcfb7dcc0c2cf6628d2de52366e8dea710eac079"], 0x0, 0x0, 0x0}) 21:15:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6602001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:05 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000004008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 433.043770][T19846] binder: 19838:19846 unknown command 0 [ 433.062573][T19846] binder: 19838:19846 ioctl c0306201 20000040 returned -22 [ 433.180949][ T7923] binder: send failed reply for transaction 1535 to 19838:19846 [ 433.189104][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 433.211293][ T7923] binder_release_work: 2 callbacks suppressed [ 433.211300][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:15:06 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000000)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000000080)={&(0x7f000000afb8)=ANY=[@ANYBLOB="01000000030000000000000000000000", @ANYRES16, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000400001100000000008e15adecfc04ab19ce0100000000"], 0x6}}, 0xfffffffffffffffe) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6702001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc4c85512, &(0x7f0000000100)={{0x6, 0x6, 0x9, 0x8, '\x00', 0xffffffffffff7fff}, 0x1, [0xc9d, 0x2, 0x7fff, 0x1, 0x6, 0x6, 0x7, 0x0, 0xffffffff, 0x5, 0x7fffffff, 0x6, 0x2, 0x9, 0x200, 0x5, 0x7, 0x80000001, 0x22a2, 0x1ff, 0x4, 0x3, 0x100000000, 0x8, 0x6, 0x7fff, 0x0, 0x3, 0x8, 0x5, 0x7, 0x10000, 0x34, 0x3, 0x1ff, 0x68f8, 0xfc7d, 0x1, 0x7f, 0xf40, 0xfff, 0x1, 0x0, 0x7, 0x0, 0x10001, 0x2, 0x3, 0x4, 0x4000000000000, 0xfff, 0xb5, 0x5, 0x8, 0x1, 0x8000, 0xfff, 0x7fffffff, 0xffffffff00000001, 0x1ff, 0x3, 0x9, 0x8, 0x40, 0x3, 0x1, 0x8f87, 0x80000001, 0x80, 0xffffffffffffff01, 0x8, 0x80, 0xb3, 0x0, 0x4, 0x6d5f, 0x100000000, 0x80000000, 0x1, 0xffffffffffffffab, 0x9, 0x8, 0x6, 0xfc, 0x4, 0xfffffffffffff56d, 0x200, 0x6, 0x679f2b76, 0xef4, 0x40, 0x2c7, 0xdb7, 0x0, 0x200, 0x101, 0xffff, 0x401, 0x446aa553, 0x4, 0x9, 0x9, 0x2, 0x1, 0xffffffff7fffffff, 0x0, 0xd8f, 0xfffffffffffffffa, 0x6, 0x4, 0x5, 0xb91, 0x3, 0x0, 0x2, 0x80000000, 0x0, 0xe2f8, 0x0, 0x7, 0x101, 0xa1, 0x3, 0x7, 0x675, 0x0, 0x6, 0xafdf], {0x77359400}}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:15:06 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000000a008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 433.606392][T19872] binder: 19859:19872 BC_INCREFS_DONE u0000000000000000 no match 21:15:06 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x200600, 0x0) write$P9_RFSYNC(r3, &(0x7f0000000040)={0x7, 0x33, 0x1}, 0x7) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6802001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 433.671491][ T7923] binder: send failed reply for transaction 1539 to 19859:19872 [ 433.680151][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 433.715822][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:15:06 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x4000}}], 0x500, 0x0, 0x0) 21:15:06 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000000e008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x400000, 0x0) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000140)=0x100) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="cf"]) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_open_dev$swradio(0x0, 0x1, 0x2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000fc0)={0x0, 0x0, &(0x7f0000000f80)={&(0x7f0000002040)={0x14}, 0x14}}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000440)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r7, 0xae9a) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:15:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6902001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6a02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:06 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa00000000000f008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 434.069496][ T2991] binder: release 19883:19894 transaction 1543 out, still active [ 434.103093][ T2991] binder: unexpected work type, 4, not freed [ 434.127549][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 434.134106][ T2991] binder: send failed reply for transaction 1543, target dead 21:15:07 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@in={0x2, 0x4e23, @multicast2}, 0x186) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) dup2(r0, r0) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)=ANY=[@ANYBLOB="01000000030000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100aba10000000000001000"], 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x18000, 0x0) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0xfffffffffffffffc) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:15:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6b02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:07 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000010008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:07 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="01000000030000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000f80000000000000000000000000015adecfc04aba100c7a989abf3f4241fa080872dd73043718819da995bda6004a9fdd1a3a023f54620d471559e81570b192969ac332e59d561657e27cd7c6197"], 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) r3 = syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x2, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0xffffffffffffff15, 0xfa00, {0x2, &(0x7f0000000140)={0xffffffffffffffff}, 0x0, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000200)={0x14, 0x88, 0xfa00, {r4, 0x3c, 0x0, @ib={0x1b, 0x3ff, 0x9, {"ffb65cee1ac2cd3d4d111da9d287e0e2"}, 0x2, 0xfff, 0x7}}}, 0x90) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r3) 21:15:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6c02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 434.529128][T19921] binder: 19915:19921 BC_INCREFS_DONE u0000000000000000 no match [ 434.637233][ T7923] binder: release 19915:19921 transaction 1547 out, still active [ 434.656597][ T7923] binder: unexpected work type, 4, not freed [ 434.663470][ T7923] binder: undelivered TRANSACTION_COMPLETE [ 434.675896][ T7923] binder: send failed reply for transaction 1547, target dead 21:15:07 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x40000}}], 0x500, 0x0, 0x0) 21:15:07 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000060008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6d02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm-monitor\x00', 0x800, 0x0) ioctl$UI_SET_MSCBIT(r3, 0x40045568, 0x2a) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='personality\x00') ioctl$VHOST_GET_VRING_BASE(r4, 0xc008af12, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR=&(0x7f0000001280)=ANY=[@ANYBLOB="f620e4cd236d3fe1a75310bf155fa7d828730944ff6ffaefd76f577879a8bd02f59b9e097c3005dff1a4dc6f86e47992b4173273aedcb522f23821b85ef0d82015d06c634888b11fb7b3a00f21e1b5c0827ada44b44199d5bc2103888cf8d22efd7fdcc699488d4f96e96c0c9492ec1af46f879d3be33b649ab57e1f3f9f3e80136f8437b7d9532ec72b33b22f517985370797975e11246aedc238ca26dc856c3148261387a49cb5224986d2b5b2f8c11da0"]], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_user\x00', 0x0, 0x0) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x40000, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r4, 0x5385, &(0x7f0000000240)={0x1000, ""/4096}) ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f0000000140)={r6, 0x0, 0x13000, 0xfffffffff1010000}) 21:15:07 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000f0008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6e02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 434.863029][T19947] binder: 19935:19947 got transaction with invalid offset (-2215932491097431818, min 0 max 40) or object. [ 434.881080][T19947] binder: 19935:19947 transaction failed 29201/-22, size 40-8 line 3241 [ 434.890645][T19936] binder: 19935:19936 BC_INCREFS_DONE u0000000000000000 no match [ 434.950167][ T2991] binder: undelivered TRANSACTION_ERROR: 29201 21:15:08 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x5, 0x802) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@empty, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@local}}, &(0x7f0000000140)=0xe8) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000180)={r1, @loopback, @local}, 0xc) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r2, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r4 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r4, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r2, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="01000000030000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100010000000000000000008e55adec0405aba149641d46304a9b0ba99eb1712fe4df5e96138bdc4380adb8143953bdc012fb95fe4038adf4635d5922e61dfe91f92a6d3b411948301440b9b65756772a18a99418770000000000000081294ed12f4a6fe25c519dbaf4219140abd3380b6862f9712ff315f5e2c23e07bf502b50b9a821e23a3081e2c434ea25fdf5898b59603907851912e8bc1f7122dae3"], 0x48}}, 0x0) recvmmsg(r4, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x6, 0x1) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000100)="32e6c3009f921b7b979cfa227f0db37ce69bbb25593f7e9febe92d07baca7e1d4746754df5a4f27106aef33b") r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:15:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f6f02001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:08 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000017028449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 435.361115][T19961] binder: 19960:19961 transaction failed 29189/-22, size 40-8 line 2994 [ 435.390183][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:15:08 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) write$binfmt_aout(r0, &(0x7f0000000340)={{0x108, 0x8001, 0x1, 0x39b, 0x374, 0x2, 0x37f, 0x75}, "42d5b01c46a609de1e306a6364c564fed80de86e7ff69978071edbdea5071a2efa3e2063b506d1f15d03a4a60aef968c2210e26a6774fa4b903731836f7065e58ede560efb06e111501b092c5756930c32e3c429247f5005d0748d1dde2f66b23fcb923987da1b9b2f63c50cb16ca95c90dd0275ea75b06697f1187be1d31c4a744bd0fdfcdd8877057704e4705284f32fd7730a618a24ca72e9a16ef5610a5e5153d27391344a51a722988e527952c9be8f8210191b3451aabfdbb2e96f11c486f50beb00a80a9f4a1d8fb1c9354e20a1a1f500a7d252aa9a8685b17eba53a4545f1d704f678a89746e94f511d996215b4dbbc82c36bab298a68dc4600b705c7acb520871e64791523d498f1344da201eeec9a44066468a664c229a66d54d7ed87168c2ce7b9e9649aabffe4ffaa69c8506584acc623aff4b3265092531bc13edb98d38030af67de0b3a305491540fbd5893df76c6205cbc104263e142aad80cb330990378fa734a7c5bbaef140ffa96f185d701115c197e78261cbc320e8cdf789155c3c695d96f26c29063f103785308ddeb1723b6447823046dbf5d031339d1074000505fe8efe5fbf7c930ade9aa060e6c192e0d7d28c1a9b2ddb6a724dca868f396c0735f61fe80cedd0924198a5697e6f8cc8a8f652d89d96835c284227eebb218f0afc061952aedded91009bd1dfaa7e147e25e14f7f4278c3097237d480ce6520dc595239fe655d38984ebb4be8f4370fde78bbd2af2ead9caec36c3c82a5579675266a366a876c67e64cd3aece3c286fdcf2379ba288136abff780be691a9c38f9efe909357d6690ba82a290a0d0552acb4136927100e719c0aa83d185a5839d754124fb2b678a047828858eb4a28986d008af5383a460b50c6ffae7907b1277e3061e9b8c296bba5aac0adedaf37cd136b5eece23ef9977a4f6c663869cd9b7534db5638b5c9e3189dc641761399980550bce038b7c9dacfabd1d6532996e9cad7b063552264c9a85c6022accfc79ae1d6dcde83763eec1edddb6e475667a4c143fae6e56bd0de90750571a9af91cabb3d46ff0bbc1a33ff7f051eea3523bb35ed0cc03e70e94f216d231c75791e781542d041115b14fcd495dd5b157d3f4df1a7dc3d86160f7e2ebcf650e31824d29e920c0f1bb1b0626bb8aa032cb3e8b8ffa6666a6309799ed01e052cd793247d3f3ab878f96f9de720017fd6de3a9413c725c9474dc01142bf4e0c8719b2ae6eae400a7701ec6ce6051f601f7f77671042567525a1281f35b5ca8f50040da4774b1e2515101954f9d766d9ac46b13f787c7b395a1722939afb8a0cc50a07e083cbc1e0fb989ca71c8de09a89820f27128288ab394be396edeaba32c35c2a3ab835d446289961dea6d8253be8b3f2938e30bb46039113ea3fef9730d43c226d8b6b15cc1dfb432b2dd1b3bed688e9bfe22aa41d2ceaf3754ae1e9290b2d565e51b8b315de79f15e9ff64639db75790feefb64a4cec1e0282e20fe1023e2fc65fbd8810cf9c75f8e4540a2df653c952115726f039139f99089827565c7fdc4a5209b5dcb5e5e8a95aa36039b5d39bdf52232c45e486f5f43276c0bc62e5621ab91fb52d2f44a2899ec3ef601c4b17f2c15b114e3612f88b2eb4ac25a5d0331fe64df75d02f4e226ecb352dc665e1bdd1341649beb86cf68260a1f19fe3a94c13dc3c9fe4607a15a42f9593b7151f5241b7e7ee11a3a2114cee9f164985c3aa9784131d7dd36381fee7a4ea58bbcb1d51a8e8a7ce0eeb302d844198c32987fbcfb6f98f9828329abb648f5bfd694df9bde2b0366bf4d3c53633bba7f524fa1271b542e79445e4a4de34f6b3bf7c34b430192969166af0eebaf6ec6678d6ab3d03e1b5d843284500cc370bfc5c577a4aa1374fc367e265983e2eca46247914ce6fec42b95e0f5d442d90088794400d218feb1da81df9df37c9b707691010d648360a6513157fa3845c17bd4956eb9b957fad39d780691a5996c8992546f4dcd641baa7bd140f22dffb2e93f4d57710ebfafe1b45e03328c7c13ee94a4a9df9062b006ecec2b8280adda26211c86e1e4d6feaf205e722308b68536da22ad0c7cdc0eff7e25513901ef7420e0f35b8fd3acae9ea98431f0b82c7a4b2343a6cc97f94acc71dccde184029f4fb2b4509dab7744c3232d9af5ad625a6ee8c10f7712e7d79a4a12204918ad1b424563177341135044dee10d0397b92b8ff39871ba67f7c75ed7f91bfdcdf85932c184f2cd93ecb44acfbdbd44c3f40abde3cc09879e7c60c4d1be1633590b60fd2791cad62c4a09a906fe638f2d29f1f792192b1965b73489e237697eb2dd7c00d41349589d637317f19e1e75fcbb27d05dd6d39e7f181482e46d147c8989ed77b788a738a0debc429ab5e5df8c3697d93f9bcd34bb61c964bd6943ebdbe71f7427497745bee386dd4cd1732076b2249ae38301e9fc9df6b4dd4fa215ada6797597f66dc5fe3d371f4eb4384ac42fa4214586c38fafbafaa5fbab781417a5e0cd2789a1c1a9aa3aae675c639d49aa0cbf68b0efe55fe93a0ec26a343c4fef5cb4aa5a13059c2d65557c654d415de7960da6ddc0521cba54821bbc174622863479347e552290818551dbb7e8ce00a53d73bff31d72898f5b4c445241e6f07a3d007cba60e9237ca8642a900c5287bc471b7d7ae16cfd489e37224b5caedc10785d338adc775d674acb1b49e7776a624c4267617dfd28dc7fd09b24236e81c02be696234e7748938d11b963946eff6c7592daff19f41f9fa3e7d77aaab92265371f53849c9f4cba12a3e69d063768775895062857dcc81f89d80ea3cbac66382ef930513dba41f671932ce3e048ae19300cc906443a2a1ae8b2f18ea765497619e46e9df7d24f5f9cae03ffde05902b937472d069322459b0269a92dfe34b23d12ddbef92d3bc5e995a6c348d3df3d52636d658668fe1ab2de47bce9e4f31d2087700026d93fecb58fe064cadcf739dd157bdda4aec1cda4df72da9986dd09ff4ef271091c8eace527e7adf48ee494ae825c18b3172d0fb17f3774bd924ffa2ff8c7e94ed227f4e8c7d18304ef46808a06cf5a545436e24c621c53647b46fc4940ec75a2f11e9dc274e8e5869e7638c7d0eb39fabecf4a9575ecfcf97ed7960699d23a4d5463e2848a9e63b0ad7e3135cca387f9e02578143f5da4f1cb915e4772ca94f80f43f3c367b772c18c8678d088bcf04efbdd355795501415f6ad19c91e794713fe519e65c8368d76e339ce05059803bd1b33318c45a1747eabaecb09fbbbeea162815aa36fcf70eb356966fbeb5b1ddd88f71b21276a90f493ae36d4abd2c441d65cd18cb7b99b318627fd6f34dfec3921d4ef87054a97f60c474536af9e15e9cf3965688b5539146e218dd5e5ca016f5f1b224dc14e8af1c97dea5ff927fd491cea036519358c58c370b96b0a56a3ee70adcd4d0a7393076707b9c82d5eb4bc7d5c5f475a1d9ad05475aac375301e4ccb9a044296ba1d03f5961a08cfac81488ce699d0d82efdb211eaac07be6170511d38edd606bf443e9e6e85c70905415f6fb69a14c5f3ec1c6871c6127df8e264da9d1be0cd19f9a9b998893749eae1d7c3850616732b996af5fd6462e6be6ae655f85bcce34fe12909099d300a3de1cdb1e6d46bbaaf81e7f52314446a5e315c6df479f8344a0c3ba198ec468ee06ef971a86e2463e5a8957f854147914c4717f4880b6cbbd0a401961d999ba62ebf596e17ceba674538884f1ef08c7dcca4a91c04d477c234733749105e90a3a4c33e9b14f4b7f494975ec0f6c04dbd5ebe6637279cd1bcc61f714be09130db0a8d7d2e5d535d2d7f4e6ffe90e4cf33faf3637e4af13eba34a721ad5e64e9c5e6493adb687f3c3a34ae9bf88a449c64d86fa8659c9819085cdc90020c0aa4dfa7b052791211b5b789b433751ee88c866359a59651f2fc311958676364bb06fee39bd373786f80d9b2a0882fe2606a1273e590a70e1a7bf3701508429bf3fe45210bbf5a488cd66b46f08ea73a4f59e39227c1e32a0b13b96fa15d89437a970eff56409061b7d1bfa71b88b21a6965038f2f6ac6b70ff384880b9f32894e5fb0e850457982edd3933947874b64229f23a9ebda9c9fa4045bebb3d4270a18ec385c6e073a76b84447432fa890b01c39fbc1724c25a6461c1285893afd07db7c2081a084c318b4449b4807a5a9494fd610b743af421de46897c5655ab743d7845d49e4c2ace3a38c83f34915433b345ab3c7459855fdb6408ab5266819d2da3dc462117c927901b14e84a5a000cb6714fb738620f0466f2c395a811b4b2ee705db3b2fd701e5a95d19dbf9acdd0e3820471d30576d87caf63af6b6961e39fb2016a3bc627740def2aae13236e2eea3b26fb57228f8482e8395bf859eed2cf1586f34e197888d4ec107a58c19cf4f65f88fe16430edbc5284fba940c5214b41a35fe566f2efcccd732f1de3018ca6fc251e2bdeb63dc55fd11374624080d8a43ccd05779dc170fb6ea3edd3b9074b4e734a69a8dbfba47eec9e438ec1417d06ab2a5abaf3f493daaa01bb2af8b04e4f7cb86799951cce7570153f59adc332d4f604d010a1c710c85badc04da469a7c0454101f2f0c7715b75c1073a922591dbd7ff86f5e0bd4aa5aad52213f76eea10978c72c858a42f4abe876df5f180a20c421f88f0b48e43939c9b77ca8fbc2ffe1b00de9eae11f3146391c0fda70b41f7fe1680580bcfdcc3f53ae982bf2062d65008765c220f1f59e74f77813442fd83735a2007eb3b19fdd61d49e30abdd5b987cbb8da77e98b898fea600cef7e8a5664ec1bb4e7a94d3d2c379c3160b781b5642735761e00fa48c0e34416259d8095315619eb390ebaabcb2813f3098ad03287cee4d76ac7cc84a4ce553b6d0c81e25d72a0ba493db3862e83a9cc30ebbae20a2a59b581aaf4875f320d5a6d820e9e006518ad03280a9208a95cb69501e5c1f89fe0aaad416b15243761a474ae8293f8a1bf092d778fb5a2c8e0bfcb5231dbc7a971d32b870356b8305e5d10ff4a5631193d079b615863d6069f039f3ad0781d09633842c262bc2b51f0d271d393a45b64e5a13b81b58fa856ead630d23f9cbbc55c28adf9761d4eba6151ac820a90aac229e2ee9b00d0a86bf52781ffba028ef6e04108219a363720ae652e3994db94b2eb8fdc5d92d8935bd41cd9fda6baad721c73226f64437822fe225faaa2b1cc17d3a7fd5edfece3b2157af914413304f6c832d3712d3e317aada2e0368c2891bca07c5fe8168d9c5a5a6efabc628a624ed6d197f5803871c7d47eed8c2d6e41ef914ca54e7867b67d151ee7047e33ac2c33ceead887dbb57d1bad477db6229f0e178e6c1e3cc9c9021b1abbcffcf5ee625a8b04d1e66c43e647b1f14858ecf6126465c7bf61bd68736b471d5f4eb71ea8b2c22459e6c88915503cc6d21fc68cfd2a14ff638abe59fbafa53c29a3e8f55d57e678bced2b50af817cfbd2ae179c32cb3ce5f89f10e260ce68c086a2922d2d8a82971de5cf580661e6a823fbfc2217f794df5bc526d1beeb3e214e27bfec73518991df71f67a54497b181be5a4c12dda1832ff33698e61b5ad52b28102ca327405a71cb8b73c6b3359bde6a7c48d250eb37ded7f034b8b6db850b5f003e44a972865db619667fc5749dd8502d7668df3be7ae532bc701e0945267f3191857765af4d9f97395afa833abc67a9bf89c6077cdd957442f3c970253827a03de183d5725628a2e1981e3d88274da24a788f2ca3b8b", [[], [], [], [], []]}, 0x1520) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x80000, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x7ff, 0x7df, 0x8001, 0x3f, 0x3f}, &(0x7f0000000080)=0x14) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f00000000c0)={r4}, 0x8) 21:15:08 executing program 0: epoll_create(0xc39) r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20015, r1, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x4, 0x80000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x3) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f00000001c0)=0x8001, 0x4) openat(r3, &(0x7f0000000180)='./file0\x00', 0x400, 0x8) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR=&(0x7f000000afd0)=ANY=[@ANYBLOB=' \x00\x00\x00\x00h\x00\x00']], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\b{@'], 0x0, 0x0, 0x0}) [ 435.571860][T19980] binder_alloc: 19978: binder_alloc_buf, no vma [ 435.578281][T19980] binder: 19978:19980 transaction failed 29189/-3, size 40-8 line 3147 [ 435.590020][T19985] binder: BINDER_SET_CONTEXT_MGR already set [ 435.601835][T19985] binder: 19978:19985 ioctl 40046207 0 returned -16 [ 435.610121][T19985] binder_alloc: 19978: binder_alloc_buf, no vma 21:15:08 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x3665c4}}], 0x500, 0x0, 0x0) 21:15:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7002001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:08 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000000a8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="398bf66e8bba836dd5c3862b1167b96c9547b3624e9cf245a60623868b4777db935c45e81f956adc77429d101bfa88c1f4522c44484a6aacbc44681d6c97aaa70965eb2ade941bc62df7489e9380cfd7f081cd7dfeacbfd804515c3617975d63c527ca73c5605a7904d0ff02723593e5b879993a61beed591f7b38874596f8e91ba643f38a11c16800f4188a61107f0c38a4ba7720dc767284cb7190a7661b88aa57bd75ef4e1a61abafb3701423c668dcc2aaa6d0cde8659cb42d029d0000000000"], 0x0, 0x0, 0x0}) [ 435.610727][T19989] binder: 19978:19989 unknown command 4225800 [ 435.616875][T19985] binder: 19978:19985 transaction failed 29189/-3, size 40-8 line 3147 [ 435.639126][T19989] binder: 19978:19989 ioctl c0306201 20000040 returned -22 [ 435.650929][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 [ 435.658394][ T7923] binder: undelivered TRANSACTION_ERROR: 29189 21:15:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7102001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:08 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000000e8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 435.812564][T20004] binder: 19998:20004 unknown command 1861651257 [ 435.828261][T20004] binder: 19998:20004 ioctl c0306201 20000040 returned -22 21:15:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x800, 0x0) r4 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) set_thread_area(&(0x7f0000000140)={0x7, 0x20000800, 0x400, 0x6, 0x1ca5, 0xc033002, 0x8, 0xfffffffffffffffd, 0x8, 0x9}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) 21:15:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7202001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:08 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0xc97d, 0x80000) ioctl$PPPIOCGMRU(r3, 0x80047453, &(0x7f00000000c0)) r4 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x4001, 0x0) ioctl$TIOCMBIS(r4, 0x5416, &(0x7f0000000040)=0x7f) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:08 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000c00e8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 436.275312][T20030] binder: 20018:20030 BC_INCREFS_DONE u0000000000000000 no match [ 436.328929][ T2991] binder: send failed reply for transaction 1558 to 20018:20030 [ 436.337616][ T2991] binder: undelivered TRANSACTION_COMPLETE [ 436.347558][ T2991] binder: undelivered TRANSACTION_ERROR: 29189 21:15:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7302001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:09 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000000f8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:09 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000, 0x1000000}}], 0x500, 0x0, 0x0) 21:15:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0xfff, 0x20000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x400, 0x0) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000e558f6cb6000000001a00000074c71000dd189fc283eb29c5e95b91a73f1287514970105688372e455690ce8d6744f1f1fd0b9b25beca592943be772eb6e02044fd8295ed40ed123cb7d02ed7e389c6f8ec3dce0bde6589e0d88059d2706abe0ec48e53b489e65f0bc1"]], 0x0, 0x10000000, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040"], 0x0, 0x0, 0x0}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-control\x00', 0x4000, 0x0) 21:15:09 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x100, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000b40)='team\x00') getpeername$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000200)={{{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@remote}}, &(0x7f0000000180)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000440)={{{@in=@multicast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000540)=0xe8) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000005c0)=0x14) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000080)={0x469, 0x80, 0x8, 0x54000000, 0x18, 0x8, 0x6, 0x8, 0xf8d, 0x8}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}}}, &(0x7f0000000700)=0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f0000000880)={0x11, 0x0, 0x0}, &(0x7f00000008c0)=0x14) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000900)={@dev, 0x0}, &(0x7f0000000a80)=0x14) accept4$packet(0xffffffffffffffff, &(0x7f0000000e00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000e40)=0x14, 0x80800) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000000e80)={@rand_addr, 0x0}, &(0x7f0000000ec0)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001080)={'team0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@multicast1}}, &(0x7f0000001240)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000001280)={'vcan0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000012c0)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@broadcast}}, &(0x7f00000013c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000001780)={{{@in6=@ipv4={[], [], @multicast1}, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@ipv4}}, &(0x7f0000001880)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000001980)={{{@in6=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f00000018c0)=0xe8) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000002080)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80040}, 0xc, &(0x7f0000001900)={&(0x7f00000020c0)=ANY=[@ANYBLOB="60050000", @ANYRES16=r2, @ANYBLOB="00062abd7000fddbdf250000000008000100", @ANYRES32=r3, @ANYBLOB="f40002003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r4, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000500000008000600", @ANYRES32=r5, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400cc00000040000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000001000040062726f61646361737400000008000100", @ANYRES32=r6, @ANYBLOB="80000200400001002400010071756575655f6964000000000000000000000000000000000000000000000000080003000300000008000400ff01000008000600057409131f8e6d7f545740d13834042798ae2ce74a93acebb5b97bc76f06fa402df64b47d36e8b9ff4d4655dc2b55ba2300086aa2e878611c6da740c64eff43b03cdfcee6106622008615b27fad02a", @ANYRES32=r7, @ANYBLOB="3c000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000000c00040072616e646f6d000008000100", @ANYRES32=r8, @ANYBLOB="0400020008000100", @ANYRES32=r9, @ANYBLOB="c40002003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB="4c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e670000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000400000008000100", @ANYRES32=r11, @ANYBLOB="0400020008000100", @ANYRES32=r12, @ANYBLOB="200102003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r13, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000080003000300000008000400ff0f000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004000600000038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000300000008000100", @ANYRES32=r14, @ANYBLOB="b401020040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r15, @ANYBLOB="080007000000000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040020000000080007000000000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400010400003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r16, @ANYBLOB="4c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000001c000400d27805092000000000003b080104000082000701000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r17, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r18], 0x560}, 0x1, 0x0, 0x0, 0x20040000}, 0x4004) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r20 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r20, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000980)={{{@in, @in=@broadcast}}, {{@in6=@loopback}, 0x0, @in6=@local}}, &(0x7f0000000840)=0xe8) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r19}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000740)=ANY=[@ANYBLOB="01000000030000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100001785131239155681608a74db3300000000a112176219117edc5de5cb7c87cf399935a1acb4a6a584b643377e9ab1cfc523cfc9990c074f0ff195230df3617dce8e9bdf9b4537a37bfd1af1d3d2206a21113540b27d414e8b01da16a47aa1e16859"], 0x6}}, 0x40000000000) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000800)='/proc/thread-self/attr/current\x00', 0x2, 0x0) recvmmsg(r20, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x4000}}], 0x500, 0x0, 0x0) 21:15:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7402001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:09 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000002178449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 21:15:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7502001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 436.700206][T20060] ------------[ cut here ]------------ [ 436.705718][T20060] kernel BUG at drivers/android/binder_alloc.c:1141! 21:15:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7602001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7702001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 436.751195][T20060] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 436.757311][T20060] CPU: 0 PID: 20060 Comm: syz-executor.0 Not tainted 5.1.0-rc2+ #37 [ 436.765283][T20060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 436.775439][T20060] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 436.781951][T20060] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 bf f9 23 fc 4c 89 e6 4c 89 ef e8 d4 fa 23 fc 4d 39 e5 76 07 e8 aa f9 23 fc <0f> 0b e8 a3 f9 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 b1 [ 436.801563][T20060] RSP: 0018:ffff88804f6ff550 EFLAGS: 00010212 [ 436.805983][ T3876] kobject: 'loop3' (00000000f6bafd29): kobject_uevent_env [ 436.807639][T20060] RAX: 0000000000040000 RBX: 0000000020a00000 RCX: ffffc90005fec000 [ 436.816904][ T3876] kobject: 'loop3' (00000000f6bafd29): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 436.822708][T20060] RDX: 00000000000004dd RSI: ffffffff854c77d6 RDI: 0000000000000006 [ 436.822718][T20060] RBP: ffff88804f6ff5d0 R08: ffff888097306540 R09: 0000000000000028 [ 436.822727][T20060] R10: ffffed1009edff01 R11: ffff88804f6ff80f R12: 0000000000000008 [ 436.822736][T20060] R13: 0000000000000028 R14: 0000b66c8f550e00 R15: 0000000000000000 [ 436.822749][T20060] FS: 00007fb6f9cd2700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 436.822758][T20060] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 436.822767][T20060] CR2: 00007f38b2028000 CR3: 00000000a012b000 CR4: 00000000001426f0 [ 436.822776][T20060] Call Trace: [ 436.822799][T20060] ? memcpy+0x46/0x50 [ 436.822821][T20060] binder_alloc_copy_from_buffer+0x37/0x42 [ 436.822921][T20060] binder_get_object+0xc3/0x200 [ 436.822944][T20060] binder_transaction+0x2b4a/0x6690 [ 436.892889][ T3876] kobject: 'loop3' (00000000f6bafd29): kobject_uevent_env [ 436.895726][T20060] ? binder_thread_read+0x3d50/0x3d50 [ 436.895752][T20060] ? __might_fault+0x12b/0x1e0 [ 436.895773][T20060] ? lock_downgrade+0x880/0x880 [ 436.895797][T20060] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 436.895892][T20060] ? _copy_from_user+0xdd/0x150 [ 436.895913][T20060] binder_thread_write+0x64a/0x2820 [ 436.904946][ T3876] kobject: 'loop3' (00000000f6bafd29): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 436.906567][T20060] ? binder_transaction+0x6690/0x6690 [ 436.906583][T20060] ? __might_fault+0x12b/0x1e0 [ 436.906614][T20060] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 436.953003][T20055] binder: 20053:20055 BC_INCREFS_DONE u0000000000000000 no match [ 436.960202][T20060] ? _copy_from_user+0xdd/0x150 [ 436.960223][T20060] binder_ioctl+0x1033/0x183b [ 436.960244][T20060] ? binder_thread_write+0x2820/0x2820 [ 436.960328][T20060] ? tomoyo_path_number_perm+0x263/0x520 [ 436.960345][T20060] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 436.960380][T20060] ? binder_thread_write+0x2820/0x2820 [ 437.016232][T20060] do_vfs_ioctl+0xd6e/0x1390 [ 437.020852][T20060] ? ioctl_preallocate+0x210/0x210 [ 437.025974][T20060] ? __fget+0x381/0x550 [ 437.030131][T20060] ? ksys_dup3+0x3e0/0x3e0 [ 437.034579][T20060] ? nsecs_to_jiffies+0x30/0x30 [ 437.039443][T20060] ? tomoyo_file_ioctl+0x23/0x30 [ 437.044372][T20060] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 437.051095][T20060] ? security_file_ioctl+0x93/0xc0 [ 437.056200][T20060] ksys_ioctl+0xab/0xd0 [ 437.060351][T20060] __x64_sys_ioctl+0x73/0xb0 [ 437.069733][T20060] do_syscall_64+0x103/0x610 [ 437.074311][T20060] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 437.080182][T20060] RIP: 0033:0x458209 [ 437.084065][T20060] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 437.103665][T20060] RSP: 002b:00007fb6f9cd1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 437.112066][T20060] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458209 [ 437.120020][T20060] RDX: 0000000020008000 RSI: 00000000c0306201 RDI: 0000000000000003 [ 437.128012][T20060] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 437.136010][T20060] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb6f9cd26d4 [ 437.144003][T20060] R13: 00000000004bf49a R14: 00000000004d0e80 R15: 00000000ffffffff [ 437.151974][T20060] Modules linked in: [ 437.157833][ T3876] kobject: 'loop1' (00000000a693b098): kobject_uevent_env [ 437.159012][T20060] ---[ end trace 0d5f35765211c3cc ]--- [ 437.170704][ T3876] kobject: 'loop1' (00000000a693b098): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 437.171886][T20060] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 21:15:09 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x80000, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r3, 0x80605414, &(0x7f0000000040)=""/153) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0x48}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x3f00000000000000, 0x0, 0xfffffe7b, 0x0, 0x4000}}], 0x44b, 0x0, 0x0) 21:15:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7802001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) 21:15:09 executing program 1: syz_open_dev$sndpcmp(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) getsockname(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa0000000000001f8449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) [ 437.193416][T20060] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 bf f9 23 fc 4c 89 e6 4c 89 ef e8 d4 fa 23 fc 4d 39 e5 76 07 e8 aa f9 23 fc <0f> 0b e8 a3 f9 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 b1 [ 437.227357][ T3876] kobject: 'loop4' (00000000d0186a88): kobject_uevent_env [ 437.229330][T20060] RSP: 0018:ffff88804f6ff550 EFLAGS: 00010212 [ 437.240731][ T3876] kobject: 'loop4' (00000000d0186a88): fill_kobj_path: path = '/devices/virtual/block/loop4' 21:15:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1f7902001e0007f1e9f5ff02000400000000000400ffffffff0003728d0417", 0x1f) [ 437.254672][T20060] RAX: 0000000000040000 RBX: 0000000020a00000 RCX: ffffc90005fec000 [ 437.266365][T20060] RDX: 00000000000004dd RSI: ffffffff854c77d6 RDI: 0000000000000006 [ 437.278772][ T3876] kobject: 'loop3' (00000000f6bafd29): kobject_uevent_env [ 437.286529][T20060] RBP: ffff88804f6ff5d0 R08: ffff888097306540 R09: 0000000000000028 [ 437.299131][ T3876] kobject: 'loop3' (00000000f6bafd29): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 437.309600][T20060] R10: ffffed1009edff01 R11: ffff88804f6ff80f R12: 0000000000000008 [ 437.326105][T20060] R13: 0000000000000028 R14: 0000b66c8f550e00 R15: 0000000000000000 [ 437.331662][ T3876] kobject: 'loop3' (00000000f6bafd29): kobject_uevent_env [ 437.341182][T20060] FS: 00007fb6f9cd2700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 437.347736][ T3876] kobject: 'loop3' (00000000f6bafd29): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 437.351905][T20060] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 437.371219][T20060] CR2: 000000000070b158 CR3: 00000000a012b000 CR4: 00000000001426f0 [ 437.376687][ T3876] kobject: 'loop4' (00000000d0186a88): kobject_uevent_env [ 437.380396][T20060] Kernel panic - not syncing: Fatal exception [ 437.393234][T20060] Kernel Offset: disabled [ 437.397552][T20060] Rebooting in 86400 seconds..