00000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:16 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xf000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1265.992853] binder: BINDER_SET_CONTEXT_MGR already set [ 1266.043556] binder: 6882:6884 ioctl 40046207 0 returned -16 00:27:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1266.087975] binder: release 6873:6874 transaction 244 in, still active [ 1266.097720] binder: send failed reply for transaction 244 to 6882:6886 [ 1266.195002] binder: 6890:6891 unknown command 4219648 [ 1266.202923] binder: 6890:6891 ioctl c0306201 20000440 returned -22 00:27:16 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x8dffffff}}], 0x1, 0x0, 0x0) 00:27:16 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2300000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:16 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x23000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1266.763662] binder_release_work: 7 callbacks suppressed [ 1266.763670] binder: undelivered TRANSACTION_ERROR: 29201 [ 1266.792746] binder: undelivered TRANSACTION_COMPLETE [ 1266.837701] binder: undelivered TRANSACTION_ERROR: 29189 [ 1266.962330] binder: BINDER_SET_CONTEXT_MGR already set 00:27:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1267.000839] binder: 6911:6912 ioctl 40046207 0 returned -16 [ 1267.021321] binder_alloc: 6890: binder_alloc_buf failed to map pages in userspace, no vma [ 1267.030827] binder: undelivered TRANSACTION_ERROR: 29201 00:27:17 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x8000a0ffffffff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1267.108476] binder_transaction: 3 callbacks suppressed [ 1267.108493] binder: 6911:6913 transaction failed 29189/-3, size 0-0 line 2973 [ 1267.160553] binder_transaction: 2 callbacks suppressed [ 1267.160561] binder: 6911:6913 got reply transaction with no transaction stack 00:27:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0xfffffff0}}], 0x1, 0x0, 0x0) [ 1267.212993] binder: 6915:6916 got reply transaction with no transaction stack [ 1267.244136] binder: 6915:6916 transaction failed 29201/-71, size 0-0 line 2741 [ 1267.276803] binder: 6911:6913 transaction failed 29201/-71, size 0-0 line 2741 [ 1267.315443] binder: release 6915:6916 transaction 251 out, still active 00:27:17 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x26000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1267.322374] binder: undelivered TRANSACTION_COMPLETE [ 1267.377410] binder: undelivered TRANSACTION_ERROR: 29201 [ 1267.416420] binder: send failed reply for transaction 251, target dead [ 1267.455158] binder: 6927:6930 got reply transaction with no transaction stack [ 1267.465394] binder: 6927:6930 transaction failed 29201/-71, size 0-0 line 2741 [ 1267.527662] binder: release 6927:6930 transaction 254 out, still active [ 1267.543100] binder: undelivered TRANSACTION_COMPLETE 00:27:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:17 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffffc0}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1267.604376] binder: undelivered TRANSACTION_ERROR: 29201 [ 1267.610211] binder: send failed reply for transaction 254, target dead [ 1267.733557] binder: undelivered TRANSACTION_ERROR: 29201 [ 1267.741819] binder: undelivered TRANSACTION_ERROR: 29189 00:27:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1267.784841] binder: 6938:6939 got reply transaction with no transaction stack [ 1267.843974] binder: 6938:6939 transaction failed 29201/-71, size 0-0 line 2741 [ 1267.915876] binder: release 6938:6939 transaction 257 out, still active [ 1267.933114] binder: undelivered TRANSACTION_COMPLETE 00:27:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1268.004894] binder: undelivered TRANSACTION_ERROR: 29201 [ 1268.037156] binder_alloc: 6944: binder_alloc_buf, no vma [ 1268.037451] binder: send failed reply for transaction 257, target dead [ 1268.073816] binder: 6944:6945 transaction failed 29189/-3, size 0-0 line 2973 [ 1268.126022] binder: BINDER_SET_CONTEXT_MGR already set [ 1268.144830] binder: 6944:6951 got reply transaction with no transaction stack [ 1268.152484] binder: 6944:6951 transaction failed 29201/-71, size 0-0 line 2741 [ 1268.173529] binder: 6947:6949 ioctl 40046207 0 returned -16 [ 1268.173690] binder_alloc: 6944: binder_alloc_buf, no vma [ 1268.224154] binder: 6947:6955 ioctl c0306201 0 returned -14 [ 1268.259158] binder: 6947:6953 transaction failed 29189/-3, size 0-0 line 2973 00:27:18 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0xa000}}], 0x1, 0x0, 0x0) [ 1268.283773] binder: 6947:6949 got reply transaction with no transaction stack 00:27:18 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2400000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1268.362306] binder: 6947:6949 transaction failed 29201/-71, size 0-0 line 2741 [ 1268.453352] binder: undelivered TRANSACTION_ERROR: 29189 00:27:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1268.565418] binder: undelivered TRANSACTION_ERROR: 29201 [ 1268.632210] binder: BINDER_SET_CONTEXT_MGR already set [ 1268.673680] binder: 6965:6967 ioctl 40046207 0 returned -16 [ 1268.707491] binder_alloc: 6944: binder_alloc_buf, no vma [ 1268.732046] binder: 6965:6967 transaction failed 29189/-3, size 0-0 line 2973 [ 1268.767359] binder: 6965:6970 ioctl c0306201 0 returned -14 00:27:19 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2900000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1268.795598] binder: 6965:6967 got reply transaction with no transaction stack 00:27:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1268.901195] binder: 6972:6974 ioctl c0306201 0 returned -14 [ 1268.910238] binder: 6972:6974 got reply transaction with no transaction stack [ 1268.957650] binder: release 6972:6974 transaction 267 out, still active [ 1268.974892] binder: undelivered TRANSACTION_COMPLETE [ 1269.021589] binder: BINDER_SET_CONTEXT_MGR already set [ 1269.110597] binder: send failed reply for transaction 267, target dead [ 1269.127553] binder: 6978:6979 ioctl 40046207 0 returned -16 00:27:19 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2b000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1269.179688] binder: 6978:6985 got reply transaction with no transaction stack 00:27:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0xa0}}], 0x1, 0x0, 0x0) [ 1269.284575] binder: 6987:6992 got reply transaction with no transaction stack 00:27:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1269.458901] binder: BINDER_SET_CONTEXT_MGR already set 00:27:19 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x4000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1269.484235] binder: 6998:7000 ioctl 40046207 0 returned -16 00:27:20 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x10000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1270.033648] binder: release 6987:6988 transaction 272 out, still active [ 1270.040635] binder: undelivered TRANSACTION_COMPLETE 00:27:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1270.076431] binder: send failed reply for transaction 272, target dead [ 1270.083493] binder: send failed reply for transaction 274 to 6998:7001 00:27:20 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1270.247138] binder: undelivered TRANSACTION_COMPLETE 00:27:20 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3800}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1270.471575] binder: BINDER_SET_CONTEXT_MGR already set [ 1270.483922] binder: 7027:7029 ioctl 40046207 0 returned -16 00:27:20 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x40000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1270.933895] binder: release 7015:7016 transaction 277 out, still active [ 1270.974064] binder: undelivered TRANSACTION_COMPLETE 00:27:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1271.007177] binder: send failed reply for transaction 277, target dead 00:27:21 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2600}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1271.067575] binder: send failed reply for transaction 279 to 7027:7029 00:27:21 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1271.254147] binder: undelivered TRANSACTION_COMPLETE 00:27:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1271.442418] binder: BINDER_SET_CONTEXT_MGR already set [ 1271.448271] binder: 7053:7054 ioctl 40046207 0 returned -16 00:27:21 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:21 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x25000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1271.989085] binder: release 7041:7044 transaction 282 out, still active [ 1271.997482] binder: undelivered TRANSACTION_COMPLETE 00:27:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080), 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1272.058160] binder_release_work: 13 callbacks suppressed [ 1272.058167] binder: undelivered TRANSACTION_ERROR: 29201 [ 1272.069608] binder: send failed reply for transaction 282, target dead [ 1272.135849] binder: send failed reply for transaction 284 to 7053:7054 00:27:22 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1272.230162] binder: undelivered TRANSACTION_COMPLETE [ 1272.266702] binder: undelivered TRANSACTION_ERROR: 29189 [ 1272.291843] binder: undelivered TRANSACTION_ERROR: 29201 [ 1272.310939] binder_transaction: 5 callbacks suppressed 00:27:22 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1272.310958] binder: 7071:7077 got reply transaction with no transaction stack [ 1272.325138] binder_transaction: 10 callbacks suppressed [ 1272.325155] binder: 7071:7077 transaction failed 29201/-71, size 0-0 line 2741 [ 1272.354240] binder: BINDER_SET_CONTEXT_MGR already set [ 1272.362763] binder: 7078:7079 ioctl 40046207 0 returned -16 [ 1272.433030] binder: 7078:7085 got reply transaction with no transaction stack [ 1272.440779] binder: 7078:7085 transaction failed 29201/-71, size 0-0 line 2741 00:27:22 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:22 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x4000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080), 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1273.027217] binder: release 7071:7072 transaction 287 out, still active [ 1273.036623] binder: undelivered TRANSACTION_COMPLETE [ 1273.082258] binder: undelivered TRANSACTION_ERROR: 29201 [ 1273.133902] binder: send failed reply for transaction 287, target dead 00:27:23 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1273.184004] binder: send failed reply for transaction 289 to 7078:7079 [ 1273.228286] binder: undelivered TRANSACTION_ERROR: 29201 [ 1273.271105] binder: 7100:7108 got reply transaction with no transaction stack [ 1273.295947] binder: undelivered TRANSACTION_COMPLETE [ 1273.301288] binder: 7100:7108 transaction failed 29201/-71, size 0-0 line 2741 [ 1273.314207] binder: undelivered TRANSACTION_ERROR: 29189 00:27:23 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3800000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1273.367829] binder: BINDER_SET_CONTEXT_MGR already set [ 1273.380415] binder: 7110:7112 ioctl 40046207 0 returned -16 00:27:23 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x300000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:23 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x40000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1273.450204] binder: 7110:7117 got reply transaction with no transaction stack [ 1273.471684] binder: 7110:7117 transaction failed 29201/-71, size 0-0 line 2741 00:27:24 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1273.977871] binder: release 7100:7101 transaction 292 out, still active [ 1273.995105] binder: undelivered TRANSACTION_COMPLETE 00:27:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080), 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1274.038603] binder: undelivered TRANSACTION_ERROR: 29201 [ 1274.044576] binder: send failed reply for transaction 292, target dead [ 1274.092382] binder: send failed reply for transaction 294 to 7110:7112 00:27:24 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1274.189155] binder: undelivered TRANSACTION_COMPLETE [ 1274.223159] binder: 7134:7135 transaction failed 29189/-22, size 0-0 line 2834 [ 1274.240584] binder: undelivered TRANSACTION_ERROR: 29189 [ 1274.272979] binder: undelivered TRANSACTION_ERROR: 29201 [ 1274.299631] binder_alloc: 7141: binder_alloc_buf, no vma [ 1274.305751] binder: undelivered TRANSACTION_ERROR: 29189 [ 1274.315551] binder: 7141:7144 transaction failed 29189/-3, size 0-0 line 2973 [ 1274.322854] binder: send failed reply for transaction 298 to 7141:7144 00:27:24 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2700000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1274.402153] binder: undelivered TRANSACTION_COMPLETE 00:27:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:24 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1274.541427] binder: 7148:7149 got reply transaction with no transaction stack [ 1274.610340] binder: 7148:7149 transaction failed 29201/-71, size 0-0 line 2741 [ 1274.618912] binder: release 7148:7149 transaction 301 out, still active [ 1274.626962] binder: undelivered TRANSACTION_COMPLETE [ 1274.648040] binder: send failed reply for transaction 301, target dead 00:27:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1274.657314] binder_alloc: 7151: binder_alloc_buf, no vma [ 1274.662844] binder: 7151:7154 transaction failed 29189/-3, size 0-0 line 2973 [ 1274.672873] binder: send failed reply for transaction 304 to 7151:7154 [ 1274.762166] binder: BINDER_SET_CONTEXT_MGR already set [ 1274.767910] binder: 7159:7160 ioctl 40046207 0 returned -16 [ 1274.773962] binder: undelivered TRANSACTION_COMPLETE [ 1274.775682] binder: 7159:7160 got reply transaction with no transaction stack [ 1274.789124] binder: 7159:7160 transaction failed 29201/-71, size 0-0 line 2741 [ 1274.802924] binder: release 7159:7160 transaction 306 out, still active 00:27:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1274.816957] binder: undelivered TRANSACTION_COMPLETE 00:27:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1274.853288] binder: send failed reply for transaction 306, target dead [ 1275.008228] binder: 7166:7167 got reply transaction with no transaction stack [ 1275.050712] binder: BINDER_SET_CONTEXT_MGR already set 00:27:25 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:25 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffffc0}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1275.093969] binder: 7165:7168 ioctl 40046207 0 returned -16 [ 1275.120419] binder: 7166:7167 transaction failed 29201/-71, size 0-0 line 2741 [ 1275.167935] binder: 7165:7170 got reply transaction with no transaction stack 00:27:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000480)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1275.239084] binder: release 7166:7167 transaction 309 out, still active [ 1275.253000] binder: undelivered TRANSACTION_COMPLETE [ 1275.265638] binder: send failed reply for transaction 309, target dead [ 1275.272528] binder: send failed reply for transaction 311 to 7165:7170 [ 1275.282196] binder: undelivered TRANSACTION_COMPLETE 00:27:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1275.354529] binder: 7179:7180 got reply transaction with no transaction stack [ 1275.413907] binder: release 7179:7180 transaction 314 out, still active [ 1275.428370] binder: undelivered TRANSACTION_COMPLETE 00:27:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000480)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1275.491043] binder: send failed reply for transaction 314, target dead [ 1275.507907] binder: 7189:7190 got reply transaction with no transaction stack 00:27:25 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2300}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:25 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x400300}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1275.627712] binder: release 7192:7194 transaction 319 out, still active [ 1275.638458] binder: undelivered TRANSACTION_COMPLETE 00:27:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000480)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1275.774621] binder: send failed reply for transaction 319, target dead 00:27:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1276.023877] binder: release 7206:7207 transaction 324 out, still active 00:27:26 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1276.085251] binder: release 7210:7211 transaction 326 out, still active [ 1276.162615] binder: send failed reply for transaction 324, target dead [ 1276.185843] binder: send failed reply for transaction 326, target dead 00:27:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:26 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1276.352045] binder: release 7218:7219 transaction 329 out, still active 00:27:26 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xf}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1276.399884] binder: BINDER_SET_CONTEXT_MGR already set 00:27:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1276.479913] binder: 7221:7222 ioctl 40046207 0 returned -16 [ 1276.497230] binder: send failed reply for transaction 329, target dead 00:27:26 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:27 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x700}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1276.899748] binder: BINDER_SET_CONTEXT_MGR already set [ 1276.935499] binder: 7243:7244 ioctl 40046207 0 returned -16 [ 1277.063833] binder: send failed reply for transaction 337 to 7243:7248 [ 1277.070538] binder_release_work: 20 callbacks suppressed [ 1277.070545] binder: undelivered TRANSACTION_ERROR: 29201 00:27:27 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x15000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:27 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:27 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1277.449924] binder_transaction: 9 callbacks suppressed [ 1277.449935] binder: 7257:7262 got reply transaction with no transaction stack [ 1277.473607] binder_transaction: 14 callbacks suppressed [ 1277.473623] binder: 7257:7262 transaction failed 29201/-71, size 0-0 line 2741 00:27:27 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2500000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1277.666385] binder: undelivered TRANSACTION_ERROR: 29189 [ 1277.710913] binder: undelivered TRANSACTION_ERROR: 29201 00:27:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:28 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xb00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1277.865560] binder: BINDER_SET_CONTEXT_MGR already set [ 1277.924654] binder: 7272:7273 ioctl 40046207 0 returned -16 [ 1278.009257] binder: 7272:7278 got reply transaction with no transaction stack 00:27:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1278.057804] binder: 7272:7278 transaction failed 29201/-71, size 0-0 line 2741 [ 1278.075212] binder_thread_release: 2 callbacks suppressed [ 1278.075222] binder: release 7257:7258 transaction 341 in, still active [ 1278.164835] binder: send failed reply for transaction 341 to 7272:7275 00:27:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1278.244556] binder: undelivered TRANSACTION_ERROR: 29201 [ 1278.274260] binder: 7284:7285 ioctl c0306201 0 returned -14 [ 1278.284764] binder: undelivered TRANSACTION_ERROR: 29201 00:27:28 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1278.336673] binder: undelivered TRANSACTION_ERROR: 29189 [ 1278.356241] binder: 7284:7285 got reply transaction with no transaction stack [ 1278.451363] binder: 7284:7285 transaction failed 29201/-71, size 0-0 line 2741 [ 1278.466896] binder: BINDER_SET_CONTEXT_MGR already set 00:27:28 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x38}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1278.507934] binder: 7289:7290 ioctl 40046207 0 returned -16 [ 1278.545980] binder: undelivered TRANSACTION_ERROR: 29201 [ 1278.551511] binder: send failed reply for transaction 345 to 7289:7290 00:27:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:28 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1f00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1278.575080] binder: 7289:7295 got reply transaction with no transaction stack [ 1278.603548] binder: 7289:7295 transaction failed 29201/-71, size 0-0 line 2741 [ 1278.660272] binder: 7302:7303 ioctl c0306201 0 returned -14 [ 1278.752382] binder: 7302:7303 got reply transaction with no transaction stack 00:27:29 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1500000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1278.841348] binder: 7302:7303 transaction failed 29201/-71, size 0-0 line 2741 00:27:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1279.009735] binder: undelivered TRANSACTION_ERROR: 29201 [ 1279.191178] binder: 7315:7316 ioctl c0306201 0 returned -14 [ 1279.223846] binder_release_work: 6 callbacks suppressed [ 1279.223851] binder: undelivered TRANSACTION_COMPLETE 00:27:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:29 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1279.279991] binder: undelivered TRANSACTION_ERROR: 29189 [ 1279.349127] binder: undelivered TRANSACTION_ERROR: 29201 [ 1279.379026] binder: 7315:7320 got reply transaction with no transaction stack [ 1279.434358] binder: 7315:7320 transaction failed 29201/-71, size 0-0 line 2741 [ 1279.453636] binder: BINDER_SET_CONTEXT_MGR already set [ 1279.473647] binder: 7321:7326 ioctl 40046207 0 returned -16 00:27:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:29 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3f00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1279.543101] binder: release 7315:7316 transaction 351 in, still active [ 1279.550353] binder: send failed reply for transaction 351 to 7321:7326 [ 1279.581145] binder: 7321:7329 got reply transaction with no transaction stack [ 1279.623224] binder: 7321:7329 transaction failed 29201/-71, size 0-0 line 2741 00:27:29 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x26}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:30 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffff7f}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1279.732873] binder: 7330:7335 got reply transaction with no transaction stack [ 1279.768162] binder: 7330:7335 transaction failed 29201/-71, size 0-0 line 2741 [ 1280.238170] binder: undelivered TRANSACTION_COMPLETE 00:27:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:30 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1280.425835] binder: BINDER_SET_CONTEXT_MGR already set [ 1280.444562] binder: 7352:7353 ioctl 40046207 0 returned -16 [ 1280.491276] binder: 7352:7353 transaction failed 29189/-22, size 0-0 line 2834 [ 1280.553914] binder: 7352:7358 got reply transaction with no transaction stack [ 1280.561416] binder: 7352:7358 transaction failed 29201/-71, size 0-0 line 2741 [ 1280.570657] binder: 7356:7359 got reply transaction with no transaction stack 00:27:30 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2b000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:30 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:31 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xbfffffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:31 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1281.370991] binder: release 7379:7382 transaction 360 out, still active [ 1281.398034] binder: undelivered TRANSACTION_COMPLETE 00:27:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1281.451173] binder_send_failed_reply: 1 callbacks suppressed [ 1281.451181] binder: send failed reply for transaction 360, target dead [ 1281.528773] binder: BINDER_SET_CONTEXT_MGR already set [ 1281.539771] binder: 7388:7390 ioctl 40046207 0 returned -16 [ 1281.567338] binder: release 7385:7386 transaction 364 in, still active 00:27:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:31 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2b00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1281.589416] binder: send failed reply for transaction 364 to 7388:7390 00:27:31 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x8000a0}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:32 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa0008000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:32 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1282.324161] binder: undelivered TRANSACTION_COMPLETE [ 1282.329607] binder_release_work: 9 callbacks suppressed [ 1282.329613] binder: undelivered TRANSACTION_ERROR: 29189 00:27:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1282.368493] binder: undelivered TRANSACTION_ERROR: 29201 00:27:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1282.436972] binder: BINDER_SET_CONTEXT_MGR already set [ 1282.452167] binder: 7418:7420 ioctl 40046207 0 returned -16 [ 1282.453165] binder: undelivered TRANSACTION_ERROR: 29201 [ 1282.507881] binder_transaction: 4 callbacks suppressed [ 1282.507891] binder: 7418:7425 got reply transaction with no transaction stack [ 1282.543681] binder_transaction: 6 callbacks suppressed [ 1282.543697] binder: 7418:7425 transaction failed 29201/-71, size 0-0 line 2741 00:27:32 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x25}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1282.557487] binder: 7422:7427 got reply transaction with no transaction stack [ 1282.565977] binder: 7422:7427 transaction failed 29201/-71, size 0-0 line 2741 00:27:32 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:32 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x6000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:33 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1283.253439] binder: undelivered TRANSACTION_ERROR: 29189 [ 1283.262386] binder: undelivered TRANSACTION_ERROR: 29201 00:27:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1283.331388] binder: undelivered TRANSACTION_ERROR: 29201 [ 1283.356174] binder: 7449:7450 got reply transaction with no transaction stack [ 1283.393544] binder: 7449:7450 transaction failed 29201/-71, size 0-0 line 2741 [ 1283.403025] binder: BINDER_SET_CONTEXT_MGR already set [ 1283.448164] binder: release 7449:7450 transaction 373 out, still active [ 1283.456085] binder: 7452:7453 ioctl 40046207 0 returned -16 [ 1283.463612] binder: undelivered TRANSACTION_COMPLETE [ 1283.479653] binder: 7452:7453 got reply transaction with no transaction stack [ 1283.488426] binder: undelivered TRANSACTION_ERROR: 29201 00:27:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:33 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x4000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1283.494805] binder: send failed reply for transaction 373, target dead [ 1283.505419] binder: 7452:7453 transaction failed 29201/-71, size 0-0 line 2741 00:27:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1283.572175] binder: 7460:7462 got reply transaction with no transaction stack [ 1283.580011] binder: undelivered TRANSACTION_ERROR: 29201 [ 1283.592884] binder: 7460:7462 transaction failed 29201/-71, size 0-0 line 2741 [ 1283.605540] binder: release 7460:7462 transaction 377 out, still active 00:27:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:33 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xb3ff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1283.629633] binder: undelivered TRANSACTION_COMPLETE [ 1283.648935] binder: undelivered TRANSACTION_ERROR: 29201 [ 1283.654532] binder: send failed reply for transaction 377, target dead 00:27:34 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x15}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1283.723969] binder: 7466:7471 got reply transaction with no transaction stack [ 1283.746535] binder: 7466:7471 transaction failed 29201/-71, size 0-0 line 2741 [ 1283.746547] binder: BINDER_SET_CONTEXT_MGR already set [ 1283.806850] binder: 7470:7473 ioctl 40046207 0 returned -16 [ 1283.829139] binder: 7470:7480 got reply transaction with no transaction stack [ 1283.836637] binder: 7470:7480 transaction failed 29201/-71, size 0-0 line 2741 [ 1283.846392] binder: release 7470:7480 transaction 381 out, still active 00:27:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1283.853205] binder: undelivered TRANSACTION_COMPLETE [ 1283.876804] binder: undelivered TRANSACTION_ERROR: 29201 00:27:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1283.899074] binder: release 7466:7468 transaction 381 in, still active [ 1283.914702] binder: send failed reply for transaction 381, target dead [ 1284.015075] binder: 7484:7488 got reply transaction with no transaction stack [ 1284.135375] binder: 7484:7488 transaction failed 29201/-71, size 0-0 line 2741 00:27:34 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1284.224149] binder: BINDER_SET_CONTEXT_MGR already set 00:27:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1284.308627] binder: release 7484:7488 transaction 384 out, still active [ 1284.321257] binder: 7490:7491 ioctl 40046207 0 returned -16 [ 1284.331870] binder: undelivered TRANSACTION_COMPLETE [ 1284.392604] binder: send failed reply for transaction 384, target dead [ 1284.468520] binder: 7490:7493 got reply transaction with no transaction stack [ 1284.509200] binder: 7490:7493 transaction failed 29201/-71, size 0-0 line 2741 [ 1284.547910] binder: 7498:7500 got reply transaction with no transaction stack [ 1284.571642] binder: 7498:7500 transaction failed 29201/-71, size 0-0 line 2741 [ 1284.614598] binder: release 7498:7500 transaction 388 out, still active [ 1284.622639] binder: undelivered TRANSACTION_COMPLETE 00:27:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d18"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:34 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1284.662636] binder: send failed reply for transaction 388, target dead 00:27:35 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x34000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1284.728179] binder: release 7505:7507 transaction 391 out, still active [ 1284.743829] binder: undelivered TRANSACTION_COMPLETE 00:27:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d18"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:35 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x600}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1284.801787] binder: send failed reply for transaction 391, target dead [ 1284.903316] binder: release 7516:7518 transaction 394 out, still active [ 1284.915587] binder: undelivered TRANSACTION_COMPLETE 00:27:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d18"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1284.983983] binder: send failed reply for transaction 394, target dead 00:27:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1285.169575] binder: release 7525:7528 transaction 397 out, still active [ 1285.189178] binder: undelivered TRANSACTION_COMPLETE 00:27:35 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1285.272655] binder: BINDER_SET_CONTEXT_MGR already set [ 1285.278212] binder: 7529:7531 ioctl 40046207 0 returned -16 [ 1285.290984] binder: send failed reply for transaction 397, target dead 00:27:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1285.367712] binder: release 7536:7538 transaction 401 out, still active [ 1285.376153] binder: undelivered TRANSACTION_COMPLETE [ 1285.401285] binder: send failed reply for transaction 401, target dead 00:27:35 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x10000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1285.497848] binder: undelivered TRANSACTION_COMPLETE 00:27:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:35 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 1285.652772] binder: undelivered TRANSACTION_COMPLETE [ 1285.789539] binder: 7556:7558 ioctl c0306201 0 returned -14 [ 1285.823042] binder: undelivered TRANSACTION_COMPLETE 00:27:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:27:36 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x15}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1286.060418] binder: undelivered TRANSACTION_COMPLETE 00:27:36 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1286.140045] binder: BINDER_SET_CONTEXT_MGR already set [ 1286.146083] binder: 7566:7568 ioctl 40046207 0 returned -16 [ 1286.153277] binder: 7566:7568 unknown command 25344 [ 1286.173757] binder: 7566:7568 ioctl c0306201 20000440 returned -22 00:27:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:27:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0}) [ 1286.506856] binder_send_failed_reply: 5 callbacks suppressed [ 1286.506863] binder: send failed reply for transaction 414, target dead 00:27:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0}) 00:27:36 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xf00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:36 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x300000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1286.661792] binder: send failed reply for transaction 416, target dead 00:27:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0}) [ 1286.800176] binder: send failed reply for transaction 418, target dead 00:27:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1286.875173] binder: send failed reply for transaction 420, target dead [ 1286.920360] binder_alloc: 7604: binder_alloc_buf, no vma [ 1286.926288] binder: send failed reply for transaction 422 to 7604:7606 00:27:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1287.095141] binder: 7609:7610 unknown command 25344 [ 1287.102622] binder: 7609:7610 ioctl c0306201 20000440 returned -22 00:27:37 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2b00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:37 executing program 1: r0 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, 0x0) mq_timedreceive(r0, 0x0, 0x0, 0x0, 0x0) 00:27:37 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:37 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt(r1, 0x100000040000010e, 0x8, 0x0, 0x0) 00:27:37 executing program 1: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000540)=@filter={'filter\x00', 0xe, 0x1, 0x130, [0x0, 0x20000180, 0x200001b0, 0x200001e0], 0x0, 0x0, &(0x7f0000000180)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x15, 0x0, 0x0, 'syz_tun\x00', 'yam0\x00', 'bond_slave_1\x00', 'sit0\x00', @dev, [], @link_local, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x1a8) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000440)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x1) 00:27:37 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() timer_create(0x0, &(0x7f0000ee4000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000e04000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = timerfd_create(0x0, 0x0) read(r2, &(0x7f0000000140)=""/87, 0x57) timerfd_settime(r2, 0x0, &(0x7f0000000100)={{0x77359400}, {0x0, 0x989680}}, 0x0) tkill(r1, 0x1000000000016) 00:27:37 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xe803}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:37 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x600000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:38 executing program 1: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket(0x10, 0x80002, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@bridge_setlink={0x20, 0x13, 0x129, 0x0, 0x0, {0x7, 0x0, 0x0, r3}}, 0x20}}, 0x0) sendmmsg$alg(r1, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) 00:27:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1287.938344] binder_release_work: 11 callbacks suppressed [ 1287.938351] binder: undelivered TRANSACTION_ERROR: 29201 00:27:38 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1288.117648] binder: 7654:7655 unknown command 25344 [ 1288.122791] binder: 7654:7655 ioctl c0306201 20000440 returned -22 [ 1288.184134] binder_transaction: 6 callbacks suppressed [ 1288.184145] binder: 7654:7662 got reply transaction with no transaction stack [ 1288.197777] binder_transaction: 7 callbacks suppressed [ 1288.197807] binder: 7654:7662 transaction failed 29201/-71, size 0-0 line 2741 00:27:38 executing program 1: msgget(0x1, 0x0) 00:27:38 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3000000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:38 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:38 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x15}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:39 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xf401000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1288.926634] binder: undelivered TRANSACTION_ERROR: 29201 00:27:39 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1289.085548] binder: 7689:7691 unknown command 4219648 [ 1289.131266] binder: 7689:7691 ioctl c0306201 20000440 returned -22 [ 1289.216044] binder: 7689:7691 got reply transaction with no transaction stack [ 1289.290296] binder: 7689:7691 transaction failed 29201/-71, size 0-0 line 2741 00:27:39 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xe00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1289.395683] binder: undelivered TRANSACTION_ERROR: 29201 [ 1289.537894] binder: 7705:7708 unknown command 4219648 [ 1289.556916] binder: BINDER_SET_CONTEXT_MGR already set [ 1289.580926] binder: 7707:7709 ioctl 40046207 0 returned -16 [ 1289.588711] binder: 7705:7708 ioctl c0306201 20000440 returned -22 [ 1289.589127] binder: 7705:7711 got reply transaction with no transaction stack [ 1289.618645] binder: 7705:7711 transaction failed 29201/-71, size 0-0 line 2741 00:27:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1289.651030] binder: undelivered TRANSACTION_ERROR: 29201 [ 1289.656806] binder: send failed reply for transaction 432 to 7707:7709 [ 1289.678920] binder: 7707:7712 got reply transaction with no transaction stack [ 1289.693472] binder: 7707:7712 transaction failed 29201/-71, size 0-0 line 2741 [ 1289.748365] binder: 7714:7715 unknown command 4219648 [ 1289.784510] binder: 7714:7715 ioctl c0306201 20000440 returned -22 [ 1289.810633] binder: 7714:7715 got reply transaction with no transaction stack 00:27:40 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffffffa0008000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:40 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2b00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1289.828438] binder: 7714:7715 transaction failed 29201/-71, size 0-0 line 2741 00:27:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1289.918751] binder: undelivered TRANSACTION_ERROR: 29201 00:27:40 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1290.063993] binder: 7724:7725 got reply transaction with no transaction stack [ 1290.071354] binder: 7724:7725 transaction failed 29201/-71, size 0-0 line 2741 [ 1290.139314] binder_thread_release: 19 callbacks suppressed [ 1290.139324] binder: release 7724:7725 transaction 437 out, still active [ 1290.151966] binder_release_work: 6 callbacks suppressed [ 1290.151971] binder: undelivered TRANSACTION_COMPLETE 00:27:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1290.234586] binder: undelivered TRANSACTION_ERROR: 29201 [ 1290.240106] binder: send failed reply for transaction 437, target dead 00:27:40 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x8000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1290.335595] binder: undelivered TRANSACTION_COMPLETE [ 1290.340942] binder: undelivered TRANSACTION_ERROR: 29189 00:27:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1290.390775] binder: 7735:7736 got reply transaction with no transaction stack [ 1290.427081] binder: undelivered TRANSACTION_ERROR: 29201 [ 1290.484658] binder: 7735:7736 transaction failed 29201/-71, size 0-0 line 2741 [ 1290.572695] binder: release 7735:7736 transaction 440 out, still active [ 1290.597015] binder: BINDER_SET_CONTEXT_MGR already set [ 1290.614275] binder: undelivered TRANSACTION_COMPLETE 00:27:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1290.634397] binder: 7741:7742 ioctl 40046207 0 returned -16 [ 1290.658691] binder: undelivered TRANSACTION_ERROR: 29201 [ 1290.687632] binder: send failed reply for transaction 440, target dead [ 1290.783823] binder: 7741:7747 got reply transaction with no transaction stack [ 1290.786250] binder: 7749:7750 got reply transaction with no transaction stack [ 1290.800232] binder: 7749:7750 transaction failed 29201/-71, size 0-0 line 2741 [ 1290.817408] binder: release 7749:7750 transaction 444 out, still active [ 1290.825807] binder: undelivered TRANSACTION_COMPLETE 00:27:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1290.842678] binder: 7741:7747 transaction failed 29201/-71, size 0-0 line 2741 [ 1290.873930] binder: undelivered TRANSACTION_ERROR: 29201 [ 1290.881465] binder: send failed reply for transaction 444, target dead 00:27:41 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x6000000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:41 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1290.956898] binder: 7754:7756 ioctl c0306201 0 returned -14 [ 1290.962925] binder: 7754:7756 got reply transaction with no transaction stack [ 1290.974224] binder: 7754:7756 transaction failed 29201/-71, size 0-0 line 2741 [ 1291.006537] binder: release 7754:7756 transaction 447 out, still active [ 1291.016453] binder: undelivered TRANSACTION_COMPLETE 00:27:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1291.083941] binder: send failed reply for transaction 447, target dead 00:27:41 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xea010000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1291.168372] binder: 7765:7766 ioctl c0306201 0 returned -14 [ 1291.195545] binder: release 7765:7766 transaction 450 out, still active [ 1291.210273] binder: undelivered TRANSACTION_COMPLETE 00:27:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1291.288951] binder: send failed reply for transaction 450, target dead 00:27:41 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x40000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1291.492021] binder: 7775:7776 ioctl c0306201 0 returned -14 [ 1291.571985] binder: release 7775:7776 transaction 453 out, still active [ 1291.586502] binder: undelivered TRANSACTION_COMPLETE 00:27:41 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x29}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1291.705043] binder: send failed reply for transaction 453, target dead 00:27:42 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:42 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x8000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:42 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x29000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:42 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3f00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1292.633605] binder: release 7786:7787 transaction 456 out, still active [ 1292.651768] binder: undelivered TRANSACTION_COMPLETE 00:27:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1292.708987] binder: send failed reply for transaction 456, target dead 00:27:43 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2a000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:43 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:43 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2400}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:43 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xf00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:43 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1293.673794] binder: release 7811:7813 transaction 459 out, still active [ 1293.680792] binder: undelivered TRANSACTION_COMPLETE 00:27:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1293.739417] binder_release_work: 5 callbacks suppressed [ 1293.739424] binder: undelivered TRANSACTION_ERROR: 29201 [ 1293.811752] binder: send failed reply for transaction 459, target dead 00:27:44 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1293.971445] binder_transaction: 4 callbacks suppressed [ 1293.971455] binder: 7839:7843 got reply transaction with no transaction stack 00:27:44 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x6000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1294.112184] binder_transaction: 4 callbacks suppressed [ 1294.112202] binder: 7839:7843 transaction failed 29201/-71, size 0-0 line 2741 00:27:44 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xf00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:44 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1294.693726] binder: release 7839:7840 transaction 462 out, still active [ 1294.715181] binder: undelivered TRANSACTION_COMPLETE 00:27:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080), 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1294.795470] binder: undelivered TRANSACTION_ERROR: 29201 [ 1294.827342] binder: send failed reply for transaction 462, target dead 00:27:45 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:45 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x700000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1295.067890] binder: 7869:7877 got reply transaction with no transaction stack [ 1295.092720] binder: 7869:7877 transaction failed 29201/-71, size 0-0 line 2741 00:27:45 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x7}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:45 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xea01000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080), 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1295.803845] binder: release 7869:7870 transaction 465 out, still active [ 1295.819876] binder: undelivered TRANSACTION_COMPLETE [ 1295.877466] binder: undelivered TRANSACTION_ERROR: 29201 00:27:46 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:46 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xeffdffff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1295.953621] binder: send failed reply for transaction 465, target dead 00:27:46 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x700000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1296.096749] binder: 7896:7902 got reply transaction with no transaction stack [ 1296.291356] binder: 7896:7902 transaction failed 29201/-71, size 0-0 line 2741 00:27:46 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x800000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:47 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1296.843633] binder: release 7896:7898 transaction 468 out, still active [ 1296.850440] binder: undelivered TRANSACTION_COMPLETE [ 1296.883662] binder: undelivered TRANSACTION_ERROR: 29201 [ 1296.889158] binder: send failed reply for transaction 468, target dead 00:27:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080), 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:47 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1297.208443] binder: 7928:7933 got reply transaction with no transaction stack [ 1297.263715] binder: 7928:7933 transaction failed 29201/-71, size 0-0 line 2741 00:27:47 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xf401}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:47 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x700000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1297.913788] binder: release 7928:7931 transaction 471 out, still active [ 1297.920598] binder: undelivered TRANSACTION_COMPLETE 00:27:48 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x40000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:48 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1298.074813] binder: undelivered TRANSACTION_ERROR: 29201 [ 1298.141521] binder: send failed reply for transaction 471, target dead [ 1298.161514] binder: 7955:7958 got reply transaction with no transaction stack 00:27:48 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x6000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1298.209657] binder: 7955:7958 transaction failed 29201/-71, size 0-0 line 2741 [ 1298.280335] binder: release 7955:7958 transaction 474 out, still active [ 1298.311136] binder: undelivered TRANSACTION_COMPLETE 00:27:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1298.402878] binder: undelivered TRANSACTION_ERROR: 29201 [ 1298.413476] binder: send failed reply for transaction 474, target dead 00:27:48 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x10}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1298.572238] binder: 7970:7972 got reply transaction with no transaction stack [ 1298.639640] binder: 7970:7972 transaction failed 29201/-71, size 0-0 line 2741 [ 1298.718638] binder: release 7970:7972 transaction 477 out, still active [ 1298.733184] binder: undelivered TRANSACTION_COMPLETE 00:27:49 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x7}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1298.870808] binder: undelivered TRANSACTION_ERROR: 29201 [ 1298.876651] binder: send failed reply for transaction 477, target dead 00:27:49 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1299.146568] binder: 7983:7986 got reply transaction with no transaction stack [ 1299.242798] binder: 7983:7986 transaction failed 29201/-71, size 0-0 line 2741 00:27:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000480)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1299.313556] binder: release 7983:7986 transaction 480 out, still active [ 1299.320361] binder: undelivered TRANSACTION_COMPLETE [ 1299.341198] binder: undelivered TRANSACTION_ERROR: 29201 [ 1299.346926] binder: send failed reply for transaction 480, target dead 00:27:49 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2a000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1299.461548] binder: 7994:7996 got reply transaction with no transaction stack 00:27:49 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3f000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1299.505882] binder: 7994:7996 transaction failed 29201/-71, size 0-0 line 2741 00:27:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000480)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1299.633607] binder: release 7994:7996 transaction 483 out, still active [ 1299.640612] binder: undelivered TRANSACTION_COMPLETE [ 1299.652613] binder: undelivered TRANSACTION_ERROR: 29201 [ 1299.666665] binder: send failed reply for transaction 483, target dead [ 1299.862611] binder: 8009:8011 got reply transaction with no transaction stack [ 1299.883865] binder: 8009:8011 transaction failed 29201/-71, size 0-0 line 2741 00:27:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1299.912742] binder: release 8009:8011 transaction 486 out, still active [ 1299.926255] binder: undelivered TRANSACTION_COMPLETE 00:27:50 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x6}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000480)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1299.959216] binder: undelivered TRANSACTION_ERROR: 29201 [ 1299.975022] binder: send failed reply for transaction 486, target dead [ 1300.005972] binder: 8013:8014 got reply transaction with no transaction stack [ 1300.017778] binder: 8013:8014 transaction failed 29201/-71, size 0-0 line 2741 [ 1300.142542] binder: BINDER_SET_CONTEXT_MGR already set [ 1300.206126] binder: release 8013:8014 transaction 489 out, still active [ 1300.213045] binder: 8018:8021 ioctl 40046207 0 returned -16 [ 1300.225211] binder: undelivered TRANSACTION_COMPLETE 00:27:50 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1300.311655] binder: 8018:8022 got reply transaction with no transaction stack 00:27:50 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x60000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1300.365694] binder: undelivered TRANSACTION_ERROR: 29201 [ 1300.371225] binder: send failed reply for transaction 489, target dead [ 1300.414059] binder: 8018:8022 transaction failed 29201/-71, size 0-0 line 2741 [ 1300.464655] binder: send failed reply for transaction 491 to 8018:8022 [ 1300.507599] binder: undelivered TRANSACTION_COMPLETE [ 1300.542046] binder: undelivered TRANSACTION_ERROR: 29189 00:27:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1300.627546] binder: undelivered TRANSACTION_ERROR: 29201 00:27:51 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3f00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:27:51 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2700}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1300.873188] binder: 8037:8038 got reply transaction with no transaction stack [ 1300.976549] binder: 8037:8038 transaction failed 29201/-71, size 0-0 line 2741 [ 1301.070488] binder: release 8037:8038 transaction 494 out, still active [ 1301.096931] binder: undelivered TRANSACTION_COMPLETE 00:27:51 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1, 0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 00:27:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1301.321583] binder: undelivered TRANSACTION_ERROR: 29201 [ 1301.398606] binder: send failed reply for transaction 494, target dead 00:27:51 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xf00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1301.502374] binder: 8056:8057 got reply transaction with no transaction stack [ 1301.608278] binder: 8056:8057 transaction failed 29201/-71, size 0-0 line 2741 00:27:51 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x24}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1301.726792] binder: release 8056:8057 transaction 497 out, still active [ 1301.740128] binder: undelivered TRANSACTION_COMPLETE 00:27:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1301.777712] binder: undelivered TRANSACTION_ERROR: 29201 [ 1301.783435] binder: send failed reply for transaction 497, target dead [ 1301.907674] binder: 8065:8068 got reply transaction with no transaction stack 00:27:52 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x8000a0}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1302.004183] binder: 8065:8068 transaction failed 29201/-71, size 0-0 line 2741 [ 1302.040120] binder: release 8065:8068 transaction 500 out, still active [ 1302.061662] binder: undelivered TRANSACTION_COMPLETE 00:27:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1302.098816] binder: undelivered TRANSACTION_ERROR: 29201 [ 1302.126454] binder: send failed reply for transaction 500, target dead 00:27:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffffbf}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1302.291859] binder: 8082:8084 got reply transaction with no transaction stack 00:27:52 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0xa0008000}], 0x1, 0x0, 0x0) [ 1302.422614] binder: 8082:8084 transaction failed 29201/-71, size 0-0 line 2741 00:27:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1302.530318] binder: release 8082:8084 transaction 503 out, still active [ 1302.544230] binder: undelivered TRANSACTION_COMPLETE [ 1302.558952] binder: send failed reply for transaction 503, target dead [ 1302.727126] binder: 8091:8094 got reply transaction with no transaction stack 00:27:53 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r3 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r3, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r3, 0x8c) r4 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r5 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r5, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r6 = accept4(r3, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my}, 0x10) dup2(r2, r1) shutdown(0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) fcntl$notify(r0, 0x402, 0x2d) [ 1302.783084] binder: 8091:8094 transaction failed 29201/-71, size 0-0 line 2741 [ 1302.805249] binder: release 8091:8094 transaction 506 out, still active [ 1302.816934] binder: undelivered TRANSACTION_COMPLETE 00:27:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1302.897702] binder: send failed reply for transaction 506, target dead 00:27:53 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xc0ffffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1303.085025] binder: release 8107:8108 transaction 509 out, still active [ 1303.101733] binder: undelivered TRANSACTION_COMPLETE 00:27:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:53 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x60000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1303.270062] binder: send failed reply for transaction 509, target dead 00:27:53 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x7000000}], 0x1, 0x0, 0x0) [ 1303.545888] binder: release 8115:8117 transaction 512 out, still active [ 1303.552732] binder: undelivered TRANSACTION_COMPLETE 00:27:53 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x9}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1303.707682] binder: send failed reply for transaction 512, target dead [ 1303.842960] binder: release 8132:8134 transaction 515 out, still active [ 1303.863317] binder: undelivered TRANSACTION_COMPLETE 00:27:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1303.973810] binder_release_work: 4 callbacks suppressed [ 1303.973817] binder: undelivered TRANSACTION_ERROR: 29201 [ 1304.026925] binder: send failed reply for transaction 515, target dead 00:27:54 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r3 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r3, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r3, 0x8c) r4 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r5 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r5, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r6 = accept4(r3, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my}, 0x10) dup2(r2, r1) shutdown(0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) fcntl$notify(r0, 0x402, 0x2d) [ 1304.208836] binder_transaction: 3 callbacks suppressed [ 1304.208845] binder: 8138:8140 got reply transaction with no transaction stack [ 1304.259235] binder_transaction: 3 callbacks suppressed [ 1304.259252] binder: 8138:8140 transaction failed 29201/-71, size 0-0 line 2741 [ 1304.273318] binder: release 8138:8140 transaction 518 out, still active [ 1304.309713] binder: undelivered TRANSACTION_COMPLETE 00:27:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1304.369960] binder: undelivered TRANSACTION_ERROR: 29201 [ 1304.376570] binder: send failed reply for transaction 518, target dead 00:27:54 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x100000}], 0x1, 0x0, 0x0) [ 1304.481266] binder: 8149:8150 got reply transaction with no transaction stack [ 1304.572245] binder: 8149:8150 transaction failed 29201/-71, size 0-0 line 2741 00:27:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:54 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffffbf}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1304.615177] binder: release 8149:8150 transaction 521 out, still active [ 1304.621947] binder: undelivered TRANSACTION_COMPLETE [ 1304.644611] binder: undelivered TRANSACTION_ERROR: 29201 [ 1304.650331] binder: send failed reply for transaction 521, target dead [ 1304.799360] binder: 8157:8161 got reply transaction with no transaction stack [ 1304.868831] binder: 8157:8161 transaction failed 29201/-71, size 0-0 line 2741 [ 1305.081474] binder: undelivered TRANSACTION_ERROR: 29201 [ 1305.087214] binder: send failed reply for transaction 524, target dead 00:27:55 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x30}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:55 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1305.190521] binder: 8167:8169 got reply transaction with no transaction stack 00:27:55 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r3 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r3, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r3, 0x8c) r4 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r5 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r5, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r6 = accept4(r3, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my}, 0x10) dup2(r2, r1) shutdown(0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) fcntl$notify(r0, 0x402, 0x2d) [ 1305.272410] binder: 8167:8169 transaction failed 29201/-71, size 0-0 line 2741 00:27:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1305.468857] binder: undelivered TRANSACTION_ERROR: 29201 [ 1305.474965] binder: send failed reply for transaction 527, target dead 00:27:55 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x8000a0ffffffff}], 0x1, 0x0, 0x0) [ 1305.766862] binder: 8181:8185 got reply transaction with no transaction stack 00:27:56 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffb3}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1305.808470] binder: 8181:8185 transaction failed 29201/-71, size 0-0 line 2741 00:27:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1305.884667] binder: undelivered TRANSACTION_ERROR: 29201 [ 1305.960505] binder: 8190:8193 got reply transaction with no transaction stack [ 1306.022506] binder: 8190:8193 transaction failed 29201/-71, size 0-0 line 2741 00:27:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1306.098061] binder: undelivered TRANSACTION_ERROR: 29201 00:27:56 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xea01}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:56 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2700000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1306.225505] binder: 8198:8200 got reply transaction with no transaction stack [ 1306.249614] binder: 8198:8200 transaction failed 29201/-71, size 0-0 line 2741 [ 1306.345470] binder_thread_release: 4 callbacks suppressed [ 1306.345481] binder: release 8198:8200 transaction 536 out, still active 00:27:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d18"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1306.392928] binder_release_work: 4 callbacks suppressed [ 1306.392933] binder: undelivered TRANSACTION_COMPLETE [ 1306.437639] binder: undelivered TRANSACTION_ERROR: 29201 00:27:56 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r3 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r3, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r3, 0x8c) r4 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r5 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r5, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r6 = accept4(r3, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my}, 0x10) dup2(r2, r1) shutdown(0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) fcntl$notify(r0, 0x402, 0x2d) [ 1306.621082] binder: 8211:8212 got reply transaction with no transaction stack [ 1306.708853] binder: 8211:8212 transaction failed 29201/-71, size 0-0 line 2741 [ 1306.728557] binder: release 8211:8212 transaction 539 out, still active [ 1306.742047] binder: undelivered TRANSACTION_COMPLETE [ 1306.753738] binder: undelivered TRANSACTION_ERROR: 29201 00:27:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d18"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:27:57 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x3000000}], 0x1, 0x0, 0x0) [ 1306.888928] binder: 8218:8221 got reply transaction with no transaction stack [ 1307.014283] binder: 8218:8221 transaction failed 29201/-71, size 0-0 line 2741 00:27:57 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x900000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1307.099637] binder: release 8218:8221 transaction 542 out, still active [ 1307.119834] binder: undelivered TRANSACTION_COMPLETE 00:27:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d18"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1307.211951] binder: undelivered TRANSACTION_ERROR: 29201 [ 1307.218112] binder_send_failed_reply: 4 callbacks suppressed [ 1307.218119] binder: send failed reply for transaction 542, target dead 00:27:57 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1307.436224] binder: 8232:8234 got reply transaction with no transaction stack [ 1307.527588] binder: 8232:8234 transaction failed 29201/-71, size 0-0 line 2741 [ 1307.599454] binder: release 8232:8234 transaction 545 out, still active [ 1307.608701] binder: undelivered TRANSACTION_COMPLETE 00:27:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1307.696128] binder: send failed reply for transaction 545, target dead 00:27:58 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0xa000}], 0x1, 0x0, 0x0) 00:27:58 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x200015e5}], 0x1}}], 0x1, 0x0, 0x0) [ 1307.881483] binder: release 8245:8247 transaction 548 out, still active [ 1307.900803] binder: undelivered TRANSACTION_COMPLETE 00:27:58 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x80ffffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 1308.006006] binder: release 8245:8247 transaction 548 in, still active [ 1308.013167] binder: send failed reply for transaction 548, target dead [ 1308.083977] binder: 8254:8255 ioctl c0306201 0 returned -14 [ 1308.124238] binder: release 8254:8255 transaction 550 out, still active [ 1308.152800] binder: undelivered TRANSACTION_COMPLETE 00:27:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1308.223311] binder: release 8254:8255 transaction 550 in, still active [ 1308.232387] binder: send failed reply for transaction 550, target dead 00:27:58 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x10000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1308.324465] binder: release 8263:8264 transaction 552 out, still active [ 1308.331232] binder: undelivered TRANSACTION_COMPLETE 00:27:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1308.366500] binder: release 8263:8264 transaction 552 in, still active [ 1308.373184] binder: send failed reply for transaction 552, target dead [ 1308.435661] binder: undelivered TRANSACTION_COMPLETE 00:27:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1308.457575] binder: send failed reply for transaction 554, target dead 00:27:58 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2400}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1308.533211] binder: undelivered TRANSACTION_COMPLETE 00:27:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0}) [ 1308.573302] binder: send failed reply for transaction 556, target dead 00:27:58 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x4000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:27:59 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x1000000}], 0x1, 0x0, 0x0) 00:27:59 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x200015e5}], 0x1}}], 0x1, 0x0, 0x0) [ 1308.861917] binder: undelivered TRANSACTION_COMPLETE 00:27:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0}) [ 1308.904014] binder: send failed reply for transaction 558, target dead 00:27:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0}) [ 1309.005724] binder: send failed reply for transaction 560, target dead 00:27:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1309.103087] binder: send failed reply for transaction 562, target dead [ 1309.232492] binder_alloc: 8305: binder_alloc_buf, no vma [ 1309.267240] binder: 8305:8306 transaction failed 29189/-3, size 0-0 line 2973 [ 1309.320827] binder: send failed reply for transaction 564 to 8305:8306 00:27:59 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xf401}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1309.376836] binder_release_work: 1 callbacks suppressed [ 1309.376843] binder: undelivered TRANSACTION_ERROR: 29189 00:27:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1309.507931] binder: undelivered TRANSACTION_ERROR: 29190 [ 1309.614440] binder_alloc: 8315: binder_alloc_buf, no vma [ 1309.622075] binder: 8315:8317 transaction failed 29189/-3, size 0-0 line 2973 [ 1309.632392] binder: send failed reply for transaction 567 to 8315:8317 [ 1309.642642] binder: undelivered TRANSACTION_ERROR: 29189 00:27:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:27:59 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1ea}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1309.680122] binder: undelivered TRANSACTION_ERROR: 29190 00:28:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0}) 00:28:00 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x3}], 0x1, 0x0, 0x0) 00:28:00 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2b00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1309.898029] binder_alloc: 8322: binder_alloc_buf, no vma [ 1309.904536] binder: 8322:8324 transaction failed 29189/-3, size 0-0 line 2973 [ 1309.913212] binder: send failed reply for transaction 570 to 8322:8324 [ 1309.924773] binder: BINDER_SET_CONTEXT_MGR already set [ 1309.953595] binder: 8327:8330 ioctl 40046207 0 returned -16 [ 1309.953930] binder: undelivered TRANSACTION_ERROR: 29189 00:28:00 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xd000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1310.038182] binder: undelivered TRANSACTION_ERROR: 29190 [ 1310.044204] binder: send failed reply for transaction 572 to 8327:8330 00:28:00 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2300000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:00 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xd00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1310.713923] binder: undelivered TRANSACTION_ERROR: 29189 00:28:01 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x800000000000000}], 0x1, 0x0, 0x0) 00:28:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0}) 00:28:01 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2a}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:01 executing program 1 (fault-call:8 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:01 executing program 5 (fault-call:8 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1311.209221] FAULT_INJECTION: forcing a failure. [ 1311.209221] name failslab, interval 1, probability 0, space 0, times 0 [ 1311.304315] CPU: 1 PID: 8371 Comm: syz-executor1 Not tainted 4.20.0-rc3+ #123 [ 1311.311625] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1311.320979] Call Trace: [ 1311.323589] dump_stack+0x244/0x39d [ 1311.327254] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1311.332463] ? __lock_acquire+0x62f/0x4c20 [ 1311.336726] should_fail.cold.4+0xa/0x17 [ 1311.340808] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1311.345936] ? zap_class+0x640/0x640 [ 1311.349662] ? zap_class+0x640/0x640 [ 1311.353406] ? mark_held_locks+0x130/0x130 [ 1311.357674] ? find_held_lock+0x36/0x1c0 [ 1311.361777] ? perf_trace_sched_process_exec+0x860/0x860 [ 1311.367246] ? kasan_check_read+0x11/0x20 [ 1311.371412] __should_failslab+0x124/0x180 [ 1311.375659] should_failslab+0x9/0x14 [ 1311.379493] kmem_cache_alloc_trace+0x2d7/0x750 [ 1311.384187] ? _raw_spin_unlock+0x2c/0x50 [ 1311.388420] binder_transaction+0xadf/0x7180 [ 1311.392845] ? __lock_acquire+0x62f/0x4c20 [ 1311.397113] ? print_usage_bug+0xc0/0xc0 [ 1311.401197] ? print_usage_bug+0xc0/0xc0 [ 1311.405294] ? binder_translate_handle.isra.39+0xde0/0xde0 [ 1311.410948] ? __lock_acquire+0x62f/0x4c20 [ 1311.415207] ? mark_held_locks+0x130/0x130 [ 1311.419462] ? mark_held_locks+0x130/0x130 [ 1311.423710] ? __lock_acquire+0x62f/0x4c20 [ 1311.427962] ? __lock_acquire+0x62f/0x4c20 [ 1311.432207] ? __mutex_lock+0x85e/0x16f0 [ 1311.436283] ? print_usage_bug+0xc0/0xc0 [ 1311.440368] ? mark_held_locks+0x130/0x130 [ 1311.444618] ? mark_held_locks+0x130/0x130 [ 1311.448873] ? zap_class+0x640/0x640 [ 1311.452610] ? find_held_lock+0x36/0x1c0 [ 1311.456687] ? zap_class+0x640/0x640 [ 1311.460411] ? zap_class+0x640/0x640 [ 1311.464150] ? print_usage_bug+0xc0/0xc0 [ 1311.468224] ? find_held_lock+0x36/0x1c0 [ 1311.472305] ? __might_fault+0x12b/0x1e0 [ 1311.476379] ? lock_downgrade+0x900/0x900 [ 1311.480539] ? lock_release+0xa00/0xa00 [ 1311.484536] ? perf_trace_sched_process_exec+0x860/0x860 [ 1311.489997] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1311.495545] ? check_preemption_disabled+0x48/0x280 [ 1311.500649] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1311.506207] ? _copy_from_user+0xdf/0x150 [ 1311.510383] binder_thread_write+0xa24/0x2b50 [ 1311.514934] ? trace_event_raw_event_binder_transaction_ref_to_ref+0x540/0x540 [ 1311.522304] ? mark_held_locks+0x130/0x130 [ 1311.526545] ? print_usage_bug+0xc0/0xc0 [ 1311.530679] ? ima_get_action+0x7e/0xa0 [ 1311.534664] ? print_usage_bug+0xc0/0xc0 [ 1311.538754] ? zap_class+0x640/0x640 [ 1311.542483] ? __lock_acquire+0x62f/0x4c20 [ 1311.546727] ? zap_class+0x640/0x640 [ 1311.550489] ? find_held_lock+0x36/0x1c0 [ 1311.554562] ? __might_fault+0x12b/0x1e0 [ 1311.558672] ? lock_downgrade+0x900/0x900 [ 1311.562851] ? lock_release+0xa00/0xa00 [ 1311.566841] ? perf_trace_sched_process_exec+0x860/0x860 [ 1311.572329] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1311.577876] ? _copy_from_user+0xdf/0x150 [ 1311.582051] binder_ioctl_write_read.isra.42+0x306/0xba0 [ 1311.587509] ? kasan_check_read+0x11/0x20 [ 1311.591676] ? binder_thread_write+0x2b50/0x2b50 [ 1311.596480] ? _raw_spin_unlock+0x2c/0x50 [ 1311.600677] ? _binder_inner_proc_unlock+0x3f/0x80 [ 1311.605629] ? binder_get_thread+0x1b6/0x880 [ 1311.610057] ? binder_new_node+0x8d0/0x8d0 [ 1311.614306] ? perf_trace_sched_process_exec+0x860/0x860 [ 1311.619778] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 1311.625332] ? rcu_pm_notify+0xc0/0xc0 [ 1311.629256] ? binder_ioctl_write_read.isra.42+0xba0/0xba0 [ 1311.634906] binder_ioctl+0xaba/0x194a [ 1311.638831] ? binder_ioctl_write_read.isra.42+0xba0/0xba0 [ 1311.644468] ? find_held_lock+0x36/0x1c0 [ 1311.648550] ? __fget+0x4aa/0x740 [ 1311.652018] ? lock_downgrade+0x900/0x900 [ 1311.656170] ? check_preemption_disabled+0x48/0x280 [ 1311.661174] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 1311.666113] ? smk_access+0x53b/0x700 [ 1311.667077] binder: BINDER_SET_CONTEXT_MGR already set [ 1311.669924] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1311.669950] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1311.669966] ? smack_log+0x423/0x590 [ 1311.669989] ? smk_access_entry+0x310/0x310 [ 1311.670008] ? __fget+0x4d1/0x740 [ 1311.675527] binder: 8374:8380 ioctl 40046207 0 returned -16 [ 1311.680593] ? smk_tskacc+0x3dd/0x520 [ 1311.680620] ? smack_privileged+0xd0/0xd0 [ 1311.680641] ? binder_ioctl_write_read.isra.42+0xba0/0xba0 [ 1311.716925] do_vfs_ioctl+0x1de/0x1790 [ 1311.720824] ? __lock_is_held+0xb5/0x140 [ 1311.724912] ? ioctl_preallocate+0x300/0x300 [ 1311.729334] ? smk_curacc+0x7f/0xa0 [ 1311.732976] ? smack_file_ioctl+0x210/0x3c0 [ 1311.737317] ? fget_raw+0x20/0x20 [ 1311.737470] FAULT_INJECTION: forcing a failure. [ 1311.737470] name failslab, interval 1, probability 0, space 0, times 0 [ 1311.740775] ? smack_file_lock+0x2e0/0x2e0 [ 1311.740800] ? fput+0x130/0x1a0 [ 1311.740828] ? do_syscall_64+0x9a/0x820 [ 1311.763449] ? do_syscall_64+0x9a/0x820 [ 1311.767447] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1311.772999] ? security_file_ioctl+0x94/0xc0 [ 1311.777423] ksys_ioctl+0xa9/0xd0 [ 1311.780894] __x64_sys_ioctl+0x73/0xb0 [ 1311.784793] do_syscall_64+0x1b9/0x820 [ 1311.788702] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1311.794081] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1311.799031] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1311.803892] ? trace_hardirqs_on_caller+0x310/0x310 [ 1311.808921] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1311.813956] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1311.818817] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1311.824013] RIP: 0033:0x457569 [ 1311.827210] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1311.846131] RSP: 002b:00007ff9dc3bac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1311.853854] RAX: ffffffffffffffda RBX: 00007ff9dc3bac90 RCX: 0000000000457569 [ 1311.861150] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1311.868442] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1311.875723] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff9dc3bb6d4 [ 1311.882993] R13: 00000000004be918 R14: 00000000004ceeb8 R15: 0000000000000007 [ 1311.915611] CPU: 1 PID: 8383 Comm: syz-executor5 Not tainted 4.20.0-rc3+ #123 [ 1311.922892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1311.932418] Call Trace: [ 1311.935012] dump_stack+0x244/0x39d [ 1311.938655] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1311.943874] should_fail.cold.4+0xa/0x17 [ 1311.947947] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1311.953065] ? print_usage_bug+0xc0/0xc0 [ 1311.957145] ? zap_class+0x640/0x640 [ 1311.960879] ? find_held_lock+0x36/0x1c0 [ 1311.964977] ? perf_trace_sched_process_exec+0x860/0x860 [ 1311.970450] __should_failslab+0x124/0x180 [ 1311.974697] should_failslab+0x9/0x14 [ 1311.978513] kmem_cache_alloc_trace+0x2d7/0x750 [ 1311.983199] ? _raw_spin_unlock+0x2c/0x50 [ 1311.987361] binder_get_thread+0x255/0x880 [ 1311.991607] ? binder_new_node+0x8d0/0x8d0 [ 1311.995856] ? perf_trace_sched_process_exec+0x860/0x860 [ 1312.001379] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 1312.006924] ? rcu_pm_notify+0xc0/0xc0 [ 1312.010831] ? __might_sleep+0x95/0x190 [ 1312.014820] ? binder_ioctl_write_read.isra.42+0xba0/0xba0 [ 1312.020452] binder_ioctl+0x275/0x194a [ 1312.024375] ? binder_ioctl_write_read.isra.42+0xba0/0xba0 [ 1312.030010] ? find_held_lock+0x36/0x1c0 [ 1312.034090] ? __fget+0x4aa/0x740 [ 1312.037576] ? lock_downgrade+0x900/0x900 [ 1312.041764] ? check_preemption_disabled+0x48/0x280 [ 1312.046787] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 1312.051725] ? smk_access+0x53b/0x700 [ 1312.055532] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1312.060824] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1312.066388] ? smack_log+0x423/0x590 [ 1312.070124] ? smk_access_entry+0x310/0x310 [ 1312.074480] ? __fget+0x4d1/0x740 [ 1312.077954] ? smk_tskacc+0x3dd/0x520 [ 1312.081776] ? smack_privileged+0xd0/0xd0 [ 1312.085935] ? binder_ioctl_write_read.isra.42+0xba0/0xba0 [ 1312.091566] do_vfs_ioctl+0x1de/0x1790 [ 1312.095489] ? __lock_is_held+0xb5/0x140 [ 1312.099566] ? ioctl_preallocate+0x300/0x300 [ 1312.104003] ? smk_curacc+0x7f/0xa0 [ 1312.107658] ? smack_file_ioctl+0x210/0x3c0 [ 1312.111984] ? fget_raw+0x20/0x20 [ 1312.115467] ? smack_file_lock+0x2e0/0x2e0 [ 1312.119738] ? fput+0x130/0x1a0 [ 1312.123026] ? do_syscall_64+0x9a/0x820 [ 1312.127022] ? do_syscall_64+0x9a/0x820 [ 1312.131066] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1312.136619] ? security_file_ioctl+0x94/0xc0 [ 1312.141042] ksys_ioctl+0xa9/0xd0 [ 1312.144509] __x64_sys_ioctl+0x73/0xb0 [ 1312.148409] do_syscall_64+0x1b9/0x820 [ 1312.152321] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1312.157692] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1312.162653] ? trace_hardirqs_on_caller+0x310/0x310 [ 1312.167708] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1312.172769] ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250 [ 1312.179460] ? __switch_to_asm+0x40/0x70 [ 1312.183522] ? __switch_to_asm+0x34/0x70 [ 1312.187594] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1312.192449] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1312.194313] binder_thread_release: 12 callbacks suppressed [ 1312.194322] binder: release 8369:8371 transaction 576 out, still active [ 1312.197669] RIP: 0033:0x457569 00:28:02 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa0008000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:02 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x8dffffff00000000}], 0x1, 0x0, 0x0) [ 1312.197700] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1312.197708] RSP: 002b:00007f98b2ebdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1312.197721] RAX: ffffffffffffffda RBX: 00007f98b2ebdc90 RCX: 0000000000457569 [ 1312.197729] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1312.197737] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 00:28:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1312.197746] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f98b2ebe6d4 [ 1312.197754] R13: 00000000004be918 R14: 00000000004ceeb8 R15: 0000000000000007 [ 1312.225134] binder: 8374:8383 ioctl c0306201 20000280 returned -12 [ 1312.242311] binder_release_work: 7 callbacks suppressed [ 1312.242316] binder: undelivered TRANSACTION_COMPLETE [ 1312.267237] binder: 8369:8371 transaction failed 29201/-12, size 0-0 line 2913 [ 1312.271242] binder: release 8374:8380 transaction 578 out, still active [ 1312.279986] binder_send_failed_reply: 1 callbacks suppressed 00:28:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1312.279994] binder: send failed reply for transaction 576, target dead [ 1312.284606] binder: undelivered TRANSACTION_COMPLETE [ 1312.326816] binder: undelivered TRANSACTION_ERROR: 29190 [ 1312.332588] binder: send failed reply for transaction 578, target dead 00:28:02 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xc0ffffff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:02 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xc0ffffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1312.433975] binder_alloc: 8393: binder_alloc_buf, no vma [ 1312.454457] binder: BINDER_SET_CONTEXT_MGR already set [ 1312.474016] binder: 8393:8396 transaction failed 29189/-3, size 0-0 line 2973 [ 1312.486649] binder: 8394:8399 ioctl 40046207 0 returned -16 [ 1312.522548] binder: send failed reply for transaction 580 to 8393:8396 [ 1312.574744] binder: undelivered TRANSACTION_COMPLETE [ 1312.576466] binder: 8394:8406 got reply transaction with no transaction stack [ 1312.579953] binder: undelivered TRANSACTION_ERROR: 29189 [ 1312.613520] binder: 8394:8406 transaction failed 29201/-71, size 0-0 line 2741 00:28:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5450, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1312.707651] binder: undelivered TRANSACTION_ERROR: 29190 [ 1312.713536] binder: send failed reply for transaction 582 to 8394:8406 [ 1312.958652] binder_alloc: binder_alloc_mmap_handler: 8415 20001000-20004000 already mapped failed -16 [ 1313.012621] binder: BINDER_SET_CONTEXT_MGR already set [ 1313.020877] binder: 8415:8417 ioctl 40046207 0 returned -16 [ 1313.027478] binder_alloc: 8415: binder_alloc_buf, no vma [ 1313.033210] binder: 8415:8418 transaction failed 29189/-3, size 0-0 line 2973 [ 1313.041174] binder: release 8415:8416 transaction 585 out, still active [ 1313.049057] binder: undelivered TRANSACTION_COMPLETE [ 1313.054605] binder: release 8415:8416 transaction 585 in, still active 00:28:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1313.061577] binder: send failed reply for transaction 585, target dead 00:28:03 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xf000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1313.223486] binder: undelivered TRANSACTION_COMPLETE 00:28:03 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x8000a0}], 0x1, 0x0, 0x0) 00:28:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1313.259053] binder_alloc: binder_alloc_mmap_handler: 8420 20001000-20004000 already mapped failed -16 [ 1313.283956] binder: BINDER_SET_CONTEXT_MGR already set [ 1313.290604] binder: 8420:8423 ioctl 40046207 0 returned -16 [ 1313.296291] binder_alloc: 8420: binder_alloc_buf, no vma [ 1313.303069] binder: 8420:8424 transaction failed 29189/-3, size 0-0 line 2973 [ 1313.349758] binder: release 8420:8423 transaction 588 out, still active 00:28:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc018620c, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1313.394697] binder: undelivered TRANSACTION_COMPLETE [ 1313.395224] binder: BINDER_SET_CONTEXT_MGR already set [ 1313.416979] binder: 8434:8435 ioctl 40046207 0 returned -16 [ 1313.430450] binder_alloc: 8420: binder_alloc_buf, no vma [ 1313.441466] binder: release 8420:8423 transaction 588 in, still active [ 1313.457202] binder: 8434:8435 transaction failed 29189/-3, size 0-0 line 2973 [ 1313.475455] binder: send failed reply for transaction 588, target dead [ 1313.478325] binder: 8438 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 1313.478338] binder: 8438:8440 ioctl c018620c 20000280 returned -22 00:28:03 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xe000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0189436, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:03 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xc000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1313.631793] binder_alloc: binder_alloc_mmap_handler: 8438 20001000-20004000 already mapped failed -16 [ 1313.704455] binder: BINDER_SET_CONTEXT_MGR already set [ 1313.725756] binder: BINDER_SET_CONTEXT_MGR already set [ 1313.733349] binder: 8438:8440 ioctl 40046207 0 returned -16 [ 1313.744413] binder: 8449:8450 ioctl 40046207 0 returned -16 [ 1313.777720] binder_alloc: 8438: binder_alloc_buf, no vma [ 1313.805901] binder: 8438 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 1313.805915] binder: 8438:8455 ioctl c018620c 20000280 returned -22 [ 1313.838617] binder: 8438:8447 transaction failed 29189/-3, size 0-0 line 2973 [ 1313.838850] binder_alloc: 8438: binder_alloc_buf, no vma [ 1313.846945] binder: release 8438:8440 transaction 592 out, still active [ 1313.859861] binder: undelivered TRANSACTION_COMPLETE [ 1313.865320] binder: release 8438:8440 transaction 592 in, still active [ 1313.872237] binder: send failed reply for transaction 592, target dead 00:28:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306225, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1314.023487] binder: 8461:8462 ioctl c0306225 20000280 returned -22 [ 1314.066996] binder_alloc: binder_alloc_mmap_handler: 8461 20001000-20004000 already mapped failed -16 [ 1314.084734] binder: BINDER_SET_CONTEXT_MGR already set [ 1314.090416] binder: 8461:8463 ioctl 40046207 0 returned -16 [ 1314.134197] binder: 8461:8465 ioctl c0306225 20000280 returned -22 [ 1314.179826] binder: release 8461:8462 transaction 596 in, still active [ 1314.190630] binder: send failed reply for transaction 596 to 8461:8462 00:28:04 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0xa0}], 0x1, 0x0, 0x0) [ 1314.223541] binder: undelivered TRANSACTION_COMPLETE 00:28:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:04 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x300}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1314.469319] binder_alloc: binder_alloc_mmap_handler: 8474 20001000-20004000 already mapped failed -16 [ 1314.484225] binder: BINDER_SET_CONTEXT_MGR already set [ 1314.490056] binder: 8474:8477 ioctl 40046207 0 returned -16 [ 1314.507440] binder_alloc: 8474: binder_alloc_buf, no vma 00:28:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1314.515538] binder_transaction: 1 callbacks suppressed [ 1314.515555] binder: 8474:8479 transaction failed 29189/-3, size 0-0 line 2973 [ 1314.546722] binder: release 8474:8476 transaction 598 out, still active [ 1314.566211] binder: undelivered TRANSACTION_COMPLETE 00:28:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1314.604498] binder_release_work: 7 callbacks suppressed [ 1314.604504] binder: undelivered TRANSACTION_ERROR: 29189 00:28:04 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xea010000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1314.671349] binder: send failed reply for transaction 598, target dead [ 1314.709831] binder: undelivered TRANSACTION_ERROR: 29189 00:28:05 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffff7f}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1314.804685] binder: BINDER_SET_CONTEXT_MGR already set [ 1314.841461] binder: send failed reply for transaction 601 to 8486:8488 [ 1314.850103] binder: 8489:8490 ioctl 40046207 0 returned -16 [ 1314.873306] binder: undelivered TRANSACTION_COMPLETE [ 1314.920907] binder: 8489:8496 transaction failed 29189/-22, size 0-0 line 2834 [ 1314.938826] binder: undelivered TRANSACTION_ERROR: 29189 00:28:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1315.025310] binder: BINDER_SET_CONTEXT_MGR already set [ 1315.035179] binder: send failed reply for transaction 604 to 8499:8501 [ 1315.044132] binder: 8489:8496 ioctl 40046207 20000280 returned -16 [ 1315.052143] binder: undelivered TRANSACTION_ERROR: 29189 00:28:05 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x10}], 0x1, 0x0, 0x0) 00:28:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1315.302645] binder: send failed reply for transaction 606 to 8506:8507 [ 1315.309988] binder: undelivered TRANSACTION_ERROR: 29189 00:28:05 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xfffffdef}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1315.543706] binder_alloc: binder_alloc_mmap_handler: 8489 20001000-20004000 already mapped failed -16 [ 1315.569254] binder: BINDER_SET_CONTEXT_MGR already set [ 1315.588638] binder: 8489:8518 ioctl 40046207 0 returned -16 [ 1315.589520] binder: send failed reply for transaction 608 to 8514:8515 [ 1315.617580] binder: undelivered TRANSACTION_ERROR: 29189 [ 1315.654014] binder_alloc: 8489: binder_alloc_buf, no vma [ 1315.671534] binder: undelivered TRANSACTION_ERROR: 29189 [ 1315.671700] binder: 8489:8519 transaction failed 29189/-3, size 0-0 line 2973 00:28:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1315.714283] binder: undelivered TRANSACTION_ERROR: 29189 00:28:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1315.798802] binder: send failed reply for transaction 612 to 8522:8525 [ 1315.812327] binder: undelivered TRANSACTION_ERROR: 29189 00:28:06 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x7}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1315.905447] binder_alloc: binder_alloc_mmap_handler: 8529 20001000-20004000 already mapped failed -16 [ 1316.008380] binder: BINDER_SET_CONTEXT_MGR already set [ 1316.039898] binder: BINDER_SET_CONTEXT_MGR already set [ 1316.047510] binder: 8529:8532 ioctl 40046207 0 returned -16 [ 1316.066444] binder: 8536:8538 ioctl 40046207 0 returned -16 [ 1316.114152] binder_alloc: 8529: binder_alloc_buf, no vma [ 1316.138728] binder: 8529:8535 transaction failed 29189/-3, size 0-0 line 2973 [ 1316.146203] binder_alloc: 8529: binder_alloc_buf, no vma [ 1316.151790] binder: 8536:8541 transaction failed 29189/-3, size 0-0 line 2973 [ 1316.161967] binder: undelivered TRANSACTION_ERROR: 29189 [ 1316.205353] binder: send failed reply for transaction 614 to 8529:8532 00:28:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:06 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x10000000000000}], 0x1, 0x0, 0x0) [ 1316.376263] binder: send failed reply for transaction 618 to 8549:8550 [ 1316.431945] binder_alloc: binder_alloc_mmap_handler: 8549 20001000-20004000 already mapped failed -16 [ 1316.476214] binder: BINDER_SET_CONTEXT_MGR already set [ 1316.481547] binder: 8549:8550 ioctl 40046207 0 returned -16 [ 1316.488332] binder_alloc: 8549: binder_alloc_buf, no vma [ 1316.494646] binder: 8549:8552 transaction failed 29189/-3, size 0-0 line 2973 00:28:06 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0189436, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:06 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x11}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1316.677368] binder_alloc: binder_alloc_mmap_handler: 8561 20001000-20004000 already mapped failed -16 [ 1316.694571] binder: BINDER_SET_CONTEXT_MGR already set [ 1316.711616] binder_alloc: 8561: binder_alloc_buf, no vma 00:28:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1316.790163] binder: 8561:8566 ioctl 40046207 0 returned -16 00:28:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc030624a, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1316.849441] binder: 8561:8567 transaction failed 29189/-3, size 0-0 line 2973 [ 1316.857563] binder: send failed reply for transaction 621, target dead 00:28:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1317.063320] binder: BINDER_SET_CONTEXT_MGR already set [ 1317.121767] binder_thread_release: 10 callbacks suppressed [ 1317.121777] binder: release 8573:8574 transaction 624 in, still active [ 1317.135626] binder: 8576:8577 ioctl 40046207 0 returned -16 00:28:07 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xfffffdef}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1317.199508] binder: 8576:8578 transaction failed 29189/-22, size 0-0 line 2834 [ 1317.208336] binder: send failed reply for transaction 624 to 8573:8574 00:28:07 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x300000000000000}], 0x1, 0x0, 0x0) [ 1317.272824] binder_release_work: 7 callbacks suppressed [ 1317.272830] binder: undelivered TRANSACTION_COMPLETE [ 1317.296985] binder: 8576:8584 ioctl c030624a 20000280 returned -22 [ 1317.351913] binder_alloc: binder_alloc_mmap_handler: 8576 20001000-20004000 already mapped failed -16 [ 1317.362205] binder: BINDER_SET_CONTEXT_MGR already set [ 1317.368256] binder: 8576:8577 ioctl 40046207 0 returned -16 [ 1317.375138] binder: 8576:8581 ioctl c030624a 20000280 returned -22 00:28:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5460, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1317.400581] binder: release 8576:8578 transaction 628 out, still active [ 1317.449931] binder: undelivered TRANSACTION_COMPLETE [ 1317.470131] binder: release 8582:8585 transaction 627 in, still active [ 1317.477715] binder: send failed reply for transaction 627 to 8582:8585 [ 1317.484642] binder: send failed reply for transaction 628, target dead [ 1317.493170] binder: undelivered TRANSACTION_COMPLETE [ 1317.508793] binder: BINDER_SET_CONTEXT_MGR already set [ 1317.517666] binder: 8594:8595 ioctl 40046207 0 returned -16 [ 1317.527266] binder_alloc: 8594: binder_alloc_buf, no vma [ 1317.532985] binder: 8594:8596 transaction failed 29189/-3, size 0-0 line 2973 [ 1317.588862] binder: release 8594:8595 transaction 630 out, still active [ 1317.600448] binder: undelivered TRANSACTION_COMPLETE 00:28:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:07 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x4000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1317.635066] binder: release 8594:8595 transaction 630 in, still active [ 1317.669651] binder: send failed reply for transaction 630, target dead [ 1317.770660] binder: release 8600:8605 transaction 633 in, still active [ 1317.786328] binder: send failed reply for transaction 633 to 8600:8605 [ 1317.845773] binder: BINDER_SET_CONTEXT_MGR already set [ 1317.875870] binder: undelivered TRANSACTION_COMPLETE [ 1317.881399] binder_alloc: 8608: binder_alloc_buf, no vma [ 1317.918201] binder: 8608:8610 ioctl 40046207 0 returned -16 [ 1317.960512] binder: release 8608:8610 transaction 635 out, still active [ 1317.970809] binder: undelivered TRANSACTION_COMPLETE [ 1317.976368] binder: 8608:8612 transaction failed 29189/-3, size 0-0 line 2973 [ 1318.003487] binder: release 8608:8610 transaction 635 in, still active [ 1318.043338] binder: send failed reply for transaction 635, target dead 00:28:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:08 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x5000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1318.216660] binder: BINDER_SET_CONTEXT_MGR already set [ 1318.239462] binder: 8619:8622 ioctl 40046207 0 returned -16 00:28:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:08 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0xa0000000}], 0x1, 0x0, 0x0) [ 1318.319786] binder_alloc: 8620: binder_alloc_buf, no vma [ 1318.327076] binder: release 8620:8621 transaction 638 in, still active [ 1318.342496] binder: undelivered TRANSACTION_COMPLETE 00:28:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1318.466526] binder: release 8633:8634 transaction 641 in, still active [ 1318.473834] binder: undelivered TRANSACTION_COMPLETE 00:28:08 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xc0ffffff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc018620c, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1318.639364] binder: undelivered TRANSACTION_COMPLETE 00:28:09 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xeffdffff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1318.806788] binder: 8650 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 1318.806802] binder: 8650:8651 ioctl c018620c 20000280 returned -22 00:28:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5450, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1318.982890] binder: undelivered TRANSACTION_COMPLETE [ 1318.991589] binder_alloc_mmap_handler: 2 callbacks suppressed [ 1318.991604] binder_alloc: binder_alloc_mmap_handler: 8619 20001000-20004000 already mapped failed -16 [ 1319.115994] binder_alloc: 8619: binder_alloc_buf, no vma 00:28:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1319.297689] binder: BINDER_SET_CONTEXT_MGR already set 00:28:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:09 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x300}], 0x1, 0x0, 0x0) [ 1319.321791] binder: BINDER_SET_CONTEXT_MGR already set [ 1319.327587] binder: 8666:8667 ioctl 40046207 20000280 returned -16 [ 1319.340423] binder: 8665:8668 ioctl 40046207 0 returned -16 00:28:09 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3f000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306225, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:09 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x11000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1319.620989] binder: 8682:8684 ioctl c0306225 20000280 returned -22 00:28:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x200000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1319.745537] binder_release_work: 20 callbacks suppressed [ 1319.745544] binder: undelivered TRANSACTION_ERROR: 29189 00:28:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x3000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:10 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x40000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1319.973248] binder_send_failed_reply: 9 callbacks suppressed [ 1319.973259] binder: send failed reply for transaction 658 to 8693:8694 [ 1320.037236] binder: undelivered TRANSACTION_ERROR: 29189 [ 1320.108293] binder_alloc: binder_alloc_mmap_handler: 8665 20001000-20004000 already mapped failed -16 [ 1320.166412] binder: BINDER_SET_CONTEXT_MGR already set [ 1320.221809] binder: 8665:8673 ioctl 40046207 0 returned -16 00:28:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x7}], 0x1, 0x0, 0x0) 00:28:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1320.287179] binder: undelivered TRANSACTION_ERROR: 29189 [ 1320.296508] binder: send failed reply for transaction 660 to 8698:8699 00:28:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306251, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1320.338850] binder: send failed reply for transaction 661, target dead [ 1320.357349] binder: undelivered TRANSACTION_ERROR: 29189 [ 1320.449400] binder: BINDER_SET_CONTEXT_MGR already set 00:28:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6800, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1320.511547] binder: 8714:8716 ioctl 40046207 0 returned -16 [ 1320.546248] binder: send failed reply for transaction 663 to 8712:8715 00:28:10 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xb3ff0000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1320.563189] binder: send failed reply for transaction 664 to 8714:8718 [ 1320.623155] binder: undelivered TRANSACTION_ERROR: 29189 [ 1320.647574] binder: 8714:8718 ioctl c0306251 20000280 returned -22 00:28:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x300, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1320.701163] binder: send failed reply for transaction 666 to 8722:8723 [ 1320.708517] binder: undelivered TRANSACTION_ERROR: 29189 00:28:11 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7400, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1320.863309] binder: send failed reply for transaction 668 to 8728:8729 [ 1320.881705] binder: undelivered TRANSACTION_ERROR: 29189 00:28:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6c, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1321.187911] binder: send failed reply for transaction 670 to 8736:8737 [ 1321.205793] binder: undelivered TRANSACTION_ERROR: 29189 [ 1321.256457] binder_alloc: binder_alloc_mmap_handler: 8714 20001000-20004000 already mapped failed -16 00:28:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0xa000000000000000}], 0x1, 0x0, 0x0) [ 1321.349340] binder_alloc: 8714: binder_alloc_buf, no vma [ 1321.367707] binder: BINDER_SET_CONTEXT_MGR already set [ 1321.415351] binder_transaction: 2 callbacks suppressed [ 1321.415369] binder: 8714:8718 transaction failed 29189/-3, size 0-0 line 2973 [ 1321.429732] binder: 8745:8746 ioctl 40046207 0 returned -16 [ 1321.488890] binder_alloc: 8714: binder_alloc_buf, no vma [ 1321.497572] binder: 8745:8748 transaction failed 29189/-3, size 0-0 line 2973 [ 1321.520651] binder: 8714:8744 ioctl c0306251 20000280 returned -22 [ 1321.528175] binder: undelivered TRANSACTION_ERROR: 29189 00:28:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:11 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1321.536111] binder: undelivered TRANSACTION_ERROR: 29189 [ 1321.706468] binder_alloc: binder_alloc_mmap_handler: 8758 20001000-20004000 already mapped failed -16 [ 1321.745716] binder: BINDER_SET_CONTEXT_MGR already set [ 1321.780591] binder: 8758:8760 ioctl 40046207 0 returned -16 [ 1321.813208] binder_alloc: 8758: binder_alloc_buf, no vma [ 1321.838291] binder: send failed reply for transaction 675, target dead [ 1321.854602] binder: 8758:8762 transaction failed 29189/-3, size 0-0 line 2973 00:28:12 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2300}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5460, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1322.032179] binder_alloc: binder_alloc_mmap_handler: 8769 20001000-20004000 already mapped failed -16 00:28:12 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xfffffdef}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1322.100393] binder: BINDER_SET_CONTEXT_MGR already set [ 1322.170821] binder: 8769:8771 ioctl 40046207 0 returned -16 00:28:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x68, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1322.226857] binder_thread_release: 15 callbacks suppressed [ 1322.226868] binder: release 8769:8771 transaction 678 out, still active [ 1322.227565] binder_alloc: 8769: binder_alloc_buf, no vma [ 1322.238807] binder: release 8769:8771 transaction 678 in, still active [ 1322.251683] binder: 8769:8773 transaction failed 29189/-3, size 0-0 line 2973 [ 1322.297972] binder: send failed reply for transaction 678, target dead 00:28:12 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x100000000000000}], 0x1, 0x0, 0x0) [ 1322.394034] binder: BINDER_SET_CONTEXT_MGR already set 00:28:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x3f00000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1322.427048] binder: release 8783:8785 transaction 681 in, still active [ 1322.437201] binder: 8786:8787 ioctl 40046207 0 returned -16 [ 1322.452694] binder: send failed reply for transaction 681 to 8783:8785 [ 1322.537267] binder: 8786:8794 transaction failed 29189/-22, size 0-0 line 2834 [ 1322.563687] binder_release_work: 15 callbacks suppressed [ 1322.563693] binder: undelivered TRANSACTION_COMPLETE 00:28:12 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x10}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7a00000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1322.719620] binder: release 8796:8797 transaction 684 in, still active [ 1322.727003] binder: send failed reply for transaction 684 to 8796:8797 [ 1322.743145] binder: undelivered TRANSACTION_COMPLETE 00:28:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x48000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1322.852923] binder: release 8802:8803 transaction 686 in, still active [ 1322.860247] binder: send failed reply for transaction 686 to 8802:8803 [ 1322.875995] binder: undelivered TRANSACTION_COMPLETE 00:28:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xa000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1322.979940] binder: release 8808:8809 transaction 688 in, still active [ 1322.994452] binder: undelivered TRANSACTION_COMPLETE 00:28:13 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffff80}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1323.191031] binder_alloc: binder_alloc_mmap_handler: 8786 20001000-20004000 already mapped failed -16 [ 1323.219326] binder: BINDER_SET_CONTEXT_MGR already set 00:28:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4800, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1323.255190] binder: 8786:8794 ioctl 40046207 0 returned -16 [ 1323.276427] binder: release 8812:8813 transaction 690 in, still active [ 1323.290018] binder: undelivered TRANSACTION_COMPLETE [ 1323.342108] binder: undelivered TRANSACTION_COMPLETE 00:28:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:13 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x29}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:13 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x8dffffff}], 0x1, 0x0, 0x0) 00:28:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x500, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1323.542210] binder: release 8823:8824 transaction 693 in, still active [ 1323.549382] binder: undelivered TRANSACTION_COMPLETE 00:28:13 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xb3ff000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1323.641131] binder_alloc: binder_alloc_mmap_handler: 8827 20001000-20004000 already mapped failed -16 [ 1323.666739] binder_alloc: 8827: binder_alloc_buf, no vma [ 1323.679859] binder: BINDER_SET_CONTEXT_MGR already set [ 1323.689994] binder: 8837:8840 ioctl 40046207 0 returned -16 [ 1323.696463] binder: BINDER_SET_CONTEXT_MGR already set [ 1323.702391] binder: 8827:8830 ioctl 40046207 0 returned -16 [ 1323.708864] binder: 8827:8839 transaction failed 29189/-3, size 0-0 line 2973 [ 1323.716441] binder_alloc: 8827: binder_alloc_buf, no vma [ 1323.723092] binder: 8837:8840 transaction failed 29189/-3, size 0-0 line 2973 [ 1323.764266] binder: release 8827:8830 transaction 695 out, still active [ 1323.777280] binder: undelivered TRANSACTION_COMPLETE [ 1323.808308] binder: release 8827:8830 transaction 695 in, still active 00:28:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1323.866855] binder: send failed reply for transaction 695, target dead 00:28:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7a000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1324.008762] binder_alloc: binder_alloc_mmap_handler: 8851 20001000-20004000 already mapped failed -16 [ 1324.061031] binder: BINDER_SET_CONTEXT_MGR already set [ 1324.122316] binder: BINDER_SET_CONTEXT_MGR already set [ 1324.131308] binder: 8852:8857 ioctl 40046207 0 returned -16 [ 1324.148941] binder: 8851:8854 ioctl 40046207 0 returned -16 [ 1324.178429] binder_alloc: 8851: binder_alloc_buf, no vma [ 1324.196699] binder: undelivered TRANSACTION_COMPLETE [ 1324.204332] binder: send failed reply for transaction 699, target dead [ 1324.237815] binder: 8852:8859 transaction failed 29189/-3, size 0-0 line 2973 [ 1324.245935] binder_alloc: 8851: binder_alloc_buf, no vma 00:28:14 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x8}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1324.304664] binder: 8851:8856 transaction failed 29189/-3, size 0-0 line 2973 00:28:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7a00, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:14 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xd00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:14 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0xf0ffffff00000000}], 0x1, 0x0, 0x0) [ 1324.590438] binder: 8869:8872 transaction failed 29189/-22, size 0-0 line 2834 00:28:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xa00, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc030623c, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:15 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xb00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4c00000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1324.852492] binder: undelivered TRANSACTION_COMPLETE [ 1324.858094] binder_release_work: 18 callbacks suppressed [ 1324.858100] binder: undelivered TRANSACTION_ERROR: 29189 [ 1324.955059] binder: 8893:8896 ioctl c030623c 20000280 returned -22 [ 1325.027714] binder_alloc: binder_alloc_mmap_handler: 8893 20001000-20004000 already mapped failed -16 [ 1325.057539] binder: BINDER_SET_CONTEXT_MGR already set [ 1325.079111] binder: 8898:8899 ioctl 40046207 0 returned -16 [ 1325.092043] binder: BINDER_SET_CONTEXT_MGR already set [ 1325.098415] binder: 8893:8900 ioctl 40046207 0 returned -16 [ 1325.105337] binder_alloc: 8893: binder_alloc_buf, no vma [ 1325.133583] binder_alloc: 8893: binder_alloc_buf, no vma [ 1325.140040] binder: 8893:8900 ioctl c030623c 20000280 returned -22 [ 1325.147265] binder: send failed reply for transaction 709, target dead [ 1325.160220] binder: undelivered TRANSACTION_ERROR: 29189 00:28:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x51, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1325.373967] binder_send_failed_reply: 5 callbacks suppressed [ 1325.373977] binder: send failed reply for transaction 713 to 8906:8907 [ 1325.440652] binder_alloc: binder_alloc_mmap_handler: 8906 20001000-20004000 already mapped failed -16 00:28:15 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0xfffffff0}], 0x1, 0x0, 0x0) [ 1325.532667] binder: BINDER_SET_CONTEXT_MGR already set 00:28:15 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x5000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1325.583819] binder: 8906:8907 ioctl 40046207 0 returned -16 [ 1325.625800] binder: undelivered TRANSACTION_ERROR: 29189 [ 1325.631331] binder: undelivered TRANSACTION_ERROR: 29190 [ 1325.648752] binder: undelivered TRANSACTION_ERROR: 29189 00:28:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x44, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xa0008000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:16 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1100000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1325.861538] binder: undelivered TRANSACTION_ERROR: 29189 [ 1325.896645] binder: send failed reply for transaction 717 to 8924:8925 [ 1325.956660] binder_alloc: binder_alloc_mmap_handler: 8924 20001000-20004000 already mapped failed -16 [ 1325.989847] binder: BINDER_SET_CONTEXT_MGR already set [ 1326.003318] binder: 8928:8932 ioctl 40046207 0 returned -16 [ 1326.017029] binder: BINDER_SET_CONTEXT_MGR already set [ 1326.026075] binder: 8924:8925 ioctl 40046207 0 returned -16 [ 1326.037978] binder: 8924:8933 got reply transaction with no transaction stack [ 1326.046180] binder: undelivered TRANSACTION_ERROR: 29189 00:28:16 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x4000000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1326.053024] binder: undelivered TRANSACTION_ERROR: 29201 [ 1326.065838] binder: undelivered TRANSACTION_ERROR: 29189 [ 1326.085380] binder: undelivered TRANSACTION_ERROR: 29190 00:28:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x98, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1326.337363] binder: send failed reply for transaction 723 to 8940:8942 [ 1326.356466] binder_alloc: binder_alloc_mmap_handler: 8940 20001000-20004000 already mapped failed -16 [ 1326.384985] binder: BINDER_SET_CONTEXT_MGR already set [ 1326.390972] binder: 8940:8943 ioctl 40046207 0 returned -16 [ 1326.430960] binder: 8940:8943 got reply transaction with no transaction stack [ 1326.438796] binder_transaction: 11 callbacks suppressed [ 1326.438812] binder: 8940:8943 transaction failed 29201/-71, size 0-0 line 2741 00:28:16 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x1000000000000000}], 0x1, 0x0, 0x0) 00:28:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x2, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:16 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1f000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1326.698160] binder: 8950:8951 unknown command 16456 [ 1326.712484] binder: 8950:8951 ioctl c0306201 20000280 returned -22 [ 1326.728491] binder_alloc: binder_alloc_mmap_handler: 8950 20001000-20004000 already mapped failed -16 [ 1326.741621] binder: BINDER_SET_CONTEXT_MGR already set 00:28:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x700, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1326.809014] binder: 8950:8951 ioctl 40046207 0 returned -16 [ 1326.850168] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 1326.850177] binder_alloc: 8950: binder_alloc_buf, no vma 00:28:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x3f000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:17 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x27000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1326.893774] binder: 8950:8958 unknown command 16456 [ 1326.898821] binder: 8950:8958 ioctl c0306201 20000280 returned -22 [ 1326.905506] binder: 8950:8953 transaction failed 29189/-3, size 0-0 line 2973 [ 1326.913304] binder: send failed reply for transaction 727, target dead [ 1327.034561] binder: BINDER_SET_CONTEXT_MGR already set 00:28:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x8000a0ffffffff, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1327.077320] binder: 8965:8966 ioctl 40046207 0 returned -16 [ 1327.082750] binder: send failed reply for transaction 730 to 8961:8964 [ 1327.140552] binder: 8965:8972 transaction failed 29189/-22, size 0-0 line 2834 00:28:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4800000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1327.294008] binder_thread_release: 8 callbacks suppressed [ 1327.294020] binder: release 8974:8977 transaction 733 out, still active [ 1327.386455] binder: release 8974:8977 transaction 733 in, still active 00:28:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x600, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1327.469092] binder: send failed reply for transaction 733, target dead 00:28:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0xf0ffffff}], 0x1, 0x0, 0x0) [ 1327.575748] binder: release 8980:8981 transaction 735 in, still active [ 1327.630582] binder: send failed reply for transaction 735 to 8980:8981 [ 1327.658605] binder_release_work: 7 callbacks suppressed [ 1327.658610] binder: undelivered TRANSACTION_COMPLETE [ 1327.691494] binder: release 8983:8986 transaction 737 in, still active [ 1327.701029] binder: send failed reply for transaction 737 to 8983:8986 [ 1327.709348] binder: undelivered TRANSACTION_COMPLETE 00:28:18 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x27000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:18 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xe803}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1327.801906] binder_alloc: binder_alloc_mmap_handler: 8965 20001000-20004000 already mapped failed -16 [ 1327.812806] binder_alloc: 8965: binder_alloc_buf, no vma [ 1327.824097] binder: 8965:8972 transaction failed 29189/-3, size 0-0 line 2973 00:28:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4800000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x74, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1327.937154] binder: release 8993:8994 transaction 741 in, still active [ 1327.949275] binder: send failed reply for transaction 741 to 8993:8994 [ 1327.979695] binder: undelivered TRANSACTION_COMPLETE [ 1328.040245] binder: BINDER_SET_CONTEXT_MGR already set [ 1328.045944] binder_alloc: binder_alloc_mmap_handler: 9005 20001000-20004000 already mapped failed -16 [ 1328.069543] binder: 9003:9006 ioctl 40046207 0 returned -16 00:28:18 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2900}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1328.099932] binder_alloc: 9005: binder_alloc_buf, no vma [ 1328.154521] binder: 9003:9010 transaction failed 29189/-3, size 0-0 line 2973 [ 1328.197748] binder_alloc: 9005: binder_alloc_buf, no vma [ 1328.198300] binder: BINDER_SET_CONTEXT_MGR already set [ 1328.260541] binder: 9005:9008 transaction failed 29189/-3, size 0-0 line 2973 [ 1328.337304] binder: release 9005:9007 transaction 743 out, still active [ 1328.344491] binder: 9005:9007 ioctl 40046207 0 returned -16 [ 1328.354822] binder: undelivered TRANSACTION_COMPLETE [ 1328.408193] binder: release 9005:9007 transaction 743 in, still active 00:28:18 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x700}], 0x1, 0x0, 0x0) 00:28:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x3000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1328.504554] binder: send failed reply for transaction 743, target dead [ 1328.718052] binder_alloc: binder_alloc_mmap_handler: 9025 20001000-20004000 already mapped failed -16 [ 1328.783895] binder: BINDER_SET_CONTEXT_MGR already set [ 1328.816097] binder: 9025:9026 ioctl 40046207 0 returned -16 [ 1328.835158] binder_alloc: 9025: binder_alloc_buf, no vma [ 1328.840995] binder: release 9025:9026 transaction 747 out, still active [ 1328.849081] binder: undelivered TRANSACTION_COMPLETE [ 1328.854775] binder: 9025:9027 transaction failed 29189/-3, size 0-0 line 2973 00:28:19 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x900000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xa00000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1328.862588] binder: release 9025:9026 transaction 747 in, still active 00:28:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x2000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1328.907776] binder: send failed reply for transaction 747, target dead 00:28:19 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x60}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1329.016662] binder: BINDER_SET_CONTEXT_MGR already set 00:28:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x700000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1329.064994] binder: 9037:9038 ioctl 40046207 0 returned -16 [ 1329.092398] binder: release 9033:9036 transaction 750 in, still active [ 1329.101653] binder: send failed reply for transaction 750 to 9033:9036 [ 1329.113772] binder: 9037:9045 transaction failed 29189/-22, size 0-0 line 2834 [ 1329.124301] binder: undelivered TRANSACTION_COMPLETE [ 1329.165846] binder_alloc: binder_alloc_mmap_handler: 9037 20001000-20004000 already mapped failed -16 00:28:19 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2a}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1329.210505] binder: BINDER_SET_CONTEXT_MGR already set 00:28:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x74000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1329.242800] binder: 9037:9038 ioctl 40046207 0 returned -16 [ 1329.270563] binder: send failed reply for transaction 753 to 9050:9054 [ 1329.280859] binder: send failed reply for transaction 754 to 9037:9045 [ 1329.328400] binder: undelivered TRANSACTION_COMPLETE 00:28:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xfffffdfd, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1329.365508] binder: undelivered TRANSACTION_COMPLETE 00:28:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1329.464910] binder: BINDER_SET_CONTEXT_MGR already set [ 1329.494054] binder: undelivered TRANSACTION_COMPLETE [ 1329.499857] binder: 9065:9066 ioctl 40046207 0 returned -16 00:28:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0xffffffffa0008000}], 0x1, 0x0, 0x0) [ 1329.582948] binder: 9065:9071 transaction failed 29189/-22, size 0-0 line 2834 [ 1329.644272] binder: 9070:9072 unknown command 0 00:28:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x100000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1329.693516] binder: 9070:9072 ioctl c0306201 20000280 returned -22 [ 1329.722090] binder: undelivered TRANSACTION_COMPLETE 00:28:20 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x23}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1329.893898] binder_release_work: 20 callbacks suppressed [ 1329.893905] binder: undelivered TRANSACTION_ERROR: 29189 00:28:20 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x9000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6800000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4c000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1330.200178] binder: undelivered TRANSACTION_ERROR: 29189 [ 1330.254071] binder_alloc: binder_alloc_mmap_handler: 9065 20001000-20004000 already mapped failed -16 [ 1330.298291] binder_alloc: 9065: binder_alloc_buf, no vma [ 1330.354845] binder: BINDER_SET_CONTEXT_MGR already set [ 1330.364427] binder: 9065:9093 transaction failed 29189/-3, size 0-0 line 2973 [ 1330.380663] binder: 9096:9098 ioctl 40046207 0 returned -16 [ 1330.396157] binder: undelivered TRANSACTION_ERROR: 29189 00:28:20 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x26}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1330.408638] binder: undelivered TRANSACTION_ERROR: 29189 00:28:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xfdfdffff00000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:20 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0xffffff8d}], 0x1, 0x0, 0x0) 00:28:20 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x40030000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1330.646207] binder_alloc: binder_alloc_mmap_handler: 9106 20001000-20004000 already mapped failed -16 [ 1330.724194] binder: BINDER_SET_CONTEXT_MGR already set [ 1330.729665] binder: 9106:9110 ioctl 40046207 0 returned -16 00:28:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x68000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1330.795087] binder_alloc: 9106: binder_alloc_buf, no vma [ 1330.802337] binder: send failed reply for transaction 768, target dead [ 1330.812043] binder: undelivered TRANSACTION_ERROR: 29189 [ 1330.901345] binder_alloc: binder_alloc_mmap_handler: 9120 20001000-20004000 already mapped failed -16 [ 1330.925993] binder: BINDER_SET_CONTEXT_MGR already set [ 1330.942765] binder: 9120:9121 ioctl 40046207 0 returned -16 [ 1330.949563] binder_alloc: 9120: binder_alloc_buf, no vma [ 1330.956289] binder: send failed reply for transaction 771, target dead [ 1330.968989] binder: undelivered TRANSACTION_ERROR: 29189 00:28:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6c00, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1331.108838] binder_alloc: binder_alloc_mmap_handler: 9126 20001000-20004000 already mapped failed -16 [ 1331.119480] binder: BINDER_SET_CONTEXT_MGR already set [ 1331.126100] binder: 9126:9127 ioctl 40046207 0 returned -16 [ 1331.146615] binder_alloc: 9126: binder_alloc_buf, no vma 00:28:21 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x48, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7400, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1331.164169] binder: undelivered TRANSACTION_ERROR: 29189 [ 1331.186224] binder: undelivered TRANSACTION_ERROR: 29189 [ 1331.191735] binder_send_failed_reply: 4 callbacks suppressed [ 1331.191743] binder: send failed reply for transaction 774 to 9126:9127 [ 1331.244721] binder: 9130:9132 unknown command 0 [ 1331.251408] binder: undelivered TRANSACTION_ERROR: 29189 [ 1331.280146] binder: 9130:9132 ioctl c0306201 20000280 returned -22 [ 1331.315085] binder: BINDER_SET_CONTEXT_MGR already set 00:28:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:21 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x24000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1331.356983] binder: 9134:9135 ioctl 40046207 0 returned -16 [ 1331.380250] binder_alloc: 9130: binder_alloc_buf, no vma [ 1331.386194] binder: send failed reply for transaction 777 to 9130:9132 [ 1331.393228] binder: undelivered TRANSACTION_ERROR: 29189 [ 1331.523238] binder: 9143:9144 unknown command 0 [ 1331.543493] binder: 9143:9144 ioctl c0306201 20000280 returned -22 00:28:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x400000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1331.596604] binder: send failed reply for transaction 780 to 9143:9144 00:28:21 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x700000000000000}], 0x1, 0x0, 0x0) 00:28:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x600000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1331.832637] binder: send failed reply for transaction 782 to 9150:9153 00:28:22 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3000000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x500000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1332.060502] binder: send failed reply for transaction 784 to 9159:9161 [ 1332.112786] binder_alloc: binder_alloc_mmap_handler: 9134 20001000-20004000 already mapped failed -16 [ 1332.186302] binder_alloc: 9134: binder_alloc_buf, no vma [ 1332.191830] binder_transaction: 5 callbacks suppressed [ 1332.191847] binder: 9134:9171 transaction failed 29189/-3, size 0-0 line 2973 [ 1332.204804] binder: BINDER_SET_CONTEXT_MGR already set [ 1332.210188] binder: 9165:9167 ioctl 40046207 0 returned -16 [ 1332.232543] binder: 9165:9172 transaction failed 29189/-22, size 0-0 line 2834 00:28:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6c000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xa00000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:22 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2b}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1332.493502] binder: BINDER_SET_CONTEXT_MGR already set [ 1332.510249] binder: 9179:9181 ioctl 40046207 0 returned -16 [ 1332.520901] binder_thread_release: 14 callbacks suppressed [ 1332.520912] binder: release 9174:9175 transaction 789 in, still active [ 1332.533537] binder: send failed reply for transaction 789 to 9174:9175 00:28:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6c00, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:22 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xb3ff0000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1332.541514] binder: 9179:9181 transaction failed 29189/-22, size 0-0 line 2834 00:28:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x300000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:22 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x10000000}], 0x1, 0x0, 0x0) [ 1332.636269] binder: release 9185:9188 transaction 792 in, still active [ 1332.672379] binder: send failed reply for transaction 792 to 9185:9188 [ 1332.726093] binder_release_work: 10 callbacks suppressed [ 1332.726098] binder: undelivered TRANSACTION_COMPLETE 00:28:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6c00000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1332.806994] binder: release 9196:9199 transaction 794 in, still active [ 1332.814322] binder: send failed reply for transaction 794 to 9196:9199 [ 1332.823884] binder: undelivered TRANSACTION_COMPLETE 00:28:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x3f000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:23 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffff7f00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1333.055590] binder: release 9205:9206 transaction 796 in, still active [ 1333.062823] binder: send failed reply for transaction 796 to 9205:9206 [ 1333.096907] binder: undelivered TRANSACTION_COMPLETE 00:28:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xffffffffa0008000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1333.193803] binder: release 9209:9210 transaction 798 in, still active [ 1333.200815] binder: send failed reply for transaction 798 to 9209:9210 [ 1333.217699] binder: undelivered TRANSACTION_COMPLETE [ 1333.263893] binder_alloc: binder_alloc_mmap_handler: 9179 20001000-20004000 already mapped failed -16 00:28:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x68000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1333.308181] binder: release 9214:9215 transaction 800 in, still active [ 1333.315636] binder: undelivered TRANSACTION_COMPLETE [ 1333.344520] binder: 9179:9218 transaction failed 29189/-22, size 0-0 line 2834 00:28:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x200000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x3, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1333.533852] binder: release 9219:9220 transaction 804 in, still active [ 1333.540653] binder: undelivered TRANSACTION_COMPLETE 00:28:23 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x27000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:23 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3f000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:23 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x8000000}], 0x1, 0x0, 0x0) [ 1333.642603] binder_alloc: binder_alloc_mmap_handler: 9224 20001000-20004000 already mapped failed -16 [ 1333.657961] binder: BINDER_SET_CONTEXT_MGR already set [ 1333.712977] binder: 9227:9233 ioctl 40046207 0 returned -16 [ 1333.739099] binder: BINDER_SET_CONTEXT_MGR already set [ 1333.776125] binder: 9227:9233 unknown command 64 [ 1333.792566] binder: 9224:9225 ioctl 40046207 0 returned -16 [ 1333.816176] binder_alloc: 9224: binder_alloc_buf, no vma [ 1333.829038] binder: release 9224:9225 transaction 806 out, still active [ 1333.838729] binder: undelivered TRANSACTION_COMPLETE [ 1333.857808] binder_alloc: 9224: binder_alloc_buf, no vma [ 1333.863657] binder: 9227:9236 transaction failed 29189/-3, size 0-0 line 2973 [ 1333.892928] binder: release 9224:9225 transaction 806 in, still active [ 1333.926749] binder: 9224:9231 transaction failed 29189/-3, size 0-0 line 2973 00:28:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6800000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1333.953697] binder: send failed reply for transaction 806, target dead [ 1333.973505] binder: 9227:9233 ioctl c0306201 20000280 returned -22 [ 1334.101588] binder_alloc: binder_alloc_mmap_handler: 9252 20001000-20004000 already mapped failed -16 00:28:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x5, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1334.250389] binder: BINDER_SET_CONTEXT_MGR already set 00:28:24 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x400000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1334.291386] binder_alloc: 9252: binder_alloc_buf, no vma [ 1334.345331] binder: 9252:9253 ioctl 40046207 0 returned -16 [ 1334.370116] binder: 9252:9254 transaction failed 29189/-3, size 0-0 line 2973 [ 1334.374235] binder: BINDER_SET_CONTEXT_MGR already set 00:28:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xffffff7f, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1334.393485] binder: 9256:9260 ioctl 40046207 0 returned -16 [ 1334.399352] binder: release 9252:9253 transaction 810 out, still active [ 1334.406547] binder: undelivered TRANSACTION_COMPLETE [ 1334.413024] binder: send failed reply for transaction 810, target dead [ 1334.435090] binder: 9256:9260 transaction failed 29189/-22, size 0-0 line 2834 00:28:24 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x30000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1334.497802] binder: 9256:9267 unknown command 0 [ 1334.530630] binder: 9256:9267 ioctl c0306201 20000280 returned -22 [ 1334.534882] binder_alloc: binder_alloc_mmap_handler: 9265 20001000-20004000 already mapped failed -16 00:28:24 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x8}], 0x1, 0x0, 0x0) [ 1334.610810] binder: BINDER_SET_CONTEXT_MGR already set [ 1334.640752] binder_alloc: 9265: binder_alloc_buf, no vma [ 1334.657929] binder: 9265:9266 ioctl 40046207 0 returned -16 [ 1334.658634] binder: undelivered TRANSACTION_COMPLETE 00:28:25 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1334.731416] binder: 9265:9269 transaction failed 29189/-3, size 0-0 line 2973 00:28:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x300000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1335.074099] binder_alloc: binder_alloc_mmap_handler: 9286 20001000-20004000 already mapped failed -16 00:28:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4c, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1335.136758] binder: BINDER_SET_CONTEXT_MGR already set [ 1335.153203] binder_release_work: 20 callbacks suppressed [ 1335.153210] binder: undelivered TRANSACTION_ERROR: 29189 [ 1335.178317] binder: 9286:9288 ioctl 40046207 0 returned -16 [ 1335.221793] binder_alloc: 9286: binder_alloc_buf, no vma [ 1335.247296] binder: undelivered TRANSACTION_COMPLETE [ 1335.254238] binder: send failed reply for transaction 817, target dead [ 1335.268804] binder: 9286:9290 transaction failed 29189/-3, size 0-0 line 2973 [ 1335.302929] binder: undelivered TRANSACTION_ERROR: 29189 00:28:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xfdfdffff, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x8000a0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1335.387216] binder: undelivered TRANSACTION_ERROR: 29189 00:28:25 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) 00:28:25 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x200000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1335.509749] binder: BINDER_SET_CONTEXT_MGR already set 00:28:25 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x6000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x3f00, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1335.540327] binder: 9301:9303 ioctl 40046207 0 returned -16 [ 1335.577528] binder: undelivered TRANSACTION_ERROR: 29189 00:28:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xa, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1335.678273] binder: undelivered TRANSACTION_ERROR: 29189 [ 1335.799859] binder: 9323:9324 unknown command 0 [ 1335.805042] binder: 9323:9324 ioctl c0306201 20000280 returned -22 00:28:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:26 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1f4}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1335.925805] binder: undelivered TRANSACTION_ERROR: 29189 [ 1336.134063] binder: 9327:9329 unknown command 0 [ 1336.143497] binder: 9327:9329 ioctl c0306201 20000280 returned -22 00:28:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x2, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1336.270728] binder_send_failed_reply: 7 callbacks suppressed [ 1336.270737] binder: send failed reply for transaction 829 to 9327:9329 [ 1336.284657] binder_alloc: binder_alloc_mmap_handler: 9301 20001000-20004000 already mapped failed -16 00:28:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4c00, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1336.333508] binder_alloc: 9301: binder_alloc_buf, no vma [ 1336.361426] binder: undelivered TRANSACTION_ERROR: 29189 00:28:26 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1336.418348] binder: undelivered TRANSACTION_ERROR: 29189 [ 1336.468163] binder: 9336:9337 unknown command 16456 [ 1336.473216] binder: 9336:9337 ioctl c0306201 20000280 returned -22 [ 1336.485474] binder: undelivered TRANSACTION_ERROR: 29189 [ 1336.505930] binder: BINDER_SET_CONTEXT_MGR already set [ 1336.513797] binder: 9338:9342 ioctl 40046207 0 returned -16 00:28:26 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x60}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7400000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1336.597555] binder: send failed reply for transaction 833 to 9336:9337 [ 1336.606515] binder: send failed reply for transaction 834 to 9338:9342 00:28:26 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x900}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1336.671825] binder: undelivered TRANSACTION_ERROR: 29189 00:28:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x5000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1336.798078] binder: send failed reply for transaction 836 to 9351:9354 00:28:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x1000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1336.890204] binder: send failed reply for transaction 838 to 9358:9359 00:28:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4c00, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1337.004274] binder: send failed reply for transaction 840 to 9362:9363 00:28:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7a, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1337.113554] binder: send failed reply for transaction 842 to 9365:9366 00:28:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1337.213720] binder: send failed reply for transaction 844 to 9368:9369 [ 1337.285934] binder_alloc: binder_alloc_mmap_handler: 9338 20001000-20004000 already mapped failed -16 [ 1337.297852] binder: send failed reply for transaction 846 to 9371:9372 [ 1337.305391] binder_alloc: 9338: binder_alloc_buf, no vma [ 1337.310992] binder_transaction: 2 callbacks suppressed [ 1337.311009] binder: 9338:9346 transaction failed 29189/-3, size 0-0 line 2973 00:28:27 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2300000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x2000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x3, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:27 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1337.483340] binder: BINDER_SET_CONTEXT_MGR already set [ 1337.501587] binder: send failed reply for transaction 850 to 9376:9377 [ 1337.508552] binder: 9378:9386 ioctl 40046207 0 returned -16 [ 1337.525121] binder: 9378:9386 transaction failed 29189/-22, size 0-0 line 2834 00:28:27 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x630c, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1337.581807] binder: 9378:9392 unknown command 64 [ 1337.588072] binder: 9378:9392 ioctl c0306201 20000280 returned -22 [ 1337.699578] binder: 9394:9399 unknown command 0 [ 1337.706853] binder: 9394:9399 ioctl c0306201 20000280 returned -22 [ 1338.207160] binder_thread_release: 17 callbacks suppressed [ 1338.207166] binder: release 9394:9399 transaction 853 in, still active [ 1338.219856] binder_release_work: 14 callbacks suppressed [ 1338.219861] binder: undelivered TRANSACTION_COMPLETE 00:28:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x400c630e, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:28 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) 00:28:28 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffffc0}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1338.275834] binder_alloc: binder_alloc_mmap_handler: 9378 20001000-20004000 already mapped failed -16 [ 1338.335196] binder_alloc: 9378: binder_alloc_buf, no vma [ 1338.341263] binder: 9378:9408 transaction failed 29189/-3, size 0-0 line 2973 [ 1338.373569] binder: 9378:9407 unknown command 64 [ 1338.383616] binder: 9378:9407 ioctl c0306201 20000280 returned -22 00:28:28 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x29000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6c00000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1338.412860] binder: BINDER_SET_CONTEXT_MGR already set [ 1338.421961] binder: 9405:9412 ioctl 40046207 0 returned -16 [ 1338.447967] binder: 9405:9412 transaction failed 29189/-22, size 0-0 line 2834 [ 1338.518246] binder: 9405:9418 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 00:28:28 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xc0ffffff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1338.582872] binder_alloc: binder_alloc_mmap_handler: 9419 20001000-20004000 already mapped failed -16 [ 1338.592666] binder: 9405:9418 unknown command 0 [ 1338.610091] binder: BINDER_SET_CONTEXT_MGR already set [ 1338.616165] binder: 9419:9422 ioctl 40046207 0 returned -16 [ 1338.632976] IPVS: ftp: loaded support on port[0] = 21 [ 1338.642839] binder_alloc: 9419: binder_alloc_buf, no vma [ 1338.663615] binder: 9405:9418 ioctl c0306201 20000280 returned -22 [ 1338.664992] binder: 9419:9423 transaction failed 29189/-3, size 0-0 line 2973 [ 1338.740451] binder: release 9419:9422 transaction 858 out, still active [ 1338.751906] binder: undelivered TRANSACTION_COMPLETE [ 1338.789459] binder: release 9419:9422 transaction 858 in, still active 00:28:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6c000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1338.837458] binder: send failed reply for transaction 858, target dead [ 1338.964285] binder_alloc: binder_alloc_mmap_handler: 9433 20001000-20004000 already mapped failed -16 [ 1338.989179] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.006345] binder: 9433:9434 ioctl 40046207 0 returned -16 [ 1339.022504] binder_alloc: 9433: binder_alloc_buf, no vma [ 1339.038135] binder: 9433:9435 transaction failed 29189/-3, size 0-0 line 2973 [ 1339.059302] binder: release 9433:9434 transaction 861 out, still active [ 1339.070855] binder: undelivered TRANSACTION_COMPLETE 00:28:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x8000a0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1339.096790] binder: release 9433:9434 transaction 861 in, still active [ 1339.126689] binder: send failed reply for transaction 861, target dead [ 1339.153901] binder_alloc: binder_alloc_mmap_handler: 9405 20001000-20004000 already mapped failed -16 [ 1339.185570] binder_alloc: binder_alloc_mmap_handler: 9438 20001000-20004000 already mapped failed -16 00:28:29 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1339.218935] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.225125] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.230712] binder: 9438:9441 ioctl 40046207 0 returned -16 [ 1339.237187] binder_alloc: 9438: binder_alloc_buf, no vma [ 1339.243958] binder: 9405:9418 ioctl 40046207 0 returned -16 [ 1339.250158] binder_alloc: 9438: binder_alloc_buf, no vma [ 1339.256189] binder: 9405:9444 transaction failed 29189/-3, size 0-0 line 2973 [ 1339.273553] binder: 9438:9442 transaction failed 29189/-3, size 0-0 line 2973 [ 1339.282982] binder: 9405:9446 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1339.290671] binder: release 9438:9441 transaction 864 out, still active [ 1339.299877] binder: undelivered TRANSACTION_COMPLETE 00:28:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7a00000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1339.321352] binder: 9405:9446 unknown command 0 [ 1339.327714] binder: release 9438:9441 transaction 864 in, still active [ 1339.341423] binder: 9405:9446 ioctl c0306201 20000280 returned -22 [ 1339.350815] binder: send failed reply for transaction 864, target dead 00:28:29 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xe8030000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1339.396644] binder_alloc: binder_alloc_mmap_handler: 9453 20001000-20004000 already mapped failed -16 [ 1339.423883] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.429382] binder: 9453:9454 ioctl 40046207 0 returned -16 [ 1339.435769] binder_alloc: 9453: binder_alloc_buf, no vma [ 1339.441633] binder: 9453:9455 transaction failed 29189/-3, size 0-0 line 2973 [ 1339.450140] binder: release 9453:9454 transaction 868 out, still active [ 1339.459667] binder: undelivered TRANSACTION_COMPLETE [ 1339.474067] binder: release 9453:9454 transaction 868 in, still active 00:28:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1339.503596] binder: send failed reply for transaction 868, target dead [ 1339.585688] binder_alloc: binder_alloc_mmap_handler: 9461 20001000-20004000 already mapped failed -16 [ 1339.628189] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.645185] binder: 9461:9462 ioctl 40046207 0 returned -16 [ 1339.663722] binder_alloc: 9461: binder_alloc_buf, no vma [ 1339.669254] binder: 9461:9464 transaction failed 29189/-3, size 0-0 line 2973 [ 1339.685275] binder: release 9461:9462 transaction 871 out, still active [ 1339.692065] binder: undelivered TRANSACTION_COMPLETE [ 1339.713952] binder: send failed reply for transaction 871, target dead 00:28:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x630d, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:30 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x11000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1339.892589] binder: 9473:9476 unknown command 0 [ 1339.915741] binder: 9473:9476 ioctl c0306201 20000280 returned -22 [ 1340.277028] binder: undelivered TRANSACTION_COMPLETE [ 1340.282266] binder_release_work: 19 callbacks suppressed [ 1340.282272] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.593870] device bridge_slave_1 left promiscuous mode [ 1341.599560] bridge0: port 2(bridge_slave_1) entered disabled state [ 1341.634316] device bridge_slave_0 left promiscuous mode [ 1341.639769] bridge0: port 1(bridge_slave_0) entered disabled state [ 1343.610353] team0 (unregistering): Port device team_slave_1 removed [ 1343.620098] team0 (unregistering): Port device team_slave_0 removed [ 1343.630820] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 1343.667786] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 1343.728553] bond0 (unregistering): Released all slaves [ 1343.799280] bridge0: port 1(bridge_slave_0) entered blocking state [ 1343.806135] bridge0: port 1(bridge_slave_0) entered disabled state [ 1343.813442] device bridge_slave_0 entered promiscuous mode [ 1343.848576] bridge0: port 2(bridge_slave_1) entered blocking state [ 1343.855032] bridge0: port 2(bridge_slave_1) entered disabled state [ 1343.861925] device bridge_slave_1 entered promiscuous mode [ 1343.896036] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 1343.929038] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 1344.026573] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 1344.062696] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 1344.221833] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 1344.229224] team0: Port device team_slave_0 added [ 1344.260200] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 1344.267702] team0: Port device team_slave_1 added [ 1344.300171] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1344.332697] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1344.368928] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 1344.376126] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1344.384307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1344.413071] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 1344.420496] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1344.428881] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1344.692237] bridge0: port 2(bridge_slave_1) entered blocking state [ 1344.698624] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1344.705324] bridge0: port 1(bridge_slave_0) entered blocking state [ 1344.711678] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1344.719813] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 1344.834114] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1345.649049] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1345.739706] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 1345.829812] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 1345.836003] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1345.842948] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1345.934322] 8021q: adding VLAN 0 to HW filter on device team0 00:28:37 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) 00:28:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x600000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x4008630a, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:37 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:37 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2b}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:37 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xb}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1347.317483] binder: BC_ATTEMPT_ACQUIRE not supported [ 1347.324752] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.350017] binder: 9749:9754 ioctl c0306201 20000280 returned -22 [ 1347.357857] binder: 9748:9750 ioctl 40046207 0 returned -16 00:28:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x400c630f, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1347.457809] binder_thread_release: 2 callbacks suppressed [ 1347.457834] binder: release 9749:9754 transaction 876 in, still active [ 1347.470463] binder_send_failed_reply: 2 callbacks suppressed [ 1347.470473] binder: send failed reply for transaction 876 to 9749:9754 [ 1347.518142] binder: send failed reply for transaction 877 to 9748:9759 [ 1347.570457] binder: undelivered TRANSACTION_COMPLETE [ 1347.647140] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.675964] binder: 9767:9768 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1347.741627] binder: 9767:9768 unknown command 0 [ 1347.780950] binder: 9767:9768 ioctl c0306201 20000280 returned -22 00:28:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40106309, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1348.086712] binder: release 9767:9768 transaction 879 in, still active [ 1348.093696] binder_alloc: binder_alloc_mmap_handler: 9748 20001000-20004000 already mapped failed -16 00:28:38 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1348.137514] binder: 9748:9772 transaction failed 29189/-22, size 0-0 line 2834 [ 1348.194210] binder: send failed reply for transaction 879 to 9767:9768 [ 1348.243627] binder: undelivered TRANSACTION_COMPLETE 00:28:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x700000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1348.324393] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.330023] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.345819] binder: 9778:9782 BC_ACQUIRE_DONE node 882 has no pending acquire request [ 1348.395592] binder: 9778:9782 unknown command 0 [ 1348.418881] binder: undelivered TRANSACTION_COMPLETE [ 1348.431824] binder: 9778:9782 ioctl c0306201 20000280 returned -22 [ 1348.443953] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.452283] binder: undelivered TRANSACTION_ERROR: 29189 00:28:38 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x40030000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1348.468008] binder: 9786:9788 ioctl 40046207 0 returned -16 00:28:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40046304, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:38 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x7000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1348.495306] binder: release 9778:9782 transaction 883 in, still active [ 1348.502382] binder: send failed reply for transaction 883 to 9778:9782 [ 1348.510929] binder: send failed reply for transaction 884 to 9786:9788 [ 1348.521329] binder: undelivered TRANSACTION_COMPLETE [ 1348.540527] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.642810] binder: 9797:9799 unknown command 0 00:28:38 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xc}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1348.666728] binder: 9797:9799 ioctl c0306201 20000280 returned -22 [ 1348.700265] binder: release 9797:9799 transaction 886 in, still active [ 1348.711523] binder: send failed reply for transaction 886 to 9797:9799 [ 1348.757491] binder: undelivered TRANSACTION_COMPLETE [ 1348.792453] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.853991] binder: 9807:9809 got transaction to context manager from process owning it [ 1348.901831] binder: 9807:9809 transaction failed 29201/-22, size 0-0 line 2825 00:28:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40106308, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1349.091745] binder: release 9807:9809 transaction 889 in, still active [ 1349.098535] binder: send failed reply for transaction 889 to 9807:9809 [ 1349.105802] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.111658] binder: undelivered TRANSACTION_COMPLETE [ 1349.117412] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.225527] binder_alloc: binder_alloc_mmap_handler: 9786 20001000-20004000 already mapped failed -16 [ 1349.260021] binder_alloc: 9786: binder_alloc_buf, no vma 00:28:39 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1349.325770] binder: 9786:9815 transaction failed 29189/-3, size 0-0 line 2973 [ 1349.347468] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.353354] binder: 9813:9816 ioctl 40046207 0 returned -16 [ 1349.383718] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.445130] binder: undelivered TRANSACTION_COMPLETE [ 1349.450287] binder: undelivered TRANSACTION_ERROR: 29189 00:28:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x400000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1349.528488] binder: 9813:9816 transaction failed 29189/-22, size 0-0 line 2834 [ 1349.588452] binder: 9813:9823 BC_INCREFS_DONE u0000000000000000 no match [ 1349.628522] binder: 9813:9823 unknown command 0 [ 1349.633642] binder: 9813:9823 ioctl c0306201 20000280 returned -22 00:28:39 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x4000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1349.731311] binder_alloc: binder_alloc_mmap_handler: 9827 20001000-20004000 already mapped failed -16 [ 1349.741991] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.748023] binder: 9827:9828 ioctl 40046207 0 returned -16 [ 1349.754322] binder_alloc: 9827: binder_alloc_buf, no vma [ 1349.760533] binder: 9827:9830 transaction failed 29189/-3, size 0-0 line 2973 [ 1349.776666] binder: release 9827:9828 transaction 895 out, still active [ 1349.794379] binder: undelivered TRANSACTION_COMPLETE [ 1349.817546] binder: release 9827:9828 transaction 895 in, still active 00:28:40 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xa000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x8000a0ffffffff, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1349.847066] binder: send failed reply for transaction 895, target dead 00:28:40 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3e8}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1349.969050] binder_alloc: binder_alloc_mmap_handler: 9837 20001000-20004000 already mapped failed -16 [ 1349.979364] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.985554] binder: 9837:9839 ioctl 40046207 0 returned -16 [ 1350.011625] binder_alloc: 9837: binder_alloc_buf, no vma [ 1350.019339] binder: 9837:9841 transaction failed 29189/-3, size 0-0 line 2973 [ 1350.036578] binder: release 9837:9839 transaction 898 out, still active [ 1350.048136] binder: undelivered TRANSACTION_COMPLETE [ 1350.093059] binder: release 9837:9839 transaction 898 in, still active 00:28:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7a000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40086303, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1350.181561] binder: send failed reply for transaction 898, target dead 00:28:40 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1350.410586] binder_alloc: binder_alloc_mmap_handler: 9852 20001000-20004000 already mapped failed -16 [ 1350.493289] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.498928] binder_alloc: 9852: binder_alloc_buf, no vma [ 1350.505342] binder: 9852:9856 ioctl 40046207 0 returned -16 [ 1350.505949] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.520526] binder: 9852:9860 transaction failed 29189/-3, size 0-0 line 2973 [ 1350.528379] binder: 9854:9857 ioctl 40046207 0 returned -16 [ 1350.541581] binder_alloc: 9852: binder_alloc_buf, no vma [ 1350.557260] binder: 9854:9857 transaction failed 29189/-3, size 0-0 line 2973 [ 1350.568522] binder: release 9852:9855 transaction 901 out, still active [ 1350.578252] binder: undelivered TRANSACTION_COMPLETE 00:28:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x500, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1350.631717] binder: send failed reply for transaction 901, target dead [ 1350.639487] binder: 9854:9857 BC_FREE_BUFFER u0000000000000000 no match 00:28:40 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1350.709537] binder: 9854:9857 unknown command 0 [ 1350.727940] binder: 9854:9857 ioctl c0306201 20000280 returned -22 [ 1350.760560] binder_alloc: binder_alloc_mmap_handler: 9869 20001000-20004000 already mapped failed -16 00:28:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40046307, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1350.854587] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.945485] binder_alloc: 9869: binder_alloc_buf, no vma [ 1350.951607] binder: 9869:9870 ioctl 40046207 0 returned -16 [ 1350.959179] binder: send failed reply for transaction 905 to 9869:9870 [ 1350.960483] binder: 9869:9872 transaction failed 29189/-3, size 0-0 line 2973 00:28:41 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x30000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4c, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1350.995715] binder: 9882:9883 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 1351.011650] binder: 9882:9883 unknown command 0 [ 1351.021875] binder: 9882:9883 ioctl c0306201 20000280 returned -22 00:28:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40406301, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1351.097965] binder: BINDER_SET_CONTEXT_MGR already set [ 1351.122959] binder: send failed reply for transaction 908 to 9882:9883 [ 1351.130391] binder: 9886:9887 ioctl 40046207 0 returned -16 00:28:41 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0xf401}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1351.168834] binder: 9886:9891 transaction failed 29189/-22, size 0-0 line 2834 [ 1351.250961] binder_alloc: 9892: binder_alloc_buf, no vma [ 1351.263705] binder: send failed reply for transaction 911 to 9892:9894 00:28:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x630b, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:41 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1351.550546] binder: 9903:9904 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER 00:28:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40406300, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1351.614866] binder: 9903:9904 unknown command 0 [ 1351.619585] binder: 9903:9904 ioctl c0306201 20000280 returned -22 [ 1351.759580] binder: 9911:9912 got transaction to context manager from process owning it 00:28:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40046302, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:42 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1000000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1351.885306] binder_alloc: binder_alloc_mmap_handler: 9886 20001000-20004000 already mapped failed -16 [ 1351.934196] binder_alloc: 9886: binder_alloc_buf, no vma [ 1351.944813] binder: BINDER_SET_CONTEXT_MGR already set 00:28:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x74, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1351.974909] binder: 9915:9917 ioctl 40046207 0 returned -16 [ 1352.056123] binder: BC_ACQUIRE_RESULT not supported [ 1352.084019] binder: 9915:9925 ioctl c0306201 20000280 returned -22 [ 1352.091842] binder_alloc: binder_alloc_mmap_handler: 9926 20001000-20004000 already mapped failed -16 00:28:42 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x23}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1352.149231] binder_alloc: 9926: binder_alloc_buf, no vma [ 1352.155747] binder: BINDER_SET_CONTEXT_MGR already set [ 1352.181182] binder: send failed reply for transaction 922, target dead [ 1352.188590] binder: 9926:9928 ioctl 40046207 0 returned -16 00:28:42 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2a00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x500000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1352.384766] binder_alloc: binder_alloc_mmap_handler: 9937 20001000-20004000 already mapped failed -16 00:28:42 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1352.439236] binder: BINDER_SET_CONTEXT_MGR already set [ 1352.444774] binder: 9937:9943 ioctl 40046207 0 returned -16 [ 1352.527733] binder_thread_release: 7 callbacks suppressed [ 1352.527744] binder: release 9937:9940 transaction 925 out, still active [ 1352.541353] binder: release 9937:9940 transaction 925 in, still active 00:28:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1352.598289] binder: send failed reply for transaction 925, target dead [ 1352.685724] binder_alloc: binder_alloc_mmap_handler: 9953 20001000-20004000 already mapped failed -16 00:28:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40086310, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1352.779050] binder: BINDER_SET_CONTEXT_MGR already set [ 1352.840079] binder_release_work: 16 callbacks suppressed [ 1352.840085] binder: undelivered TRANSACTION_ERROR: 29189 [ 1352.856743] binder_alloc: 9953: binder_alloc_buf, no vma [ 1352.881010] binder: 9953:9954 ioctl 40046207 0 returned -16 [ 1352.888900] binder: release 9953:9954 transaction 927 out, still active [ 1352.899468] binder: BINDER_SET_CONTEXT_MGR already set [ 1352.899524] binder_release_work: 7 callbacks suppressed [ 1352.899529] binder: undelivered TRANSACTION_COMPLETE [ 1352.915863] binder: 9960:9961 ioctl 40046207 0 returned -16 00:28:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x700, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1352.926358] binder: undelivered TRANSACTION_ERROR: 29189 [ 1352.932333] binder: release 9953:9954 transaction 927 in, still active [ 1352.940177] binder: send failed reply for transaction 927, target dead 00:28:43 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1f00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1352.972881] binder: 9960:9962 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1352.991108] binder: 9960:9962 unknown command 0 [ 1352.998784] binder: 9960:9962 ioctl c0306201 20000280 returned -22 [ 1353.081770] binder: BINDER_SET_CONTEXT_MGR already set [ 1353.087759] binder: 9967:9968 ioctl 40046207 0 returned -16 [ 1353.137479] binder: release 9967:9968 transaction 931 out, still active [ 1353.148029] binder: undelivered TRANSACTION_COMPLETE 00:28:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7a00, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1353.177041] binder: undelivered TRANSACTION_ERROR: 29189 00:28:43 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x1500000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1353.242236] binder: release 9967:9968 transaction 931 in, still active 00:28:43 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1353.284285] binder: send failed reply for transaction 931, target dead [ 1353.311238] binder_alloc_mmap_handler: 1 callbacks suppressed [ 1353.311255] binder_alloc: binder_alloc_mmap_handler: 9973 20001000-20004000 already mapped failed -16 [ 1353.373952] binder: BINDER_SET_CONTEXT_MGR already set [ 1353.379513] binder: 9973:9978 ioctl 40046207 0 returned -16 00:28:43 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1353.471809] binder_transaction: 8 callbacks suppressed [ 1353.471823] binder: 9973:9979 transaction failed 29189/-3, size 0-0 line 2973 00:28:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1353.552893] binder: undelivered TRANSACTION_ERROR: 29189 [ 1353.558523] binder: release 9973:9978 transaction 934 in, still active [ 1353.579637] binder_send_failed_reply: 2 callbacks suppressed [ 1353.579646] binder: send failed reply for transaction 934 to 9973:9978 [ 1353.624555] binder: undelivered TRANSACTION_COMPLETE [ 1353.651411] binder: undelivered TRANSACTION_ERROR: 29189 00:28:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1353.704736] binder_alloc: binder_alloc_mmap_handler: 9993 20001000-20004000 already mapped failed -16 [ 1353.725741] binder: 9993:9996 transaction failed 29189/-3, size 0-0 line 2973 [ 1353.726318] binder: undelivered TRANSACTION_ERROR: 29189 [ 1353.740773] binder: BINDER_SET_CONTEXT_MGR already set [ 1353.766211] binder: 9993:9994 ioctl 40046207 0 returned -16 [ 1353.821641] binder: release 9993:9994 transaction 937 out, still active [ 1353.834468] binder: undelivered TRANSACTION_COMPLETE [ 1353.883063] binder: BINDER_SET_CONTEXT_MGR already set 00:28:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1353.954143] binder: undelivered TRANSACTION_ERROR: 29189 [ 1353.959860] binder: release 9993:9994 transaction 937 in, still active [ 1353.969575] binder: 9999:10002 ioctl 40046207 0 returned -16 [ 1354.004749] binder: 9999:10005 transaction failed 29189/-22, size 0-0 line 2834 [ 1354.033242] binder: send failed reply for transaction 937, target dead [ 1354.060931] binder: 9999:10005 got reply transaction with no transaction stack [ 1354.086861] binder: 9999:10005 transaction failed 29201/-71, size 0-0 line 2741 00:28:44 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x2600000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1354.112735] binder: 10007:10008 unknown command 0 [ 1354.125093] binder: 10007:10008 ioctl c0306201 20000280 returned -22 [ 1354.139004] binder_alloc: binder_alloc_mmap_handler: 10007 20001000-20004000 already mapped failed -16 [ 1354.150812] binder: BINDER_SET_CONTEXT_MGR already set [ 1354.157080] binder: 10007:10008 ioctl 40046207 0 returned -16 [ 1354.163651] binder: 10007:10009 transaction failed 29189/-3, size 0-0 line 2973 [ 1354.202776] binder: 10007:10014 unknown command 0 [ 1354.231230] binder: 10007:10014 ioctl c0306201 20000280 returned -22 00:28:44 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x1000000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1354.288733] binder: release 10007:10008 transaction 942 out, still active [ 1354.319025] binder: undelivered TRANSACTION_COMPLETE [ 1354.335496] binder: undelivered TRANSACTION_ERROR: 29189 00:28:44 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) 00:28:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x60, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1354.390026] binder: send failed reply for transaction 942, target dead [ 1354.511918] binder_alloc: binder_alloc_mmap_handler: 10024 20001000-20004000 already mapped failed -16 00:28:44 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3f00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1354.603978] binder: BINDER_SET_CONTEXT_MGR already set 00:28:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0xa0008000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1354.673281] binder: 10024:10027 ioctl 40046207 0 returned -16 [ 1354.696515] binder: undelivered TRANSACTION_ERROR: 29201 [ 1354.704797] binder: undelivered TRANSACTION_ERROR: 29189 [ 1354.760514] binder: send failed reply for transaction 945 to 10024:10027 [ 1354.770137] binder_alloc_new_buf_locked: 5 callbacks suppressed [ 1354.770145] binder_alloc: 10024: binder_alloc_buf, no vma [ 1354.836302] binder: undelivered TRANSACTION_COMPLETE 00:28:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x100000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1354.860302] binder: 10024:10029 transaction failed 29189/-3, size 0-0 line 2973 [ 1354.896102] binder_alloc: 10036: binder_alloc_buf, no vma [ 1354.901685] binder: 10036:10037 transaction failed 29189/-3, size 0-0 line 2973 [ 1354.909812] binder: send failed reply for transaction 948 to 10036:10037 [ 1354.976599] binder: BINDER_SET_CONTEXT_MGR already set [ 1354.982238] binder: 10040:10042 ioctl 40046207 0 returned -16 00:28:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1355.043918] binder: undelivered TRANSACTION_COMPLETE [ 1355.052447] binder: send failed reply for transaction 950 to 10040:10042 00:28:45 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xe000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1355.158728] binder_alloc: 10048: binder_alloc_buf, no vma [ 1355.164685] binder: 10048:10049 transaction failed 29189/-3, size 0-0 line 2973 [ 1355.172475] binder: send failed reply for transaction 952 to 10048:10049 00:28:45 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x2900000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:45 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1355.316524] binder: undelivered TRANSACTION_COMPLETE [ 1355.521813] binder_alloc: 10059: binder_alloc_buf, no vma [ 1355.533781] binder: 10059:10064 transaction failed 29189/-3, size 0-0 line 2973 [ 1355.541249] binder: send failed reply for transaction 955 to 10059:10064 00:28:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1355.620549] binder: undelivered TRANSACTION_COMPLETE 00:28:45 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x1000000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1355.708573] binder_alloc: 10069: binder_alloc_buf, no vma [ 1355.733204] binder: 10069:10070 transaction failed 29189/-3, size 0-0 line 2973 [ 1355.749849] binder: send failed reply for transaction 958 to 10069:10070 [ 1355.757103] binder_alloc: binder_alloc_mmap_handler: 10040 20001000-20004000 already mapped failed -16 00:28:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1355.807017] binder: BINDER_SET_CONTEXT_MGR already set [ 1355.812416] binder: 10040:10046 ioctl 40046207 0 returned -16 [ 1355.829018] binder: undelivered TRANSACTION_COMPLETE [ 1355.834263] binder: send failed reply for transaction 960 to 10040:10073 00:28:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4c000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1355.881203] binder_alloc: 10080: binder_alloc_buf, no vma [ 1355.896195] binder: send failed reply for transaction 962 to 10080:10081 00:28:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:46 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0xe00}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1356.005553] binder_alloc: binder_alloc_mmap_handler: 10085 20001000-20004000 already mapped failed -16 [ 1356.034983] binder: BINDER_SET_CONTEXT_MGR already set [ 1356.041027] binder_alloc: 10085: binder_alloc_buf, no vma 00:28:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x74000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1356.080410] binder: 10085:10086 ioctl 40046207 0 returned -16 [ 1356.102765] binder: BINDER_SET_CONTEXT_MGR already set [ 1356.145625] binder: 10089:10093 ioctl 40046207 0 returned -16 [ 1356.151691] binder: send failed reply for transaction 965, target dead 00:28:46 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xc}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1356.226500] binder: 10089:10097 got reply transaction with no transaction stack [ 1356.325549] binder_alloc: binder_alloc_mmap_handler: 10099 20001000-20004000 already mapped failed -16 00:28:46 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1356.410622] binder: BINDER_SET_CONTEXT_MGR already set 00:28:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1356.493637] binder: 10099:10100 ioctl 40046207 0 returned -16 [ 1356.499973] binder_alloc: 10099: binder_alloc_buf, no vma [ 1356.507658] binder: send failed reply for transaction 970, target dead [ 1356.822538] binder_alloc: binder_alloc_mmap_handler: 10117 20001000-20004000 already mapped failed -16 00:28:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1356.911959] binder: BINDER_SET_CONTEXT_MGR already set 00:28:47 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3800000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1356.953637] binder: 10117:10118 ioctl 40046207 0 returned -16 [ 1356.971641] binder_alloc: 10117: binder_alloc_buf, no vma 00:28:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xa00, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1357.004384] binder: BINDER_SET_CONTEXT_MGR already set [ 1357.009689] binder: 10124:10125 ioctl 40046207 0 returned -16 [ 1357.009743] binder: send failed reply for transaction 973 to 10117:10118 [ 1357.069879] binder: 10124:10128 got reply transaction with no transaction stack [ 1357.125224] binder_alloc: binder_alloc_mmap_handler: 10131 20001000-20004000 already mapped failed -16 [ 1357.155851] binder: BINDER_SET_CONTEXT_MGR already set [ 1357.161693] binder: 10131:10133 ioctl 40046207 0 returned -16 00:28:47 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x700}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:47 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x4}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:47 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1357.480579] binder: 10143:10145 unknown command 0 [ 1357.544591] binder: 10143:10145 ioctl c0306201 20000280 returned -22 [ 1357.624248] binder_alloc: binder_alloc_mmap_handler: 10143 20001000-20004000 already mapped failed -16 [ 1357.683884] binder_alloc: 10143: binder_alloc_buf, no vma [ 1357.684014] binder: BINDER_SET_CONTEXT_MGR already set [ 1357.769797] binder: 10143:10154 unknown command 0 00:28:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1357.821031] binder: 10143:10154 ioctl c0306201 20000280 returned -22 [ 1357.910588] binder: 10143:10145 ioctl 40046207 0 returned -16 [ 1357.910744] binder_release_work: 21 callbacks suppressed [ 1357.910752] binder: undelivered TRANSACTION_ERROR: 29189 [ 1357.944709] binder: undelivered TRANSACTION_ERROR: 29201 [ 1357.952997] binder: undelivered TRANSACTION_ERROR: 29189 00:28:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7400000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1357.959034] binder_thread_release: 8 callbacks suppressed [ 1357.959044] binder: release 10143:10145 transaction 980 in, still active [ 1357.984940] binder_release_work: 7 callbacks suppressed [ 1357.984945] binder: undelivered TRANSACTION_COMPLETE [ 1358.003238] binder: undelivered TRANSACTION_ERROR: 29189 00:28:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1358.060474] binder: BINDER_SET_CONTEXT_MGR already set [ 1358.066459] binder: undelivered TRANSACTION_ERROR: 29190 [ 1358.072429] binder: undelivered TRANSACTION_COMPLETE [ 1358.077882] binder: 10161:10162 ioctl 40046207 0 returned -16 [ 1358.089879] binder: undelivered TRANSACTION_ERROR: 29189 00:28:48 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xea01}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1358.214425] binder: undelivered TRANSACTION_ERROR: 29190 [ 1358.221689] binder: undelivered TRANSACTION_COMPLETE [ 1358.237856] binder: undelivered TRANSACTION_ERROR: 29189 00:28:48 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x3}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1358.375118] binder: undelivered TRANSACTION_ERROR: 29190 [ 1358.381275] binder: undelivered TRANSACTION_COMPLETE 00:28:48 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1358.418801] binder: undelivered TRANSACTION_ERROR: 29189 00:28:48 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xd00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1358.521642] binder_transaction: 13 callbacks suppressed [ 1358.521658] binder: 10182:10183 transaction failed 29189/-3, size 0-0 line 2973 [ 1358.645550] binder_send_failed_reply: 5 callbacks suppressed [ 1358.645562] binder: send failed reply for transaction 993 to 10182:10183 00:28:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1358.746400] binder: undelivered TRANSACTION_COMPLETE [ 1358.860828] binder_alloc: binder_alloc_mmap_handler: 10161 20001000-20004000 already mapped failed -16 [ 1358.881532] binder: 10195:10196 transaction failed 29189/-3, size 0-0 line 2973 [ 1358.898394] binder: BINDER_SET_CONTEXT_MGR already set [ 1358.926806] binder: send failed reply for transaction 996 to 10195:10196 [ 1358.944270] binder: release 10161:10198 transaction 998 out, still active [ 1358.952047] binder: 10161:10197 ioctl 40046207 0 returned -16 [ 1358.964966] binder: undelivered TRANSACTION_COMPLETE 00:28:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x300, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) 00:28:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1359.112075] binder: send failed reply for transaction 998, target dead [ 1359.128362] binder: undelivered TRANSACTION_COMPLETE 00:28:49 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x4000000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1359.235929] binder: BINDER_SET_CONTEXT_MGR already set [ 1359.244199] binder_alloc: binder_alloc_mmap_handler: 10199 20001000-20004000 already mapped failed -16 [ 1359.253979] binder: 10202:10205 ioctl 40046207 0 returned -16 [ 1359.270355] binder: BINDER_SET_CONTEXT_MGR already set [ 1359.276313] binder: 10199:10203 ioctl 40046207 0 returned -16 [ 1359.285967] binder: 10199:10204 transaction failed 29189/-3, size 0-0 line 2973 [ 1359.288806] binder: 10202:10208 transaction failed 29189/-3, size 0-0 line 2973 [ 1359.306834] binder: release 10199:10203 transaction 1000 out, still active [ 1359.317033] binder: undelivered TRANSACTION_COMPLETE [ 1359.332732] binder: release 10199:10203 transaction 1000 in, still active 00:28:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xffffff7f00000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1359.361965] binder: send failed reply for transaction 1000, target dead [ 1359.378471] binder: 10202:10208 got reply transaction with no transaction stack [ 1359.387811] binder: 10202:10208 transaction failed 29201/-71, size 0-0 line 2741 00:28:49 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1359.443776] binder_alloc: binder_alloc_mmap_handler: 10215 20001000-20004000 already mapped failed -16 00:28:49 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x1f00000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1359.539504] binder: BINDER_SET_CONTEXT_MGR already set [ 1359.558918] binder: 10215:10217 transaction failed 29189/-3, size 0-0 line 2973 00:28:49 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1359.606682] binder: 10215:10216 ioctl 40046207 0 returned -16 [ 1359.634323] binder: release 10215:10216 transaction 1005 out, still active [ 1359.651745] binder: undelivered TRANSACTION_COMPLETE [ 1359.691685] binder: release 10215:10216 transaction 1005 in, still active 00:28:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x1000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1359.752543] binder: send failed reply for transaction 1005, target dead [ 1359.912855] binder_alloc: binder_alloc_mmap_handler: 10232 20001000-20004000 already mapped failed -16 [ 1359.958364] binder: BINDER_SET_CONTEXT_MGR already set [ 1359.974155] binder: 10232:10236 ioctl 40046207 0 returned -16 [ 1360.005592] binder_alloc_new_buf_locked: 8 callbacks suppressed [ 1360.005599] binder_alloc: 10232: binder_alloc_buf, no vma 00:28:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1360.082397] binder: release 10232:10236 transaction 1008 out, still active [ 1360.096296] binder: 10232:10237 transaction failed 29189/-3, size 0-0 line 2973 [ 1360.104482] binder: undelivered TRANSACTION_COMPLETE [ 1360.135952] binder: release 10232:10236 transaction 1008 in, still active [ 1360.208546] binder: send failed reply for transaction 1008, target dead 00:28:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xa0008000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1360.297974] binder_alloc: 10244: binder_alloc_buf, no vma 00:28:50 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1360.362354] binder: 10244:10245 transaction failed 29189/-3, size 0-0 line 2973 [ 1360.393593] binder: send failed reply for transaction 1011 to 10244:10245 00:28:50 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x800000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1360.481860] binder_alloc: binder_alloc_mmap_handler: 10248 20001000-20004000 already mapped failed -16 [ 1360.561692] binder: BINDER_SET_CONTEXT_MGR already set [ 1360.567556] binder: 10258:10261 ioctl 40046207 0 returned -16 [ 1360.575073] binder: BINDER_SET_CONTEXT_MGR already set [ 1360.581359] binder_alloc: 10248: binder_alloc_buf, no vma [ 1360.587617] binder: 10248:10249 ioctl 40046207 0 returned -16 [ 1360.603328] binder: 10258:10261 transaction failed 29189/-3, size 0-0 line 2973 [ 1360.612143] binder_alloc: 10248: binder_alloc_buf, no vma [ 1360.618188] binder: 10248:10254 transaction failed 29189/-3, size 0-0 line 2973 [ 1360.627568] binder: release 10248:10249 transaction 1014 out, still active [ 1360.637539] binder: release 10248:10249 transaction 1014 in, still active [ 1360.653064] binder: send failed reply for transaction 1014, target dead 00:28:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x3f00000000000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1360.660648] binder: 10258:10267 got reply transaction with no transaction stack 00:28:51 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x5000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:51 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x300}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1360.791798] binder_alloc: binder_alloc_mmap_handler: 10270 20001000-20004000 already mapped failed -16 [ 1360.814201] binder: BINDER_SET_CONTEXT_MGR already set [ 1360.823994] binder: 10270:10271 ioctl 40046207 0 returned -16 [ 1360.830782] binder_alloc: 10270: binder_alloc_buf, no vma [ 1360.860207] binder: send failed reply for transaction 1019, target dead 00:28:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0xa000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1361.210645] binder_alloc: binder_alloc_mmap_handler: 10282 20001000-20004000 already mapped failed -16 [ 1361.318813] binder: BINDER_SET_CONTEXT_MGR already set 00:28:51 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) 00:28:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1361.390702] binder: 10282:10283 ioctl 40046207 0 returned -16 00:28:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x6800, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1361.458641] binder_alloc: 10282: binder_alloc_buf, no vma [ 1361.509993] binder: send failed reply for transaction 1022 to 10282:10283 00:28:51 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x200000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1361.637273] binder: BINDER_SET_CONTEXT_MGR already set [ 1361.647465] binder_alloc: 10294: binder_alloc_buf, no vma [ 1361.676639] binder: send failed reply for transaction 1025 to 10294:10297 [ 1361.677702] binder: 10295:10296 ioctl 40046207 0 returned -16 00:28:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1361.717657] binder: send failed reply for transaction 1027 to 10295:10303 00:28:52 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x7000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1361.857891] binder_alloc: 10311: binder_alloc_buf, no vma [ 1361.899243] binder: send failed reply for transaction 1029 to 10311:10313 00:28:52 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x4}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) 00:28:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1362.244945] binder_alloc: 10319: binder_alloc_buf, no vma [ 1362.250514] binder: send failed reply for transaction 1032 to 10319:10321 00:28:52 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1362.411037] binder_alloc: binder_alloc_mmap_handler: 10295 20001000-20004000 already mapped failed -16 00:28:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1362.459800] binder: BINDER_SET_CONTEXT_MGR already set 00:28:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x3f00, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1362.493971] binder: 10295:10303 ioctl 40046207 0 returned -16 [ 1362.615754] binder_alloc: 10330: binder_alloc_buf, no vma 00:28:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xe803000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1362.661982] binder: send failed reply for transaction 1036 to 10330:10332 [ 1362.697664] binder: BINDER_SET_CONTEXT_MGR already set [ 1362.735914] binder: 10335:10336 ioctl 40046207 0 returned -16 00:28:53 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x80ffffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) 00:28:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1362.826217] binder: send failed reply for transaction 1038 to 10335:10339 00:28:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1363.062157] binder_release_work: 28 callbacks suppressed [ 1363.062164] binder: undelivered TRANSACTION_ERROR: 29190 [ 1363.075693] binder_release_work: 9 callbacks suppressed [ 1363.075698] binder: undelivered TRANSACTION_COMPLETE 00:28:53 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0xd00000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1363.168923] binder: undelivered TRANSACTION_ERROR: 29189 00:28:53 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) 00:28:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1363.371196] binder: undelivered TRANSACTION_ERROR: 29190 [ 1363.380074] binder: undelivered TRANSACTION_COMPLETE [ 1363.422208] binder: undelivered TRANSACTION_ERROR: 29189 [ 1363.487908] binder_alloc: binder_alloc_mmap_handler: 10335 20001000-20004000 already mapped failed -16 [ 1363.512620] binder: BINDER_SET_CONTEXT_MGR already set [ 1363.550325] binder: 10335:10339 ioctl 40046207 0 returned -16 00:28:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1363.632004] binder: undelivered TRANSACTION_ERROR: 29190 [ 1363.638113] binder: undelivered TRANSACTION_COMPLETE [ 1363.688020] binder: undelivered TRANSACTION_ERROR: 29189 00:28:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x7a, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1363.746574] binder_transaction: 11 callbacks suppressed [ 1363.746589] binder: 10372:10373 transaction failed 29189/-3, size 0-0 line 2973 [ 1363.753641] binder: undelivered TRANSACTION_COMPLETE [ 1363.760561] binder_send_failed_reply: 4 callbacks suppressed [ 1363.760571] binder: send failed reply for transaction 1050 to 10372:10373 00:28:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1363.816994] binder: undelivered TRANSACTION_ERROR: 29189 [ 1363.831052] binder: undelivered TRANSACTION_ERROR: 29190 [ 1363.870455] binder: undelivered TRANSACTION_COMPLETE 00:28:54 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x700}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1363.896597] binder_alloc: binder_alloc_mmap_handler: 10376 20001000-20004000 already mapped failed -16 [ 1363.921493] binder: undelivered TRANSACTION_ERROR: 29189 [ 1363.943734] binder: undelivered TRANSACTION_COMPLETE 00:28:54 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3000000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1363.974387] binder: BINDER_SET_CONTEXT_MGR already set [ 1363.989136] binder: undelivered TRANSACTION_ERROR: 29189 [ 1364.001800] binder: 10379:10381 ioctl 40046207 0 returned -16 [ 1364.008286] binder: BINDER_SET_CONTEXT_MGR already set [ 1364.053646] binder: 10376:10377 ioctl 40046207 0 returned -16 [ 1364.058679] binder: 10376:10378 transaction failed 29189/-3, size 0-0 line 2973 [ 1364.060295] binder: 10379:10381 transaction failed 29189/-3, size 0-0 line 2973 [ 1364.125636] binder_thread_release: 3 callbacks suppressed [ 1364.125647] binder: release 10376:10377 transaction 1053 in, still active [ 1364.140205] binder: 10379:10389 got reply transaction with no transaction stack [ 1364.168584] binder: send failed reply for transaction 1053 to 10376:10377 [ 1364.211584] binder: undelivered TRANSACTION_COMPLETE 00:28:54 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1364.243547] binder: 10379:10389 transaction failed 29201/-71, size 0-0 line 2741 00:28:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x4, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1364.454755] binder: 10402:10404 unknown command 0 [ 1364.494297] binder: 10402:10404 ioctl c0306201 20000280 returned -22 [ 1364.584563] binder_alloc: binder_alloc_mmap_handler: 10402 20001000-20004000 already mapped failed -16 [ 1364.625830] binder: BINDER_SET_CONTEXT_MGR already set [ 1364.631127] binder: 10402:10404 ioctl 40046207 0 returned -16 [ 1364.653716] binder: 10402:10406 transaction failed 29189/-3, size 0-0 line 2973 00:28:54 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x1100000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1364.696357] binder: 10402:10407 unknown command 0 [ 1364.703270] binder: 10402:10407 ioctl c0306201 20000280 returned -22 [ 1364.711720] binder: release 10402:10404 transaction 1058 out, still active [ 1364.721394] binder: undelivered TRANSACTION_COMPLETE [ 1364.734982] binder: release 10402:10404 transaction 1058 in, still active 00:28:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x48000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1364.792975] binder: send failed reply for transaction 1058, target dead [ 1364.877403] binder: 10412:10416 transaction failed 29189/-3, size 0-0 line 2973 [ 1364.897964] binder: send failed reply for transaction 1061 to 10412:10416 [ 1364.909928] binder: BINDER_SET_CONTEXT_MGR already set 00:28:55 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$cgroup_ro(r2, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x3000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r1, r0) shutdown(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r6, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @local}, 0x0, 0x3, 0x3}}, 0x26) fcntl$notify(0xffffffffffffffff, 0x402, 0x2d) [ 1364.929851] binder: 10411:10415 ioctl 40046207 0 returned -16 00:28:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1364.973640] binder_alloc: binder_alloc_mmap_handler: 10411 20001000-20004000 already mapped failed -16 [ 1364.984864] binder: send failed reply for transaction 1063 to 10411:10418 [ 1364.992830] binder: undelivered TRANSACTION_COMPLETE 00:28:55 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff0000966f1503db0cfd2a0000bf"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0xffffffffa0008000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x2, 0x3, 0x3}}, 0x26) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1365.078101] binder: undelivered TRANSACTION_COMPLETE 00:28:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x60000000, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}}}], 0x0, 0x0, 0x0}) [ 1365.121887] binder_alloc_new_buf_locked: 8 callbacks suppressed [ 1365.121895] binder_alloc: 10423: binder_alloc_buf, no vma [ 1365.252033] binder: 10423:10424 transaction failed 29189/-3, size 0-0 line 2973 [ 1365.280905] binder: BINDER_SET_CONTEXT_MGR already set 00:28:55 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1365.333940] binder: send failed reply for transaction 1066 to 10423:10424 [ 1365.351905] binder: 10432:10434 ioctl 40046207 0 returned -16 00:28:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1365.648908] binder: send failed reply for transaction 1068 to 10432:10436 [ 1365.793489] binder_alloc: 10445: binder_alloc_buf, no vma [ 1365.799526] binder: 10445:10446 transaction failed 29189/-3, size 0-0 line 2973 [ 1365.807922] binder: send failed reply for transaction 1070 to 10445:10446 00:28:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:28:56 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x8000) openat$cgroup_ro(r3, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x8c) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8ff0000000069a2f8ff00"], 0x0}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) r7 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r7, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0xc9, 0x0, {0x6000000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) dup2(r2, r1) shutdown(r2, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x410000, 0x0) connect$l2tp(r7, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007ff, 0x0, 0x0) [ 1365.911766] ================================================================== [ 1365.919429] BUG: KASAN: use-after-free in vhost_work_queue+0xc3/0xe0 [ 1365.925978] Read of size 8 at addr ffff8881780ebb68 by task syz-executor3/10433 [ 1365.933419] [ 1365.935068] CPU: 1 PID: 10433 Comm: syz-executor3 Not tainted 4.20.0-rc3+ #123 [ 1365.942434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1365.951795] Call Trace: [ 1365.954403] dump_stack+0x244/0x39d [ 1365.958051] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1365.963253] ? printk+0xa7/0xcf [ 1365.966543] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 1365.966573] print_address_description.cold.7+0x9/0x1ff [ 1365.966591] kasan_report.cold.8+0x242/0x309 [ 1365.966606] ? vhost_work_queue+0xc3/0xe0 [ 1365.966624] __asan_report_load8_noabort+0x14/0x20 [ 1365.976722] vhost_work_queue+0xc3/0xe0 [ 1365.976741] vhost_transport_send_pkt+0x28a/0x380 [ 1365.976759] ? vhost_vsock_dev_open+0x5a0/0x5a0 [ 1365.976820] ? virtio_transport_send_pkt_info+0x2e7/0x460 [ 1366.009285] ? __local_bh_enable_ip+0x160/0x260 [ 1366.013972] virtio_transport_send_pkt_info+0x31d/0x460 [ 1366.019358] virtio_transport_connect+0x17c/0x220 [ 1366.024235] ? virtio_transport_send_pkt_info+0x460/0x460 [ 1366.029773] ? vsock_auto_bind+0xa9/0xe0 [ 1366.033861] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1366.039416] vsock_stream_connect+0x4ed/0xe40 [ 1366.043938] ? vsock_dgram_connect+0x500/0x500 [ 1366.048556] ? lock_downgrade+0x900/0x900 [ 1366.052711] ? lock_release+0xa00/0xa00 [ 1366.056685] ? perf_trace_sched_process_exec+0x860/0x860 [ 1366.062144] ? finish_wait+0x430/0x430 [ 1366.066051] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 1366.071246] ? smack_socket_connect+0x13f/0x1c0 [ 1366.075923] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1366.081475] ? security_socket_connect+0x94/0xc0 [ 1366.086254] __sys_connect+0x37d/0x4c0 [ 1366.090144] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1366.094752] ? __ia32_sys_accept+0xb0/0xb0 [ 1366.098995] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1366.104446] ? _copy_to_user+0xc8/0x110 [ 1366.108454] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1366.114001] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1366.118762] ? retint_kernel+0x2d/0x2d [ 1366.122661] __x64_sys_connect+0x73/0xb0 [ 1366.126739] ? do_syscall_64+0xca/0x820 [ 1366.130715] do_syscall_64+0x1b9/0x820 [ 1366.134621] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1366.139987] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1366.144930] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1366.149833] ? trace_hardirqs_on_caller+0x310/0x310 [ 1366.154850] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1366.159866] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1366.164897] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1366.169779] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1366.174965] RIP: 0033:0x457569 [ 1366.178158] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1366.197058] RSP: 002b:00007fbd8626cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1366.204761] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 1366.212023] RDX: 0000000000000010 RSI: 0000000020000200 RDI: 000000000000000b [ 1366.219286] RBP: 000000000072c040 R08: 0000000000000000 R09: 0000000000000000 [ 1366.226554] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbd8626d6d4 [ 1366.233821] R13: 00000000004bdbc6 R14: 00000000004cd040 R15: 00000000ffffffff [ 1366.241098] [ 1366.242718] Allocated by task 10425: [ 1366.246437] save_stack+0x43/0xd0 [ 1366.249887] kasan_kmalloc+0xc7/0xe0 [ 1366.253615] __kmalloc_node+0x50/0x70 [ 1366.257414] kvmalloc_node+0xb9/0xf0 [ 1366.261125] vhost_vsock_dev_open+0xa2/0x5a0 [ 1366.265586] misc_open+0x3ca/0x560 [ 1366.269128] chrdev_open+0x25a/0x710 [ 1366.272838] do_dentry_open+0x499/0x1250 [ 1366.276897] vfs_open+0xa0/0xd0 [ 1366.280173] path_openat+0x12bc/0x5150 [ 1366.284069] do_filp_open+0x255/0x380 [ 1366.287863] do_sys_open+0x568/0x700 [ 1366.291588] __x64_sys_openat+0x9d/0x100 [ 1366.295652] do_syscall_64+0x1b9/0x820 [ 1366.299538] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1366.304718] [ 1366.306344] Freed by task 10425: [ 1366.309709] save_stack+0x43/0xd0 [ 1366.313162] __kasan_slab_free+0x102/0x150 [ 1366.317409] kasan_slab_free+0xe/0x10 [ 1366.321233] kfree+0xcf/0x230 [ 1366.324339] kvfree+0x61/0x70 [ 1366.327443] vhost_vsock_dev_release+0x4f4/0x720 [ 1366.332202] __fput+0x385/0xa30 [ 1366.335508] ____fput+0x15/0x20 [ 1366.338816] task_work_run+0x1e8/0x2a0 [ 1366.342701] exit_to_usermode_loop+0x318/0x380 [ 1366.347281] do_syscall_64+0x6be/0x820 [ 1366.351167] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1366.356348] [ 1366.357972] The buggy address belongs to the object at ffff8881780ebac0 [ 1366.357972] which belongs to the cache kmalloc-64k of size 65536 [ 1366.370802] The buggy address is located 168 bytes inside of [ 1366.370802] 65536-byte region [ffff8881780ebac0, ffff8881780fbac0) [ 1366.382839] The buggy address belongs to the page: [ 1366.387774] page:ffffea0005e03800 count:1 mapcount:0 mapping:ffff8881da802500 index:0x0 compound_mapcount: 0 [ 1366.397761] flags: 0x2fffc0000010200(slab|head) [ 1366.402428] raw: 02fffc0000010200 ffffea0005d18808 ffffea0006092008 ffff8881da802500 [ 1366.410306] raw: 0000000000000000 ffff8881780ebac0 0000000100000001 0000000000000000 [ 1366.418189] page dumped because: kasan: bad access detected [ 1366.423889] [ 1366.425559] Memory state around the buggy address: [ 1366.430485] ffff8881780eba00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1366.437845] ffff8881780eba80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 1366.445206] >ffff8881780ebb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1366.452558] ^ [ 1366.459321] ffff8881780ebb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1366.466682] ffff8881780ebc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1366.474027] ================================================================== [ 1366.481388] Disabling lock debugging due to kernel taint [ 1366.488364] binder_alloc: binder_alloc_mmap_handler: 10432 20001000-20004000 already mapped failed -16 00:28:56 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfffffc50) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}, 0x0}], 0x1, 0x0, 0x0) [ 1366.521487] Kernel panic - not syncing: panic_on_warn set ... [ 1366.527399] CPU: 1 PID: 10433 Comm: syz-executor3 Tainted: G B 4.20.0-rc3+ #123 [ 1366.536146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1366.536542] binder_alloc: 10432: binder_alloc_buf, no vma [ 1366.545507] Call Trace: [ 1366.545527] dump_stack+0x244/0x39d [ 1366.545545] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1366.545617] panic+0x2ad/0x55c [ 1366.545651] ? add_taint.cold.5+0x16/0x16 [ 1366.569908] ? preempt_schedule+0x4d/0x60 [ 1366.574077] ? ___preempt_schedule+0x16/0x18 [ 1366.574295] binder: 10432:10453 transaction failed 29189/-3, size 0-0 line 2973 [ 1366.578490] ? trace_hardirqs_on+0xb4/0x310 [ 1366.578506] kasan_end_report+0x47/0x4f [ 1366.578519] kasan_report.cold.8+0x76/0x309 [ 1366.578532] ? vhost_work_queue+0xc3/0xe0 [ 1366.578547] __asan_report_load8_noabort+0x14/0x20 [ 1366.578559] vhost_work_queue+0xc3/0xe0 [ 1366.578574] vhost_transport_send_pkt+0x28a/0x380 [ 1366.578592] ? vhost_vsock_dev_open+0x5a0/0x5a0 [ 1366.621124] ? virtio_transport_send_pkt_info+0x2e7/0x460 [ 1366.626665] ? __local_bh_enable_ip+0x160/0x260 [ 1366.631352] virtio_transport_send_pkt_info+0x31d/0x460 [ 1366.636721] virtio_transport_connect+0x17c/0x220 [ 1366.641566] ? virtio_transport_send_pkt_info+0x460/0x460 [ 1366.647143] ? vsock_auto_bind+0xa9/0xe0 [ 1366.651226] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1366.656774] vsock_stream_connect+0x4ed/0xe40 [ 1366.661269] ? vsock_dgram_connect+0x500/0x500 [ 1366.665850] ? lock_downgrade+0x900/0x900 [ 1366.669995] ? lock_release+0xa00/0xa00 [ 1366.673967] ? perf_trace_sched_process_exec+0x860/0x860 [ 1366.679437] ? finish_wait+0x430/0x430 [ 1366.683367] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 1366.688572] ? smack_socket_connect+0x13f/0x1c0 [ 1366.693234] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1366.698760] ? security_socket_connect+0x94/0xc0 [ 1366.703529] __sys_connect+0x37d/0x4c0 [ 1366.707423] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1366.712006] ? __ia32_sys_accept+0xb0/0xb0 [ 1366.716239] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1366.721703] ? _copy_to_user+0xc8/0x110 [ 1366.725710] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1366.731250] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1366.736002] ? retint_kernel+0x2d/0x2d [ 1366.739897] __x64_sys_connect+0x73/0xb0 [ 1366.743960] ? do_syscall_64+0xca/0x820 [ 1366.747935] do_syscall_64+0x1b9/0x820 [ 1366.751827] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1366.757194] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1366.762123] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1366.766964] ? trace_hardirqs_on_caller+0x310/0x310 [ 1366.771984] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1366.777012] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1366.782025] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1366.786868] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1366.792055] RIP: 0033:0x457569 [ 1366.795244] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1366.814443] RSP: 002b:00007fbd8626cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1366.822147] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 1366.829419] RDX: 0000000000000010 RSI: 0000000020000200 RDI: 000000000000000b [ 1366.836686] RBP: 000000000072c040 R08: 0000000000000000 R09: 0000000000000000 [ 1366.843958] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbd8626d6d4 [ 1366.851221] R13: 00000000004bdbc6 R14: 00000000004cd040 R15: 00000000ffffffff [ 1366.859607] Kernel Offset: disabled [ 1366.863230] Rebooting in 86400 seconds..