fffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:03 executing program 0: r0 = socket$rds(0x15, 0x5, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) prctl$PR_SET_FP_MODE(0x2d, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x1e7, 0x0, 0x0, 0x0, 0x89, 0x0, 0x7f, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000300)) 05:48:03 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = accept4$netrom(0xffffffffffffff9c, 0x0, &(0x7f0000000000), 0x800) sendto$netrom(r0, &(0x7f0000000040)="1131fee40abc1496f689572ccdab706e338db9a229b6367de1e749a290d2a620a2dcd00744b47e9596fae62d637628f8795f3039cd501df08c5e", 0x3a, 0x0, &(0x7f0000000100)={{0x3, @bcast, 0x5}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @null]}, 0x48) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f00000008c0)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000090000000300000080020000f8000000f8000000f8000000f8000000f8000000e8010000e8010000e8010000e8010000e801000003000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="000000000000336dffffffff0000000076657468315f746f5f62726964676500626f6e6430000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc0003200000000000009800f800000000000000000000000000000000000000000000000000600053455400000000010000000000000000000000000000000000000000000080000000010100000400000002000000ff030000810000000400000018ff000004000000ee130000070000000008000002000000ffffffff01040000000700007f00000100000000000000ff000000ff76657468315f746f5f6272696467650173797a5f74756e000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000006700a93094bf362ff93f03100000000000000000000000000000c00007000000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000002000000000000003000434f4e4e4d41524b0000000000000000000000000000000000000000000101000000020000000400000002000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff0000000045ff1e6cee4ff8d0c6fee35c98bc2b6f8d68c6f9537d8bde213c72a0b6f4ba1c90fe6c02c3fcda1e9c17e676991fbc0f5bdbd537f4f413defa15faf652856dafae1ded8d3d9fd8199b9d1933f8704dca5528985f1e7a1bcc23bdc3e9e14444c0206297a5dfe2c87babec1582171bc5d3ec4d9457c82ec9a2ecbc97dd3671757da1d4ec1b323ff2d18551991bbbdb6b2ed4f9deb202d0b87bfa37d96225b42c8fc58d3dbbdba4faeedffe074747a06143a5e6c01ae575fd33c2c0b18d5b6beda933740e3db98bc1937ce94607a837cb3eadb6c6c5ca20a09a294864399685a752971f3c9adc72dcae922f1e0026eed525a89f45c8605d174faebaf2431dfd38906d30d26560ca8b9a04dd1dd848a72704d18c10c876c9800d1f8de12f890a01c4e2ee19ad5221f8e49493a4c4ebbe6bdadf9b56ec729c03d9a0fcd5691d7cfb6d1f"], 0x2e0) readahead(r2, 0x9576, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000240), 0x4) 05:48:03 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="8500000025000000000000009500000000000000e078483a1fda988dc79fae88f78744526851efe40b45b53156b05a21617fe713f50b07000000000000009af6e9dfc34d71c20c50cff135e4a85769a88882dc1d138b0b24b9ecc690aa6e053c29a3645bf869ce26c0c367af4af911154eaeba803f8719130085f0087ed391614c13d48e823900005518346e3f693433eb290000000000000000000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() r3 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x7fffffff, 0x212200) getsockopt$bt_BT_CHANNEL_POLICY(r3, 0x112, 0xa, &(0x7f0000000180)=0xd8b6, &(0x7f00000001c0)=0x4) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r1, &(0x7f0000000140)={0xd0002000}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:03 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) 05:48:03 executing program 4: r0 = gettid() seccomp(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x10200000006, 0x0, 0x0, 0x7fc00000}]}) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x1000000000016) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$P9_RWSTAT(r1, &(0x7f0000000100)={0x7, 0x7f, 0x2}, 0x7) r2 = accept$inet(0xffffffffffffff9c, &(0x7f0000000000)={0x2, 0x0, @local}, &(0x7f0000000040)=0x10) fcntl$setlease(r2, 0x400, 0x0) 05:48:03 executing program 1: r0 = inotify_init1(0x807ff) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x400000, 0x1) preadv(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000100)=""/88, 0x58}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f0000000240)=""/125, 0x7d}], 0x3, 0x0) ioctl$int_out(r0, 0x5460, &(0x7f0000000180)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2002, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r0, &(0x7f0000000340)=[{&(0x7f0000000480)=""/254, 0xfe}], 0x1, 0x0) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f00000003c0)={@local, @local, 0x0}, &(0x7f0000000400)=0xc) setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000440)={@local, r3}, 0x14) fcntl$getownex(r0, 0x10, &(0x7f00000002c0)={0x0, 0x0}) mq_notify(r1, &(0x7f00000001c0)={0x0, 0x5, 0x2, @tid=r4}) preadv(r1, &(0x7f0000000300), 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000000)={'IDLEtIMER\x00'}, &(0x7f0000000040)=0xe9) [ 706.313411] binder: 11303:11313 got transaction with invalid offset (0, min 0 max 24) or object. [ 706.326207] binder: 11303:11313 transaction failed 29201/-22, size 24-8 line 3241 05:48:03 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff8000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) [ 706.366515] PKCS8: Unsupported PKCS#8 version 05:48:03 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) 05:48:03 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r0, &(0x7f0000000580)=[{&(0x7f0000000480)=""/251}], 0x3b8, 0x0) 05:48:03 executing program 0: r0 = socket$rds(0x15, 0x5, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) prctl$PR_SET_FP_MODE(0x2d, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00000000000004}, 0x0, 0x0, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000300)) 05:48:03 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0x7bc, 0x8201) ioctl$PPPIOCGDEBUG(r2, 0x80047441, &(0x7f0000000180)) r3 = gettid() ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f00000001c0)='/dev/input/mouse#\x00') bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r0, 0x0, 0x0, 0x0}, 0x30) [ 706.595113] protocol 88fb is buggy, dev hsr_slave_0 [ 706.600346] protocol 88fb is buggy, dev hsr_slave_1 [ 706.614087] binder: 11433:11434 got transaction with invalid offset (0, min 0 max 24) or object. [ 706.640860] binder: 11433:11434 transaction failed 29201/-22, size 24-8 line 3241 [ 706.675192] protocol 88fb is buggy, dev hsr_slave_0 [ 706.680417] protocol 88fb is buggy, dev hsr_slave_1 [ 706.685625] protocol 88fb is buggy, dev hsr_slave_0 [ 706.690732] protocol 88fb is buggy, dev hsr_slave_1 05:48:06 executing program 5: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000, 0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000180)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x41100, 0x1, [], 0x0, 0x4000000}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:06 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_tables_matches\x00') write$selinux_validatetrans(r0, &(0x7f0000000040)={'system_u:object_r:inetd_child_exec_t:s0', 0x20, 'system_u:object_r:dhcpd_var_run_t:s0', 0x20, 0x5, 0x20, '/usr/sbin/ntpd\x00'}, 0x71) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000100)={@rand_addr="524c8634c13b15227f8a892181be84ad", 0xfffffffffffffffb, 0x2, 0x3, 0x6, 0xfffffffffffffffa, 0x3}, &(0x7f0000000140)=0x20) preadv(r1, &(0x7f0000000480), 0x0, 0x0) 05:48:06 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) 05:48:06 executing program 0: r0 = socket$rds(0x15, 0x5, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) prctl$PR_SET_FP_MODE(0x2d, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) write$binfmt_elf32(r1, &(0x7f0000000340)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x4, 0xfffffffffffffeff, 0x9, 0xa25, 0x3, 0x3, 0xffff, 0x314, 0x38, 0x4a, 0x0, 0x3, 0x20, 0x1, 0x9, 0x1, 0x5}, [{0x7, 0x4, 0x5d, 0x8001, 0x7fffffff, 0x6}, {0x6474e551, 0x1000, 0x2, 0x7, 0x849, 0x0, 0x3, 0x80}], "4bf4d49a03d6c2afdf2d7448860c0c8e13efcbc62ca3173190dfae1494eb755031e65ae15b21834a0c0b2449171e6f4656a10a590af7d7f2980433bdd8ddd598365c3de9072a6331772fad196c26ac6e8b904a1ec29970ac157e7267ea2b252447f0d515d1d77d29545f15f12f", [[], [], [], []]}, 0x4e5) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000300)) 05:48:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000003f00, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:06 executing program 4: r0 = gettid() seccomp(0x1, 0x1, &(0x7f0000000180)={0x1, &(0x7f00000000c0)=[{0x10200000004, 0x0, 0x0, 0x7fc00000}]}) timer_create(0x7, &(0x7f0000000040)={0x0, 0x12, 0x0, @thr={&(0x7f0000000000)="356952c37063fbbfab99d961d5313772f15651407f6c9e", &(0x7f0000000200)="d89f428bd0aba5dca940a6f74061fc024b3b650e0c91e42b1e3f577889c6f0bb8f82043a57d1fcd38c4a21c1c17698ac243df72e17b9de05cdb7025e0b3f8dc6a8c420db62078ed138c87442c1e2d2759e6ea711d8de0f3903243ce9c0b693558507df516b90db96e3bdda4718f1db4dcf42d0871936fceba9b76a00f5d98db8ac64165270de6fa94a030feb9b86dcae444d7d0f3bc703e058ce92c3a360b8b360a5f04e87d613a6e47b60257671664ec03ad8611a6e2ccd42b4a9804307d1fa3517a8017bfe8d48880fe5afbebe13386b96cbe19543a206f34f25eafa407b5a9ee7f87d6a53537f141062cb97e7133b94500f4ab13963e026fe5600b1cfc46253965de6474a774fa098e93b7aae88a9c6ae69ba2de4d16bde15d61ea6d174a3cbf15e7495c31ebec351aad13c0e5c3fe76bd092b9127bc3084839337df340524d4689f83a7cf1ddcd615f54a7ff500d64c770a361c394c1bd95cf20969cd96dfae8628d99413056332707b4ac0d6599f2334e570f5eedf10ec009ec7fc084fbb4a32208f5ceac1dcfa78e9bbbcc405e8db47937d93b669a0c03e113b2d7c07c7f023994fc951540aeda2241e82a7916c089e1c02d56dbac0348129bdc8e821610d058e3e3db8c6de12f79aaadab87edd4ff3351c2a883a1eb5d886463f5f92703624030ce8a8374d785d9b87b2a3f7924ac79eb3fcc27c826c8e9f47269da934d27b84041f3f1b5b3247c13a5cb17f95c5e4420b6ce4cf447f8ae4d0d824d4e45727246d0b8cbe1503596bbcc14cdfb32e9637c8a3a7f38858ef62366aa28f7d22f5e26a9ef7ccd8678ac34f3298d1ab32378c16b2cd2421e4dcdfda22c5e29aca652414e069f3e02648d0f81929e24a860f66f1f7d6d4e958ba0907b9cc8f51bf76ea6280b31793b3082cb63176da939abd13ac2d3d379d5d1069adb4993e823ad8fdc3f670c9e628146a2f5854d5fea261312720ccf1964eac3e2f77c7fff1e9fdb4c5009edbf6add8f2b8db8dc5258e158711ae0c735244b306f843a633451eb52a32f3251cda5fb4923eb40a33d7480727bf7d26bdc426a487d1933dea01f14fa01c252730c4387ed5f65d8b89ace2688d3ae6dc1336a5da5c01a76c64c10055fbf1e4416d5042ca76d0b20bab9e41154088972bfbf30761f91fc476e6be22b66cecfdeb99348e85a8e0a7ae5bc48e1790f5f0dcfa3ccdd795e04b88be0b0100abf0be37b72db078848ab2bd525d81660802520727e54d88233e1f6366a1606d48b323e3c31a0405cdd9fd7dbaf60ec8928b9a4ce3ac17563ffbfa369baf0c2a40cb6b3b1a1db3525ad992c57f7b09450f19fd429ca3332a1dd3fcef247474db4ad53a26202406c9f6fef5c1672326df7eaaa3dfafc7f74ca0eeb12b490f57be94d3fc6fe96ddb2e7ec3cc499f0e8cb232bdf95cc5dd1860efbfaabbc2340ae156f110d121ab665ab31a7924a9f2a00d428579eff76545622caeee8eec96b26096caf3bdaa263e408526ba1649a4c43562267a2e602328d910b620547be1c254122930de696440a2e9bbb3cc192185c16a69af7a6df5c31dcccf8e50d33e40021bb0350c283c749f01f291bb1e83ff431c18e58d8c26a8a5596caf9791b984a5d3039f102c3b3ea944f47aef1685379835fc6b176c2bf9664c388c7cfaddfbe123317357155b36ea957294cbe1dde68840f3888f5cfeea933c8d9f755049e03d59ff73e122b2ec142236fddf29aa83ebcd42bc0f1f88de1fd1a0bb851316aa1131ff6dcb6362c023f2d2658bbed3cc7b5ac211340d467e34cc235d0adbc9d78a76292eb342edf17290381480ba74a53c0887be02677047a48a3ae2791683f054c2532455d6a54e481af83cb3b47aac398234d7670feee93548c8ccfd6b5869fe78654b96f8bfd7bb07c4b0542bc3f8ea039f4fee929018d8747ce9adce0a7125dd9f80d04ea67499042a5b07fdb596cd3d028c4842ce16c090a95ef68c2ed9fb34f05a52dddee12f761b784b35e2cec53e6a3f8b03339d37c9196b61ad393b947523d8045beab19256f3d6e84178e59ce7140e7d83d322dccad0fb42c6f2ee8278ff3b3fad1d777f1dff3af1d2d1afe84fbbf6abd6604b1f42319a64708a17dcaee1267f19138eabe9cf2e768b21ef4c9ccc3c51678ab9001fed19013abb0e0d36b5fd2b41c0a8d91e6ee8dc85d50ee694636bcb6686080f568d1749052f4fe01132adee267e3a4e93800c499c4d636eff7632c41dcde1ef26dc2375c30c39311d8ea4c0c4db1d67f905025c0be81a9cac61c201740120b77ab280828826a54feb24607189f8fadbf2fda193906e07c3bb577f884584089137f2b9479eb0263d9830b0367e810e9bf75acf98ab40644c11bf1eba7606a801d5966ff43cf836d0fe6f38a8ff53e676e37cd5749322faa60e24ae360a1f088e61d544ba16817b014d2c2036aa086224cf5c9c19d6c635fa9b5e7cb75655b2d0ebcd86ccab578772fbdedc12d715198003cd20a0e9b8224dc919f892ab1289cae4663c19448703027e002351acae755e82a4b90aef11434f00cf455a2a3c53d556bde44916661268d618549e7e429a2a36446c40f3891b0d32cd41cd67048e0bef5f051f60366ea56e5d41a636ede1e4c19c67e2598f8784032eb2a207431fe99b561fde25e37280c5db2504ff6583b0ff9f333b072d62add79926d7e1d19d7506d566c82790c2da16dfad463d93cc239964a66db24ae9a8726f97c02567b64754c4482af1053eeca16d46177a5db1afc685ea9bc825e23a704e5dcb39083c5af3dd2aa38f1458d8359f04ecdc7ea81cb8bced427fbd5eb803d96472f4c0c902de1e531838a0b17afae5a14a86477528ec6418ccaf6a2cc5ed2b69ef56644cd2997f3ecdea255c9771911e448d5cb4e0bebb4e7d823a13ea167c8db734df7b303f7df78ffdcda3bc4e4bfee267a1bb71c491afb72ac65e5224ccb43afeb951ec6bd0b8ecdb0b55b9fe694c5ae0f5b077db1dd590314f72fb71aaaeb930fffe01c1eaada29d679cce49f05a0462a02c2e48742295b334ca06f431968b9b0774da4e16d8386a471d83e085875d562c1030f5031ef3058b0fb24059a3bb141f82f30fbcea7979eb8bf72717206cab42cfbf5c672044130b91eb5e636eba189b153c52471872c26d75cd6ee0bfe7c423d42f58a560cb0186d8042fa5175a70e50fe00f71f48bf2a5fae6f8c40fe2f4036cb05dadb6fe68acecd33a19a027412e494abf5c5845b4d64b1b2525d459333ceb305f7ef3d1f0e4cb5acc2fc7186385db16b60375650f0d3b610636a327bfa7043a9ccb87ce4623b83f1abaf355481a72974f5b5e4b1eb2394a20f0ef8b40084965b98c819294fd591ec3f6fbf77d7ac094ee07271a174441f10b94fc5b57a64e70b67ae58cb3d0b6ad8d8f5a7430c68572dc2ccd48fbc59d902f58c014ce3521bb2eaa57dbb1755440512242fe51d4380f900a228f3964206e1f91ffdaa905f4449f679f3409017f8f15e9c937afbb2c5b056c354637959c57b673786e2fac5c04db95821fa0351b4d6685b8a1b961a8eaf4bf6d985bc450fee3ccfb44ee3d08a954b5efa6c6dc4e7d468084354aaa5ac17495d8a80397999e4070211a7502de1fd0a9e8206ba710bb5982f10d616f97ef1d7a1272e659bd00e9d11ca3970ba283c39345e5225dc54f3a7aa9a7f878a9d248efd3c07f07aeb324bc0589acbd436efb58180db53b7826759ad035ff9ceae2d4e84a6bb7e194dabfd24b7944225b7f503c84b9543b2e686d894c312ac2e67deebdfad34a579cf4e98c71b225ec484a048be3e80f5a17b26cd383cece20119d8bd78722e7072f52a99d8d33e4125c031d659a63cebc6fa208ce4b30ca9707c63f3d0a3cab95cfb97f7fee2be7cbd974df3801f87af19c90995d0f136594869a1ba3cdec66bdb90bc2edd31ecdd9a29dee03b273135b86a14887880f64613008663f2f599242d3759476ed2f780a59b72894e9ebb3a582e801bf3a49a59a4f3066e91caa9de1647fac196ac531459ee0848e3523f9ce5decb6012b8d88a6fba205b81f388b2d34be034a6d9dbb5538f7700fee3c7d6bead8ccc4e356b7f607f2bb53addce40046ad5c49f41372dacd3a51c8ca4b40834c50fa86faaf0f2f391172c59183b69f9c349f10b10bd82efd7339768c41070296a7afecd1b9dc9873879562d6f29a489448b35c6ed3d71785cb1a0d7a2c203025f349a5950aaea4b73a0a448fa1a810ad6b37051992d71907ce4114b9ce1d52434d38c9f41ef26d4eb5a19c710dbe1891bbe95961dd48974fa534738f8f61cb0e0a2e05dc34e305e942981092ebd743c9a6334852210568b5cf700573286b01c1f95f5dae9cdaa4656f236deb1171500d395b7a1d59e601af1ac5e8f8bcefa92ecb0564bb2426da20839fe21690f85abd31b9a15619ca91404067e56ee614d99a8b4e978fa8480616bd9d48b7e1d406fa2b58fddf68598605d89c9374197404cba0205d5755830ab9eaa4743ba0950d842632072a91baa1b30ca4c8bac3d18bded6bf48c8a984720146631d36fb58b5c5bb63b5668e771ff77eefbd708c3e126f19d383925e60b1fa5ab36479320db50ad5d5852ed92cfa2407669efdd3dcd6791af483364455bd86f67c4bf80425ba473cd9ba8c1a0b3ab7433195847057d5cb0e9f7d183ffd6a24db8ccba66696911db7a7bb39c0474f0906a82274519846e5c2648e792cb81d3ef4fc7a321ece2abb31694d899658b4193497255656131de096965a9d72fe6c9bcace93d56f7a98a4e1b8d873890dd9781e97525529fc8f0c05c931b0ba8afaa9a67f973ef128e85f2ef22bb6f7b2a1cd4f5287346b9766ef0bda833784f2a8c66cc1b94e01fae88467b99b12989b11eb3e68e998357ef2ea3a275d84b338a653b8c4c3f145e11639e2111ce6740ebd7971565159a467338e8280570c1e747f12b2d28d8a548c74bfcb63d7a705293dec4c137dafc9b54a16055cc0242e08660ba6dcf822b473791b182ba58f0e735330c06cf89d0f16bc51f719ab6458b28ec24cb608882eb8fc1e7e5afe40ef4783353ed906e7c696bc84575d3cb5e864fe79134b37d42c6235b22cc78e115035cfeb7019b6485f611177f40b5d5c7c039769bad10823146ea4d9c9eff827d60a4e11d03e4e13372a7892d2f7850d668ee71c002f2a3e3c7db6254f4e1b52c62330ba19bbf2cf9a02ead1be8ca0b8919c1800e0ad4d98b5bb94a04a75e7ed2d8691b39c55ca762dbb19b389cc74bf4972cb958b207f8a90802c34a3eb8d774f4488e6cb9e23aa061f7b91788990b53e8a257b16ca0e433dbb616ed7806fbf65a47a47bf4656970e595824e018bb2d2a0fe31890b05f2e44c74970480c8761dedfcb72b06f87cbf430524fca60f45f038074a9a3dda3f3e5b4dc77c5ac8039db78a9fda20a2694b6312805f201ed5ca19131ede8934238f58ba19259ec7c15d2d29905dfa2391bb0f2db50a6bffdd2771dbcc657cc01ca6e09b84e41be877757b6baeaab4065888aea39a37947082825303f19aeabe4a4b9c838304a8e315554a597edc432937bd673638899cdc7481ae35235b693ee019dc4ce2c4afc06471145b55c980603a3bbc39c2b36a5036adb9a225c82202b29e0c6600b6c52300dbd12eada3cdd75a9871f9c21fdd59c37f249ee3f6652dd24d2fe7eaa83a4309877d04764dd9e0e69da949a6d396ac7e4b20e7ae70968946881f6ddbfde7b2b43c84bfb21718a58849d37b173a7a5913a9a752374378460cdad1a7"}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x1000000000016) 05:48:06 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$VIDIOC_G_AUDIO(r0, 0x80345621, &(0x7f0000000140)) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x101100, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000240)={0x0, 0x1}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000380)={r2, 0xa0, &(0x7f00000002c0)=[@in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e22, 0xcc1, @local, 0x7}, @in6={0xa, 0x4e22, 0x80, @mcast2, 0x3}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x12}}, @in6={0xa, 0x4e21, 0xa69e, @dev={0xfe, 0x80, [], 0x1a}, 0xfff}, @in6={0xa, 0x4e21, 0x100000000, @dev={0xfe, 0x80, [], 0x17}, 0x4}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f00000003c0)=0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @local, @loopback}, &(0x7f0000000100)=0xc) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000000), 0x0, 0x8000000000000) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000), 0x4) [ 709.372144] binder: 11661:11662 got transaction with invalid offset (0, min 0 max 24) or object. [ 709.390990] binder: 11661:11662 transaction failed 29201/-22, size 24-8 line 3241 05:48:06 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x0, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) [ 709.446761] PKCS8: Unsupported PKCS#8 version 05:48:06 executing program 4: r0 = gettid() seccomp(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x10200000006, 0x0, 0x0, 0x7fc00000}]}) timer_create(0xfffffffffffffffe, &(0x7f0000000000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x1000000000016) 05:48:06 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 05:48:06 executing program 1: r0 = inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) fcntl$setlease(r0, 0x400, 0x1) r1 = getpgrp(0xffffffffffffffff) r2 = syz_open_procfs(r1, &(0x7f0000000040)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f0000000480), 0x1000000000000237, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x400000, 0x0) 05:48:07 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x4002, 0x0) bind$ax25(r1, &(0x7f0000000140)={{0x3, @null, 0x4}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x1b6, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000000700000061a3940000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x1, [], 0x0, 0x3}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2) r3 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:07 executing program 0: r0 = socket$rds(0x15, 0x5, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) prctl$PR_SET_FP_MODE(0x2d, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) getsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000100)={@rand_addr, @dev}, &(0x7f0000000140)=0x8) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000300)) 05:48:07 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x8001, 0x10000) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f0000000080)={0x0, 0x5, 0xfffffffffffffff9, &(0x7f0000000040)=0x100000001}) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000240)=""/203) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 709.701091] binder: 11793:11794 got transaction with invalid offset (0, min 0 max 24) or object. [ 709.738958] binder: 11793:11794 transaction failed 29201/-22, size 24-8 line 3241 05:48:07 executing program 5: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-monitor\x00', 0x50100, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x404000, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x3ff, 0x28000) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0xa, &(0x7f0000000280)=@raw=[@ldst={0x0, 0x3, 0x2, 0xc, 0x5, 0x50, 0x10}, @map={0x18, 0x6, 0x1, 0x0, r0}, @call={0x85, 0x0, 0x0, 0x3}, @jmp={0x5, 0xffffffff, 0x7, 0x6, 0xa, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x3, 0x1, 0x0, r1}, @exit, @map={0x18, 0x6, 0x1, 0x0, r2}], &(0x7f00000001c0)='GPL\x00', 0x8000, 0x1000, &(0x7f0000000580)=""/4096, 0x41100, 0x1, [], r3, 0xf}, 0x48) r4 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000001580)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x1, 0xc3, &(0x7f0000001600)=""/195, 0x41000, 0x4}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) r6 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r6, r4, 0x0, 0x0, 0x0}, 0x30) ioctl$VIDIOC_CROPCAP(r0, 0xc02c563a, &(0x7f00000004c0)={0x8, {0xbd5, 0x3, 0xff, 0x8}, {0x6, 0xffff, 0x2d8cc3cc, 0x1462}, {0x5, 0x4}}) 05:48:07 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) [ 709.991947] binder: 11974:12018 got transaction with invalid offset (0, min 0 max 24) or object. [ 710.006977] binder: 11974:12018 transaction failed 29201/-22, size 24-8 line 3241 [ 711.155165] net_ratelimit: 24 callbacks suppressed [ 711.155176] protocol 88fb is buggy, dev hsr_slave_0 [ 711.165293] protocol 88fb is buggy, dev hsr_slave_1 [ 712.275149] protocol 88fb is buggy, dev hsr_slave_0 [ 712.280261] protocol 88fb is buggy, dev hsr_slave_1 05:48:09 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:09 executing program 1: r0 = inotify_init1(0x80800) preadv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$IP_VS_SO_SET_EDITDEST(r1, 0x0, 0x489, &(0x7f0000000000)={{0x87, @empty, 0x4e22, 0x4, 'sed\x00', 0x15, 0x7, 0x46}, {@multicast2, 0x4e21, 0x10003, 0x400, 0x8, 0x20}}, 0x44) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f0000000240)={0x0, @bt={0x5, 0x0, 0x0, 0x3, 0x0, 0x401, 0x7, 0xff, 0x8, 0x3, 0x9, 0x100000000, 0x4, 0x5, 0x8, 0x1}}) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) pipe2(&(0x7f0000000080), 0x80000) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x200, 0x0) 05:48:09 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) 05:48:09 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000004000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) [ 712.355150] protocol 88fb is buggy, dev hsr_slave_0 [ 712.361908] protocol 88fb is buggy, dev hsr_slave_1 [ 712.464084] binder: 12027:12028 got transaction with invalid offset (0, min 0 max 24) or object. [ 712.484148] binder: 12027:12028 transaction failed 29201/-22, size 24-8 line 3241 05:48:09 executing program 4: r0 = gettid() seccomp(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x10200000006, 0x0, 0x0, 0x7fc00000}]}) timer_create(0x0, &(0x7f0000000000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x1000000000016) 05:48:09 executing program 0: r0 = socket$rds(0x15, 0x5, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000100)=0x0) r4 = getpgrp(0x0) tgkill(r3, r4, 0x30) perf_event_open(&(0x7f0000000440)={0x5, 0x70, 0x0, 0x4, 0x18, 0x4, 0x0, 0x7f82, 0x0, 0x0, 0x6, 0x4, 0x100, 0x6, 0x4, 0x400, 0x1e, 0x72af2aa7, 0x4, 0x3f, 0xf68, 0x1f, 0x0, 0x4, 0x99, 0x3, 0xfffffffeffffffff, 0x7, 0x10001, 0x8001, 0x4, 0xffffffffffffff49, 0x3, 0x2dbc, 0x0, 0xffffffff9bb764e3, 0x0, 0x10e0, 0x0, 0x5, 0x4, @perf_config_ext={0x80000000}, 0x200, 0x8000, 0x6, 0x7, 0x7, 0x309, 0xb78}, r4, 0x1, r2, 0x1) prctl$PR_SET_FP_MODE(0x2d, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x1, 0x0, 0x0, 0x9, 0x1, 0x3649, 0x2, 0x10000, 0x1ff, 0x3, 0x3, 0x2, 0x1, 0x0, 0x7ff, 0x8001], 0x10d000}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r7 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r8 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r8, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x40000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r8, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000540)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000fb4c8152b97a859ff2be54000000004c14291616fb5a4845981621eb619dfc00a9d94b2ecfe5c2987ccac9c0c9e4f823c767a29bd195111ba8b56f4e675527f26acd10f83ba50883d8addd5a5ffb998f3c9c6c25fe6ab0ccb122b5e1becf9b651beb35e8608b48523b091aa862bebc7001ad3f05942fd547679c1b35d616a6bd9b4097a4454b866debf499d5b3b18c7e"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="055d8c3e71f07763"], 0x0, 0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000380)={0x3, 0x0, 0xfffffffeffffffff, 0x0, 0x8001}) fcntl$getownex(r0, 0x10, &(0x7f0000000300)) ioctl$DRM_IOCTL_GET_MAGIC(r1, 0x80046402, &(0x7f00000003c0)=0x1) 05:48:09 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) syz_open_procfs(r0, &(0x7f0000000040)='sessionid\x00') r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:09 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:09 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 712.712796] audit: type=1400 audit(1552024090.057:135): avc: denied { transfer } for pid=12047 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 712.717228] binder: 12047:12055 unknown command 1049386245 [ 712.753069] binder: BINDER_SET_CONTEXT_MGR already set 05:48:10 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="8500000007a76b0009000000000000005a9e50763225740bf69f4e6a0000000000b41700"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x4b0e80, 0x0) accept$unix(r2, &(0x7f0000000380), &(0x7f0000000400)=0x6e) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = gettid() bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0x50, &(0x7f0000000180)}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0x50, &(0x7f00000002c0)={0x0, 0x0}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r0, 0x0, 0x1bf, 0x0, r4}, 0x30) 05:48:10 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VIDIOC_S_FBUF(r0, 0x4030560b, &(0x7f0000000100)={0x8c, 0x38, &(0x7f0000000480)="e79018ce486ffebdacfef51d522a1b74d33edcec6722e7d1372d0edbf4491ce2d85d2d85304032e092bb6e471bc4a25efb139321666adbb74a9efd60648d0b38918d8a5d9147c9ea75c668a01b81dbb384afdd81895b082826a43a34f7ec058572947446e20afb057a80c501290d549b7a0c3cf022aaa055e4c6527e460f24f5c3e661fbae1562955be0c886dceb", {0x10001, 0x9, 0x55595659, 0x0, 0x7, 0x8, 0xf, 0x10001}}) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000000)=""/6, 0x6}, {&(0x7f0000000040)=""/13, 0xd}, {&(0x7f0000000240)=""/222, 0xde}, {&(0x7f0000000340)=""/184, 0xb8}], 0x4, 0x0) [ 712.767008] binder: 12051:12052 ioctl 40046207 0 returned -16 [ 712.770809] binder: 12047:12055 ioctl c0306201 200001c0 returned -22 [ 712.785504] binder: 12051:12052 got transaction with invalid offset (0, min 0 max 24) or object. [ 712.804948] binder: 12051:12052 transaction failed 29201/-22, size 24-8 line 3241 [ 712.835107] protocol 88fb is buggy, dev hsr_slave_0 [ 712.840260] protocol 88fb is buggy, dev hsr_slave_1 05:48:10 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 712.915968] protocol 88fb is buggy, dev hsr_slave_0 [ 712.921075] protocol 88fb is buggy, dev hsr_slave_1 [ 712.955580] binder: BINDER_SET_CONTEXT_MGR already set 05:48:10 executing program 1: inotify_init1(0x80800) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x1) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:10 executing program 5: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000100)) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r0, 0x800448d3, &(0x7f0000000140)={{0x6, 0x6, 0x22, 0x0, 0x1000, 0x4}, 0x0, 0x5, 0x40, 0x2, 0x9, "acd122c792ca0a00438fb8376892e1be2dfe7dd01748251df0c6d6a35328ab4dfc4983c51135e49d36a9563d99a43b1048218ea049599e944a83246f91bc2c02259d4ec0d2524753d310bb18d3e09a30e913fd77afbb63f2757bc0ad391ff879e136c4acdf9ec3c1288240dd1758c6031796dce4c39318758bd9184b46b1ce21"}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = gettid() ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f0000000280)={0x26cc, 0x0, 0x2, 0xe343}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r1, 0x0, 0x0, 0x0}, 0x30) [ 712.961180] binder: 12166:12167 ioctl 40046207 0 returned -16 [ 712.973514] binder: 12166:12167 got transaction with invalid offset (0, min 0 max 24) or object. [ 713.016515] binder: 12166:12167 transaction failed 29201/-22, size 24-8 line 3241 05:48:10 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 713.275483] binder: send failed reply for transaction 32 to 12047:12055 [ 713.276846] binder: 12179:12180 transaction failed 29189/-22, size 24-8 line 2994 [ 713.304479] binder: undelivered TRANSACTION_COMPLETE [ 713.312409] binder: undelivered TRANSACTION_ERROR: 29189 05:48:13 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000006000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:13 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) r2 = fcntl$getown(0xffffffffffffff9c, 0x9) move_pages(r2, 0xa, &(0x7f0000000100)=[&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil], &(0x7f0000000180)=[0x94, 0x6, 0x5, 0x4, 0x80000000], &(0x7f00000001c0)=[0x0], 0x2) r3 = dup(r0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f00000006c0)={0x7, &(0x7f0000000680)=[{}, {}, {}, {}, {0x0}, {}, {}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r3, 0x4010641c, &(0x7f0000000740)={r4, &(0x7f0000000700)=""/37}) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000440)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000780)={{{@in6=@ipv4={[], [], @local}, @in=@multicast2}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000000880)=0xe8) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xf, 0xa, &(0x7f0000000280)=@raw=[@call={0x85, 0x0, 0x0, 0x2f}, @initr0={0x18, 0x0, 0x0, 0x0, 0x57a, 0x0, 0x0, 0x0, 0x5610000000}, @call={0x85, 0x0, 0x0, 0xc}, @initr0={0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xab5a}, @exit, @jmp={0x5, 0x7, 0xf, 0x0, 0x4, 0xffffffffffffffff, 0xffffffffffffffff}, @generic={0x58d59fa0, 0x9, 0x424, 0x3, 0x40}, @ldst={0x0, 0x1, 0x6, 0x0, 0x9, 0xffffffffffffffe0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0xd74000000000, 0xaf, &(0x7f0000000340)=""/175, 0x41f00, 0x1, [], r5, 0x7}, 0x48) pwritev(r6, &(0x7f0000000500)=[{&(0x7f0000000580)="ecd25446bd250193bf0bb05927a46c2430332982e0b04181885558082d28792ac5c4bea5aad1674844bc5dc5497e6ea2cec41d53a6054aa3a82e6fde45c21c4a5d5af2d10c006815788cacaaa3cfc82ac3cae52340b02ee04ac1474d75d449f2dc2b3b3b9a12a51bf1f5f0bfc0b4a08a", 0x70}, {&(0x7f0000000600)="ad2160cd954073fc1dc160ded164651025567ad501aa5b2ea7d11ba1773fb8e445eb7a30b98b44a5730e73cf54260020188c03f093ab60ce330b127f85f88b0311a5f10a23e2e62a9e4486148327ab38d558515883d40773d9a6718eb716e66bfe4a0d458b35c490f6", 0x69}], 0x2, 0x0) r7 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r7, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:13 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) keyctl$join(0x1, &(0x7f0000000000)={'syz', 0x2}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7ad) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:13 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:13 executing program 0: r0 = socket$rds(0x15, 0x5, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) prctl$PR_SET_FP_MODE(0x2d, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00000000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000300)) socket(0xa, 0x8000b, 0xf76) 05:48:13 executing program 4: r0 = gettid() seccomp(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x10200000006, 0x0, 0x0, 0x7fc00000}]}) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)=0x0) timer_settime(r1, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x0, 0x0) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000040)=0x1, &(0x7f00000000c0)=0x4) tkill(r0, 0x1000000000016) [ 715.743983] binder: 12191:12195 transaction failed 29189/-22, size 24-8 line 2994 05:48:13 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:13 executing program 1: r0 = inotify_init1(0x80800) preadv(r0, &(0x7f0000000480)=[{&(0x7f0000000000)=""/171}, {&(0x7f0000000100)=""/9}, {&(0x7f0000000240)=""/115}, {&(0x7f00000002c0)=""/163, 0xfffffffffffffe8a}, {&(0x7f0000000380)=""/136}], 0x3f2f89e5264a881, 0xfffffffffffffffc) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x100) r2 = getpid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000001b80)={{{@in6, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@dev}}, &(0x7f0000001c80)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000001cc0)={0x0, 0x0, 0x0}, &(0x7f0000001d00)=0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000001d40)=0x0) r6 = getuid() lstat(&(0x7f0000001d80)='./file0\x00', &(0x7f0000001dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000001e40)=0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001e80)={{{@in=@broadcast, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000001f80)=0xe8) lstat(&(0x7f0000001fc0)='./file0\x00', &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = fcntl$getown(r0, 0x9) r12 = geteuid() getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000002080)={0x0, 0x0, 0x0}, &(0x7f00000020c0)=0xc) r14 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000002400)=0x0) lstat(&(0x7f0000002440)='./file0\x00', &(0x7f0000002480)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000002500), &(0x7f0000002540), &(0x7f0000002580)=0x0) r18 = getpid() getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000025c0)={{{@in6=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@remote}}, &(0x7f00000026c0)=0xe8) lstat(&(0x7f0000002700)='./file0\x00', &(0x7f0000002740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r1, &(0x7f00000028c0)=[{&(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000001ac0)=[{&(0x7f0000000500)="e430f7cb750d289d8b4ccd2ba8197d61172e52488c3010006e8c5324e2f7f63c90b4823c34138ce68a51fcecbdb6529560bfb39a5ffbc8eed8e9b22c434f5f7afe475803663f0a54f827b3c51eb84c44d1a22378f9cc1bf7633041ab6ea6a3415430ab83ea12ebe7b0252ea9eb38343d610cfb89b2dd598b8e54f9c7d0914cbc6b092bfbb6ea68e4f0000e8e688610e2c7049cae84629d46463c628082c641c1002bd73fafa037c80d682bfb7896b176acfb2e5393ff7632bae4eeafc6a29df4d94c419419251477b61364d0bd920fe2b53d046b5286b82b256c63d0f1fcd4b3cb68146b7da0ac65d5485469", 0xec}, {&(0x7f0000000200)}, {&(0x7f0000000600)="bc315c707877407ba318e82ddf8e59031ea9caeb1f6293ca2d62656243aaf50d569b06aa0515a311bf629feffc885d1ca9d20d8e591e5409066061d31aa0dde699498fb2599b0a7f14e34eb96568f7f61b9462e5d8b39d5025eb7fb93fd720cbc4ca920bd3085584989ee4a4a5b832a718c5761edcf8142aba34eedf6c88b9e47b92055154", 0x85}, {&(0x7f00000006c0)="20bdb911121dff8d9c6d1e81b1c9bdf3f2f3b1941936217f050fa0bbfc42eeb0057fffe3f9b7095bf890f6db6fd28f1d80db52699bba33c28bdbefcb81640412bb1516121fa7005c0f7b89ea7be315f476d070176763a93840b28c5f66fcfb5917d9081a6f0378241659107aee1846ee3df3d87025cbbfb4765b9da702d5c10d8e2716b5fcfd251236cd748c1fce7e5e28776d6d086e23ee27276b1787bdf424abd40a2531af773352025fe8b48ea017d6370612", 0xb4}, {&(0x7f0000000780)="0d2a0364afc04477aa4e", 0xa}, {&(0x7f00000007c0)="4be7127045a95d78e79cad95dee33195497e11d9586697439dee5d50d806a5cea52308179739d8baa95f5523af41b86206bce784f0a4f5871e4a84684e9c2be51cfc3d3c20b0a69138de1155a1dd740ba673dcb327fc69e66f89b36f1f3543110e177e79826b4eaa0ff56aa27623384c28ca5a2cd4f25c12d2d302d0c8ef81f5aaf0eade4575eddab2318933bca74d4a4f81b4fbe6c259e3750a370ebb4761bdd3d36dd434f79df54456fd0ae7806019fc370715d39abbadc13555a86ec0b91a3126f696f325fbd46f103eec", 0xcc}, {&(0x7f00000008c0)="c82ba8f85366cacdeabedab36c0dee1a0b62e2bb6582404c7f8f3ed058f568671a07e6ec7b9fa5881714dafa04e7c734dac554ec1e79a8a31015968dcb132648faa39f6ccea1a11ad5ef271751aec6111023a28230822351b7a530b88bb23d68e9799b315fb29ee4decf4c7015854f30b4eb63d89157fe324fa572538bc8af6f4585fae3d686af62002d425e2538f097d9749d69f74789e1429a0dd9d95b9fef82e92ee24244147622b3647903405bc8dd045a7272f24b10390ae6fdbd05", 0xbe}, {&(0x7f0000000980)="7e64d465714bc7429a0ae6a9f075b85f684f0e506904440bad32fd29026ddb7bf3f45272e4d4b29a383207028ae76359d0069300a5ca752a805052d684c12955d464e88172e2f07c387422f9011e19dd6f2c0508cfefb449ced4ce293d7d05816e0b1afb170f9fb37c8a97e832fd83d61e800b02d4af2077305bc838f7c0385aa685086279164fa6e6d6a31bf22adc45f8c8b1a39b152d3aa46d8640c81c34197f4790a957ee3ad8759955645fbd629998f0ce83611186986d7063464c8b61b939f5710294bbadf3931c1ca222c27cbb2d976a287fe3284a9cdad83c086985e0578577c25ddfcd7f31f75db1df", 0xed}, {&(0x7f0000000a80)="a6f146797c1ccf208108882944f8bdcf99ecdf6217e7d22e848f4e4c59319cebeabca1f41517dcff21ab60888765815fd34402364cd3ebb49460a21c5f457eea92726dd5de327fc18fa3d47d26c2338c242a3368f302dc48fe82211ac606b6d445be432ef75fbda2aec2a7dea04e69695e2328ebcb29d3295305e28a719e3ad855dbe04ef2b404e3097a957e689216800e2696df9d905ce1ad860337f8b1da6a809c1cfc8874eabfb624c2ab23b0f208eef11c176d6900ec1457da942ee22796fb3aac13e9a46dc91646f24acdc7d86a80856c6d29ea299b7368744b0e8166260e2613eaaa38ccc28920e830c96bbd205a9a660bc999b81772b42b86031a7aa982dab5fae6ae9673b0ea8310ef47eae730d750f81761fa9f6cf21e0d7875ada933717e36604a3678a1d71a17fcc97721e5cd9227a478170a4280d099781e3ef5fc3d3c4ac02e1586c16e39fdbc4ec8671974b4b1ea5455322608a615d9ef9f38e7969d25b3033be72efb3f26d195f335381924b479bea257ad946b985359aed1b86d7491f00f34805b512fe5f74c192ecda74dc423a44e3d16117c1f65ccece787a1273ca913bbdc31ff5c88f82106afce681d8edf78f12334d91dc4c93c8e6234f3f9ec0721b2cec0e2811712346495a21635c4238957ea54ad2e2448519ef6ea8c88411c496159f63ba06b0c47db0cac17898d00fadeb2982d3cda5ba5b0b5e80c3d0121f7d35d85f9f4f4a33833f9f013840ce820870b0d054ee3ce51e183d8fe5bb10a9ef9680fd0396a99d92ee79ea47413f20d3dc994bd7a3dd97885a4b950f6120accc3b4e41abdd903fdff967a74ff99298dae477d1f2019fe2ae36e585fee31ceb974d73baf32ea0d97be3924c6f9b40c8632bf767d4899576d81def1da0e3acc56bdc3030e1cf3fed4b88216bba3c165dbc4c9e1fd6e8e2b7637aca03a7d2cf7a366dde0ea8fa3e199581112ba0a1a3e865bb95f531a238eaff54c6d119614ee9c1b9fe5dcb7be1333a6ec865cdfc516da4b05d4a36df2b64d0db97182652878286d6164ea2c97b75fd1ac1c816b25d1782a0fe0f973981ce7b15ba9c8131102ebba95d65bd85f8b4dae9fa60523ab6a22e4e8b4608d23d6cacf2f349c276db156ea9d51ff501baaa6bc6209446b849b33396dd0831b48eb00003c0db28f1f4bbed0c7ea7cee43a89699df3e1f5bc0abc3e4366810a1c0f37da78170306fe548c0005e31012f0f60e9111346a8580692c959e1c959bcaa60bb40f1aba3fd59fe43fed39790954463ce8f67ac8401b3b2e360ff44d3a795123ccab5bf520563f07b6285381bfb2adcf3de512155ec67804cd58de686ff689281d13fa8b0dfbd1d7a6d8ab59f7aecb882e52e6691c610d390f3c93451750b17c2045f5afbeecfd54a5ba6570389653fd07bda61bf4689ccc7658372e1099263a346584e43bd14388c555c0e3d816bba239680c4c757f28af30eee6ef41fa29c19b0e393a0f12bcd1df1a5ca36779f583b60714569604af708413f4b8023986d489da7ee918587cdfd8d2fa870ef288fc70cac53963f901a2a7169f4265749e8594c81eb7c217db77f216a2f5d0444f927779795f43d5706cfcc0d647fe4fe61426ce911a25a62a48c3168b203c455848ea2de961fb6ef673c0d939111cd6ebde87349b7a2960c7f7698451a01adaa9311d24529bfeb2ff19fc2e0a55834f954c06136b00f86ba21f523113c19710dff50bbf506a164ec444f3ae408fd38d25a3a60d60874cb92669054f6d8514473e0cf441a1afdbd54ab99143ca4c591b4db767c1c14deeb3e2c33a5456d0285eb2bbcb55913585dfc9b9345b5af2960101aaf6f03915bdb458ea693f4ca26b233d54206363f726507061823c54938282dec65f4d1f4ab91d9726469a6297717dbf83ef5b92859b65700f80c6d291c090c0f4122b67567a7417bd4c047c5cd85e39697f8f2870f278c9f9c67d5cabc81da0fc956ab34bc62eeaef16c1e0cb49b8fa51da4762e7d26f696def901eccd4cb05684cbb090253f01ae3804f7107f54760456c7b269136242d064ac0155bcc2a1283a92437598a433f0f1fdf3e1d46895e266d3a8df091518837ad7ed6bf9c3d1c83f42669803fb63304323d1749d419ba1e9a10d5b0a277e76c79098ca7fe656afaa84036d2061adcf0d1f4c579fef6ea7b9c89d7100466c8a01c08ccb6d6a176dfcfc5d09f3167b76081dfb542915199200ded595586baed6826fc7453f31caf5daa160312e413a5261bf7ac9d29d68fd683f56913b345ea1d7e7dc88330a7a7f3e9743fde56eefe456541babab87c32fa5c1e77dcc5a32358ac22e3ce56f21fc477a8b93783bf4aa9041320c425cd9166f3b9c15950659f6f031b89f304c08d742c59307b405f4f3240ea272dbf6db7763311f46d0b5592c1fa1f91d67c83dcf51d7b32e8b901ac1f1cfdb5e5900bbc99fd22838b2f0ab03bdff6173c5d3cad74f4fe54a3a6cbaa4b4e389f12f4f47606b1ed8864ef363a03dd6b4e3420bfe83143358aff116a7f50e0caa9a782a796782efaec25850534c92edc4a58c99432f09f079adf7bb6862ae13fda53c7a6a6828f202fe6ee05acbb0ec25f88cfc6f53f2d6e64a61ead23f2b79471989b2119a39f5bc5eee83ecd3679e633f5b8678df7a8454357c796091461d54de0d1e35373498ab9c5be209832a0b04450bbba2729fa953425912e8d8c97e8d54ef184563037dbafdf880410ccd568b6a346f483f0b412f47a76f79be60965a2fb60b4447ccfcededbe0b06ed009238be7ce8051d9a19a787ee12312eec6767c6a34a5fd4c8435ec356172fb729c79998e0341084204b06e49aa19f9d70dc0b150f5478e77cc67e63703002999db6cf573de0a5cc2b1baefec550a19ba435e63338b910544bc69c6b1233e70ca10f61665c1952b4fac56447678c41444a86ce990d217ca903b1d082c2103ee2399c7ef6690e43a9aa8e8a06fad1109dee8261c339289d59f4ff32f072df6199d0c443c7ffe062bb1e3d62ddc09c52faf2b4f6032ec92e32a717f5557be9046252d3e9c249258c313391a19eb3d65812a1255f2e5a244ea251753eabad07e96b4790c3cc86b90d200564afe83f33d3a3cc471f5d089c6db07f61d36b7b051051a53c1e8e3a318a83df10f9d35badef5c411c3de3453f18abde819674e12047bcf11ba34c36c447a64f53d6d7fe4ac1c0f95cd3dbf4ba4a80c0bc609cebf4988fce287b3c62172cbaad0fcd3268652327a74029ab4d195808fe4b627fb41f7dc13d9d524efc7688612cfef528fb2cf5d8db7d6eba6718e2f28622fd1737138ffe43abf9946cd7f8ccf9e9fb0aee7db4f3c6c38dae45b16eafc88314d9f95e724e74a266a4ce38acb28c4caf23071ad56fa57b5ebcf17948e4aacdffbb2d13e9e5e7b759829c72f9372320c4ed10e34bb2754f78263cb38db42335900f7e0da109ffc71dec2aca77407937c09f967f4714e48faa4d7f97534615c1c39e6c2c063b412f877ae3807ce835d39650e4dc97576efa1b2cad6f68bf1c8aad55b565311a684561489fe8b2b75431c3ef86caf8103a7e7093647b284b240951cf583f578f1784c6084b3df955c2ef04080b64b2f82529583148a75ff9b69afd8b3e6e5224b9e0fea5935336f221a6d25091e64e6928a564f5985b4b50a58bc24b402be41f9f74164eef789d023d8c0798b8d6b0ffda4fc108e9e4bf7592774c6c3bf11752aa951aca8eea7e99ca7681da2a9bfa17835ad69f5ddf8cf77829b8c157ee26777e06e2bad5442d42aa0f1467476e58336bb65067a3191cfce8f3a287fd4fc6854ff446e134805d3743ae3c8ae18fab908c618a5715c7236b40ab28327ff71817d82857a92ee2527283789e833bbf26f9ef3833b64411b323002b291239e83ee92a57bc645139a19b50bd29602b0e78d23fc873bb6ded8a032d93dd71f7703540a1fe4bf64c729b2dafd3f290022ce323d636e1cfa5b9ee78b7955a800d1bb5583544b79262d32b3e0ab06e59392ecb9440f6c444e5abfe1574b71ab471d8a23f85ccf19abae0029aa47b63c09602ecdd7b73500b0839f85dbf9e29f28d50657e27558c2420169f6c855fa9b4d25f18bf93d44168e4e6f27ce52df536faa75c38b5d6a8d315e640b8f66e51b4ee4cc701f4ecc149d2b836b465a7264c7ad76d9cdf654bbc3f9ce516e5e4fe9105b2438c48dca28b93a22f25bb588735e953dd2033f306588fc179b0b8f0cf304c5466be9237e4492376c6fd3f8333cc9724a40db149bacf283e49d643c5183af6849bb439a37df917deeec4d1e0cca76ecd1777995db49d85e42e043bed3273f13f841ad04b4ccb8d9fb9b1ef72725ebc096824535eb1c54f21a1234c4de53f5ca573245251706401cb9247c8b70523be6a4833d9a13f632c9763534637a7a17e69e9dcbdf55f5616e22b26a3f64bbc00ed910461427b9c48018fba4cc3a634563f498ba78086d4cc8010560782ebe8232583d29f917ad4bb1ad91322b87d871c481185dd19cc412e6137e544b8b991dfd26b67760b3bb0c26fbb74416c40df232bd747eca16e35a1fe11778d32503a821d05ed2263a73176113cfa9c3d33b2d1e36a617b0a9264371cb8f2d970b2261f73cbe5c574f1ba8d51b9700c54eb7b3bef570fc401b05ee8453a32cae64d168abc0aeaa87f85b179751632730d6bae37195ea4d924b5c965a9506fb0641fb26a0a565d4327f57aade0123d2a8ef6ad1de303575d8614f6d70344a14e75601f289b8f9d7b0eb5c19ea267e205f1173132373d87fb4d5cac51b79a90e623a99e11b4aa8bdb08ebacc8b20fdbf996874de8e311683b43112056367a4650a744b4500c987fcf5f12e9a8f8be1a0776db2416eeb9c3c963d55f80ba2f4dcb3d6cee60be879651ceb4862130fbdc61a7795093ccafe7dac71643eabacd7a136a5ecd3089aaff9d78c58f4c406b96d737e623999bdc98c263cc8b18688d212792732d592d1b203723dda84a78d5af612b24a073e674c0d286bec473c4051e1833a16652a88c377510beefface5b2016c97752c9cd4953c74b0b1854a89ad18afb435402153a9197df7c458bdf59085f7f946c06d1c8e994287019f174dd52c15d5a8ed1c1f1b4a017563c3420da886767af56a4c44fc840f908cda08c6739c3d29985ff49afd7e5b0ebe29180bcd67d19979add96ce7ad727d4784c8264fe4e6bf44456500865c6ec086141f759c69436e7a059c330ead040c314b53a3f87d10c999a8f5e22936408c702f6e30d768572deea58499b458bb125ca684d569fd2ac63793e25d0112955635e4579751a3eb99eb50d7914527f244d920f5c977318c21f0a481c6d7b2a3c3788a6f27cb0d9a41990766ab2f83903650b09825e19681bbd0473df4deacb0d3781342e39478b5913c49129f078d8e3455fee0c46e8526704fa6fcfbb6bb76e7d812990a2360fbead14386d76b59b2943b46144d1337912a6b3dfd2b68d5e86e2fd6baae5eaa6acd8957e29d1b5b551763f816f52a56eb47e3912aeaef848c5ab8142b7bedb462f80d19f5ded88fb9a7a508ce1ef6c3a9dcb02a434f312a1cca281585ebf8e8c441911275aa865ebdae3df648599a83bf4550f3ce860acf9850261b61c1d4579e83ecbd1cde61ee0c1b518ba9173f39a2e11f09e02d5764e765ded7d782850355afa4c5c4f8d0b543a75b995bfc0c6c1836eefc1a5f8e4b1910df58acd769ee9f4e735f801e036df009bb842d53f48ed4693794efe0004c7ed8a873c055ebfc0e16b", 0x1000}, {&(0x7f0000001a80)="c627b1e251223c01a94cb1ea26434d3c288df19e7291a05aa21d20398a9d954c687dcf", 0x23}], 0xa, &(0x7f0000002100)=[@cred={0x20, 0x1, 0x2, r2, r3, r4}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r5, r6, r7}, @cred={0x20, 0x1, 0x2, r8, r9, r10}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r11, r12, r13}], 0xc8, 0x4000000}, {&(0x7f0000002200)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f00000023c0)=[{&(0x7f0000002280)="7776bc2a9e519d64b453f85c9bb6b1ef8554fca824c8b2f290c92474a5c330ca5547aa838e77941b94453fa603919b504bc5bbcc30ecc3ea438cb6ecb8f2d493a5316c245aa976a234f07d1541969bb11be806509f34bd618ea7b13e3082ed37cdbbe04044d2ba03c793b9070ba08866678b6ee2126271f54bc6b13e84db108b505b4e1ca226f9e73e5f964b9e7f84fbb85456310ca4552e83382a0bd3307c53c5e2cf72e07617c2c8b8e5c1d4078fcc149707839fbcef5d8e8baeaa2d414a011962619282e9a48afa7c0f1d0f513eda21572cc47d5014a5cec49bf381998653e4", 0xe1}, {&(0x7f0000002380)}], 0x2, &(0x7f00000027c0)=[@rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r14]}, @rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r15, r16, r17}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r18, r19, r20}, @rights={0x18, 0x1, 0x1, [r0, r0]}], 0xe8, 0x800}], 0x2, 0x40) r21 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r22, 0x8912, 0x400200) preadv(r21, &(0x7f0000000480), 0x0, 0x2) 05:48:13 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:13 executing program 5: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGVERSION(r0, 0x80044501, &(0x7f0000000140)=""/107) r2 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000ed070000002500000000000000958f000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) write$capi20(r1, &(0x7f00000001c0)={0x10, 0x10001, 0x83, 0x81, 0x9a, 0x8001}, 0x10) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) r4 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r4, r2, 0x0, 0x0, 0x0}, 0x30) ioctl$CAPI_GET_FLAGS(r0, 0x80044323, &(0x7f0000000300)) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000280), &(0x7f00000002c0)=0x4) [ 715.932571] binder: 12268:12280 transaction failed 29189/-22, size 24-8 line 2994 05:48:13 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:13 executing program 1: r0 = inotify_init1(0x80800) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f0000000000), 0x0, 0x0) [ 716.064421] binder: 12316:12317 transaction failed 29189/-22, size 24-8 line 2994 [ 716.199491] binder: 12324:12325 got transaction with invalid offset (0, min 0 max 24) or object. [ 716.224178] binder: 12324:12325 transaction failed 29201/-22, size 24-8 line 3241 [ 716.435235] net_ratelimit: 16 callbacks suppressed [ 716.435245] protocol 88fb is buggy, dev hsr_slave_0 [ 716.445360] protocol 88fb is buggy, dev hsr_slave_1 [ 716.515171] protocol 88fb is buggy, dev hsr_slave_0 [ 716.520340] protocol 88fb is buggy, dev hsr_slave_1 [ 716.995128] protocol 88fb is buggy, dev hsr_slave_0 [ 717.000202] protocol 88fb is buggy, dev hsr_slave_1 [ 717.075163] protocol 88fb is buggy, dev hsr_slave_0 [ 717.080238] protocol 88fb is buggy, dev hsr_slave_1 [ 717.085396] protocol 88fb is buggy, dev hsr_slave_0 [ 717.090454] protocol 88fb is buggy, dev hsr_slave_1 05:48:16 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:16 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0x1, &(0x7f0000000100)='\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={r2, r0, 0x0, 0x0, 0x0, r3}, 0x30) 05:48:16 executing program 1: r0 = inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000000)={0x2, 0xf1, 0x3, 0x100, 0x2, [{0xff, 0x1f, 0x8, 0x0, 0x0, 0x800}, {0x5a, 0x7fffffff, 0x1f, 0x0, 0x0, 0x1008}]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x2) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000100)={0x79, 0x0, [0x0, 0x5, 0x7, 0x8]}) preadv(r2, &(0x7f0000000280)=[{&(0x7f0000000240)=""/48, 0x30}, {&(0x7f00000013c0)=""/4096, 0x1000}], 0x2, 0x0) 05:48:16 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:16 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x8000000000060ff, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:16 executing program 4: r0 = gettid() seccomp(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x10200000006, 0x0, 0x0, 0x7fc00000}]}) syz_mount_image$ceph(&(0x7f00000000c0)='ceph\x00', &(0x7f0000000100)='./file0\x00', 0x3, 0x1, &(0x7f0000000200)=[{&(0x7f00000002c0)="e76ed28abf2cdf19c85f2834c10c00e486503bc781aef57dc1e5328923aa326c692d4795fd0fc24f6e2f268f81e4e509487d337bfd9a3768bef79e9bbaebf5a93c91dd169d85460ab429cca83f25ad7443eb5bd82314bf826fe68d3d41b01c7389ec5697d0ac9ebc43988b1865e0134ee7936fd08b68c099d16fc5358ee4d5217d7b2c96cdc305dfa56353aa1169e41473a472afd8e70cf1fa038f5936ac08328b4024c0416bd1356f229a4335aae8f74fd2a8c99a3c13446b43c2481f33d9cd2e2257ad5de9947514345bd68ca9bc96ab03be5ea2b193d7b7e27e9ec793e15bee287c18a6b79e68c238fadb0443757fdcf9883a716b9bc60e787a15e1e63b78a9c08a0fb6a3b0b6d0f2a6d42c241ef7001755bc33f970e8a145649e819aece681309ae19b185a74c8e2cce0faba3478f5889b2293e4c2778bf2efd8a69a8a6d531cf94ab577f44a12664ad5de323202830d39815cabf9bd9191396b083f7923f9f57f92c8a4df496c548e420a44a964269d9b64ce6d472de5a19163f87b44440dcb8c893f7e09cb3bb6feaa32bb6124f96f1d0bce9287f6a402093b7d476e7522854a2ca657b93af3986b20d340ea9176a2b0b04028e34fad6aa8f021600323ab063872c272b055e11075acfaaef445cb10e5afb2606787ecf3e048fa8376806dd6f78a811c361bfb626e75a1a19672dc1332537959a46d0014d4ba04b048aba3228f1b69a181952fd9bb69c57657f69a1d94d7c6b73636dc8322e652e2b6456a7cf4588fa7403d0bea43761fa34e5729d824e82fcd2dd9cc7d1eed54c7f821992f43419a591769c3f430073dc5abd9fe9fb3bfa1a7c9c152039c09c604e619715698f8ad3bc5c11db9c5fb770823007435bd0140bd22a12f9fdeb2ed3cb113926d33987490bcb55c0b301248de858dc24047892476e7c8c2d951b89528649db6d786ba91159d3c1f70ab48612bbcb2617d5e6d4165da292080d6acd0efb4737dcc3a815cdee527e838830ed135aeebb61ad7c3da830c81c4a6450391d0cf71c1f8a6b273b73f0deb409df2b2df97e925e086cf718d0d301f8bbba422aad322b201d473be4a8f148f9a570965eca8987e4cec2a587de5ecd9f221da9d9f448619f1caf2c15b2c4b6a375aae8f0f78624928da9609227ef71f8a890a0a01ff3c7fa5f1caa0ce36f011c6592331c946d51a2169b4ad351f26e23e0a12ed783e549988ae6962515d99b4f8d8c92ee5fce630c713ccf21d2466078158479563efa5300f1658199b31eb83fb7fd96d22b4a69b2d8fc67d370848a84be4d6acd24bd8a9bb8bfc0118c1f92e0daf30ebc72be8abef58e2668bd22ecd58dcb387da4fb6a8e10f261221af477eafc3e0f17a53da11193109eea40bcac8799c7b8a157abbb642a41642e44e4838c35178bff2f5c9e1de047445fbaee410f47c1b392154b96f700d2c272bc800c98aab8ee50c3b49c463b1149ca29a3c7e388b796a680f539eb6beae9d08d2c6fd4e9f1c8991e50f96fea17d5228e2193e4b8054320590e63841b35cb33f3e7a598dff2aaba073db50b2f86b24453b3604e5815dd47975eaf8aa3dd3552eca4fff9da8d088456fd8722e5f75209887391dd6df2aabe52b6662251fa273325b30514af878ebe4bb187d54f746264674fe69a2e9d4a166434ed5de6f292094a0cb3dd953229c57ab4a785c7a2ca3cada14fdcb177635d1e19c3e43e7061e2b4df0e8935353bbaadbc3eb65e250e335c3dee65c62b11da38de54844b1a59aab5a68d6f98ce4590fa23cfbfdccc98d29ac11218a7ce7a02490aba068999589e337cd54bb3cdd47f6d3b537cdde4f920154e9819f377c7d9980b916ffe40df381c9837501465caf1853c66e757a9931a98a976d435230ed5903a7083cb115359236cd5adc3d3233c9efb5c7be1025eac0705d05153221d47fc226dd2425b6b6b359cbd15cefe64a7c11f436e4d495503b1ba3422178456fcccc88ca3c2021d04de4f27177856e3a2447748f3dbc29c5f12a7bbada540279ea203abe6e1f98145d3686c4c2c51a9ee73b5e6f3f931c5f40bb830947eb409adaac45d226c5dd7d00648f0dd595465b31b81263520fd9244392547140dbe9b7aa4f0bd202befceb152047da6636d0d3d14a2913d70b2edca2f302b3bad039b6a5e74cf786facde14f22da1ed0bb67aecb0c3b9af94a00205c120525306ec4b896ac7c9747f3f1704249d299448029f6d17491d24708d2b2fe4b92fd117dd07229d40a08138cbc7d80f1c25abfbb1123e222e5860cb1f710e37646c1d6f8775388835e25d4eb3850b2c13ae7b1a3172e10c987898e38c25950efd8035cd65a4e5ad0b0abf593719d220219f2e13d01d655dc62876bba7349b367233df1ccb774ca0b80b543996f69036c8408b90400a3ecc670ecb6d943dd50943b6c461f9a9413d23408ad12e84b2a8fbb20b11774860ab21e73329ce676043a8165ec00402b86981b3782f5820c7f73e39e69b8c7cd72c3cd60ca48e443601389e9c43ad736171f1f0883012bc37d6e30dc06dc6c9162ef5fa872b29d98bc631fa63647f03990684b7e82ff692b6d4cfa9979842a6e935997e17998d72634212f2efbf59dcc84b7bcd684eca27d0c67218b89f6d7df1565d008d4dc1ae52a91134cd7a65c35b38ec34d20a23ada48b0cb01feb33f6d273ebb2b04237d3aa49c43da1e2d21b1aec9df876d9c2b4322d464d949b88573a2203e26258fc51b27ba705c44122b5adafde59f3881ef058080c1ff7a2400816480d23fc6688330d96172993bdbd97f6613a395126d8ff6371b65985c2c6a16a5070919dc42632367cdd2dc99f6874152937d5b94536c345af6abf9eb5b3a6573fb2858f3acba7436fa2dbdf36c32b1eead813b7f625c427ae6d84bafded8bf72758f5f9ba0616b7f007778c84777463da7c2866e4f309efc4b70f43b7ca222f1a2cb9d8e5c24acbdc1bd3b74633bd4be9f2c999f7684ed467bfb9565ccc96f16aeca94e1b3c944710f1adc5bc2ac7cc7615d5602a2be690804afe4073f552842ee29bc9820c296ed4dd6fb70c26cd519a3d5021ff594c0837635875a4724f2253f9c268f404e2a8fb4d176561a2aae47ac2952b2e20d450ce9152f1855360e7dbf83f2503091d27bc64298f7f2788805c2a5a72affb836f11448233d5209ea49ee9c32ced5c6e0e60f1ec26eb67bc5e656b2feac4ee0862581c0b41a9acddd1eb51ae915079d209c7d349dc5a3d00471f4b16bf26315bee0ba03e7c2f40f1f785f9a3815c33facd7b5521f6b4a72ec91a67d3d7284eb8bfb3a21298f3cce82f95b1af42254c535d97eb15df47ca829ba0dda4e931168a320a16027f43b31ad988cfff6e184b9e401d065bfd03c02e08f36b74d960c7647b2a2eb21b9c7530f6c2709cf09a03b7bcc28aae62bf778e5908d6dabbc014b2fe3e8e64f7f9a31002eb1854f9bf61bc8e1b2a5317df814a9a9e215201332be5b91b0405a6c2df93f1417b4fd2eccc837d62036ecd5758ae99c400ca4948b0bd98247c8404b365fa0c6c0eeaacba8395cd235ee67505e03b8b328750acff918e9b44be8687af3291de5257cd88e7169084095dd04c746f5a8da0355536a040d1da05d7daec2c5243484433378d37693ef1f53543ec39c7375321cf4ada6a5ba76c73c4eae4cd66018f39bbf5a7fd5a85359ce17ba20177e211576b7af488f89202c85779db82fe11c24e266cdfa4d869e9e4d5f549426ed1f5b19c87f593ec633cbd91c159ea8fc75551f9553edf778f6472a1bb369310e91b62eae771e3a3f37c63d1de662cd1a6a885c2bfc07e0ae09f1a0235ab3bb6eef9f5b4b24c51fe36244dc480afd47672a587477f7d3dd77306aac8c9b1d19aac1a0716eb6a0ed36d03c86043d2b2a9dcdd8c5fda4c45622f82759423802b80c79449cc30d9f5f68bdd308bc49ae755129f74f4f054b1d24a79e86c13f82a5a271ca0f772fba9bb776f155c5f659fd5473675ef5a683fcd789e3e3f575a03a4d2af62aeb5e778cad850368769190cd86bd63cf4ec2826d86a085e6febc65c79b476ea69a6ca9605bcdd419823255eef49cd62f5fccb6e6af259e60223c4088335210d64e5831100c6759a1352148a345657ef552dd4298eb9de91ef9875f11958e1bd35c07d7d98274306954aaf038b307edd123d0cce46f18b5789a12620af7d47862abbe0d6f84cfab52c81796e469077c9f512da97e03e433a99c19470027f6610fc20d044a242ad255ce4662702816e8aa407857db6802f8e76c3035a4102e5a4670baa6108605e00da9c2d233b83b2ac9eb5e03ba284970783a3a41c31efb0c0d6f63370978b558dee02d6d7ce5b6897e0ca5fc83d28e9728429a6be4e6f1b4740289318ed55ad0ab2341ac00db14eae5d4b606b1e980baf2cfc7f094853ae6d9da1ebc9b563bec6e4e79b08ee5816ceb7f28de13689c63b21d49784a97ce9f2b82cad1c40350831c0fe40165bcb896444f21cfc4ff2bbaade0f8bebc19788273a2f883fc0fb3da37cd455ebf2a8929db2edcdd7f2ddb42482375c26e59c87ea4806b6055049b9d2c15534144261cb7de30a60c930e221c0aa65c3e8403c421441eab6b6fb1cfbe4fbe3bc143757d15f662b0057c406c55ed0938777102df4496215fb396132e4015cdcffe4f0f988b8642789a551a78a604685c7e4123579675eeb17ee71d6c26b8833881a8ed767083044340af39e262e579fd47173d8627f835ad9232530f149b656dc509b1bfb6b119c7e05387fdb312e426fab87a1fb1adf273156f6fbc88773b7e3c41bd7d8935de253be042f5c1adadd01e5300b090e31a3ac4958a5af228a87746cdbdfe2c95d206c6a84de7347991b01f4f8fb3e281a2c7ae7c4a0294303e71c544797d47d1362466099d9599d9f3320df906992fc348d73c394d01f4c57a7964b60a30f8de713751107aa2fcc06955dc749637f2063661b618fa67c4522bef0084e982ba73226044570d9aedb7d61e4d56d2915072fe3a8987f171d5aa98f9702b78efb06767ed4322aec9a7db272fd9f52487fb37454fe71f24c5ca6e1bfe40e7489ff7e8a3972f81cb5016c3d1cb38a99f4e863291088d65d90c38302bdc6e6f2d263068718c89fb354cf681cb9b12d6380c05276cbfd76758670a5cd5b65ab2f4a5e89d0cf62e3eb8df35c3b27c415b3dca8af999162eb4969bd4a2db1a4c0409892e9d8916bd9723218234c3135c2dbe72732f1f03959c031d9357bb3eb0fa647998b737a97897fc04f564f72e054b7e605621eff2c0bd458904e752a4c1f37b7384afeb26eba4d5b1b4120ef3c3fb85aa5b7ba842fc5560fdbf0ba56abb992d2d7b41270626b544b414a44aeaac1afc6cf55c6ca55d530ae8d2bafd35dd77dffb6d7f4edcbab66334b9f91f5b67c9f3f79331d3c84348be4cf6bc2e69730011dc652bdd51e3f54141cf71cb5a8344ac69e415930e07e150899fd5fe930fae26b545e9e29685ced12efa4268a34e704e72bd52c724239c297562c350c9ea216ec393479f0615f2dffe6b73b853f77e0a8a1bd64e8add4cabdf98b8fb34252fd2ad4d8f3cdac56897f8804e9f22328a8a3181644b1c4910a638bde7a2891d0eed74238df600561c99b630777eb5f72b1915278b2b4d18e853857c30e23470c3c8089535472bd303b20637b2b771f7c1a30b569fe9b0bc75ffc7da5d8955c081fab23f2d816eeb493c947751bbc4ba4a4c10af1e08d58270b8d8e55315102e2597443d2c81d2affbe9a3c1c5ec0a2ee4100fbeb557", 0x1000, 0x6}], 0x10000, &(0x7f0000000240)='#vboxnet1^}\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x410040, 0x0) getsockname$inet(r1, &(0x7f0000000280)={0x2, 0x0, @dev}, &(0x7f0000000180)=0xfffffffffffffe22) timer_create(0x0, &(0x7f0000044000)={0x0, 0x24}, &(0x7f0000000040)) socket$can_raw(0x1d, 0x3, 0x1) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x1000000000016) 05:48:16 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x7, 0x300) r1 = syz_genetlink_get_family_id$team(0xffffffffffffffff) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000240)={{{@in=@dev, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@local}}, &(0x7f0000000140)=0xe8) recvmsg$kcm(0xffffffffffffff9c, &(0x7f00000008c0)={&(0x7f0000000340)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f00000007c0)=[{&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f0000000480)=""/157, 0x9d}, {&(0x7f0000000540)=""/186, 0xba}, {&(0x7f00000003c0)=""/50, 0x32}, {&(0x7f0000000400)=""/37, 0x25}, {&(0x7f0000000600)=""/7, 0x7}, {&(0x7f0000000640)=""/171, 0xab}, {&(0x7f0000000700)=""/81, 0x51}, {&(0x7f0000000780)=""/44, 0x2c}], 0x9, &(0x7f0000000880)}, 0x10000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000006980)={{{@in6=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@multicast2}}, &(0x7f0000006a80)=0xe8) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000006d80)={@dev, @broadcast, 0x0}, &(0x7f0000006dc0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000006e00)={{{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in=@initdev}}, &(0x7f0000006f00)=0xe8) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000006f40)={@initdev, @local, 0x0}, &(0x7f0000006f80)=0xc) accept4(0xffffffffffffff9c, &(0x7f0000007080)=@hci={0x1f, 0x0}, &(0x7f0000007100)=0x80, 0x80800) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000012900)={{{@in6=@mcast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f0000012a00)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000012b40)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000015a80)={{{@in=@broadcast, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@dev}}, &(0x7f0000015b80)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000015bc0)={{{@in=@multicast1, @in6=@ipv4={[], [], @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@local}}, &(0x7f0000015cc0)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000015dc0)={{{@in6=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f0000015ec0)=0xe8) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000016580)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000016540)={&(0x7f0000015f00)={0x624, r1, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [{{0x8, 0x1, r2}, {0x1d0, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3d03}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r4}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xa8c, 0xfffffffffffffffb, 0x9, 0x800}, {0x0, 0x6, 0x7, 0x2}, {0x100000000, 0x40, 0x80000000, 0x9}, {0x8, 0x0, 0x4, 0xffffffff80000001}, {0x80000001, 0x4, 0x0, 0x4}]}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r5}, {0x74, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x20}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x87}}}]}}, {{0x8, 0x1, r6}, {0xbc, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}}]}}, {{0x8, 0x1, r8}, {0x130, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r10}}}]}}, {{0x8, 0x1, r11}, {0xf4, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x80000000}}, {0x8, 0x6, r12}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}}]}}, {{0x8, 0x1, r13}, {0xbc, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}]}}]}, 0x624}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000) r15 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r16, 0x8912, 0x400200) preadv(r15, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:16 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000100), &(0x7f0000000180)=0xffffffffffffff5e) r3 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r0, 0x0, 0x0, 0x0}, 0x30) socket$packet(0x11, 0x2, 0x300) [ 718.972672] binder: 12343:12344 transaction failed 29189/-22, size 24-8 line 2994 [ 718.990113] binder: 12341:12349 got transaction with invalid offset (0, min 0 max 24) or object. [ 719.004563] ceph: device name is missing path (no : separator in /dev/loop4) 05:48:16 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 719.071095] binder: 12341:12349 transaction failed 29201/-22, size 24-8 line 3241 05:48:16 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:16 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KDADDIO(r1, 0x4b34, 0x5a9) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 719.228251] binder: 12363:12370 got transaction with invalid offset (0, min 0 max 24) or object. [ 719.251493] binder: 12363:12370 transaction failed 29201/-22, size 24-8 line 3241 05:48:16 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:16 executing program 1: inotify_init1(0x810) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2e4639f77ac02a14, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$RTC_AIE_ON(r0, 0x7001) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:16 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) gettid() r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20ncci\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000180)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r4, &(0x7f0000000480)={0x13, 0x10, 0xfa00, {&(0x7f0000000280), r5, 0x3}}, 0x18) r6 = openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x8000, 0x4) epoll_ctl$EPOLL_CTL_DEL(r6, 0x2, r3) [ 719.321426] binder: BINDER_SET_CONTEXT_MGR already set [ 719.341324] binder: 12376:12377 ioctl 40046207 0 returned -16 05:48:16 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000000040)=0x1000) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:16 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 719.549873] binder: 12470:12488 got transaction with invalid offset (0, min 0 max 24) or object. [ 719.569151] binder: 12470:12488 transaction failed 29201/-22, size 24-8 line 3241 [ 719.632932] binder: BINDER_SET_CONTEXT_MGR already set [ 719.653932] binder: 12496:12498 ioctl 40046207 0 returned -16 [ 719.662808] binder: 12496:12498 transaction failed 29189/-22, size 24-8 line 2994 [ 721.555164] net_ratelimit: 24 callbacks suppressed [ 721.555174] protocol 88fb is buggy, dev hsr_slave_0 [ 721.565288] protocol 88fb is buggy, dev hsr_slave_1 05:48:19 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000007400, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:19 executing program 1: r0 = inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) sendfile(r0, r0, 0x0, 0x80000001) r1 = fcntl$getown(r0, 0x9) r2 = syz_open_procfs(r1, &(0x7f0000000100)=')\xe9\x7f\x82\xf6P\xd6\xff`\x0e\xff\x15\xf7\x19T\x19G@i\r\xdd6M:\xbc\x91\x8a\xa6+`6xR\xfa\xac\x1f\xc6\x93\x16\v\t\xa0\xe4\xfb1\"\x19sxa\xceG\x0f\xfeY\xc1R\xe5]`\xb5\xcf\x14v\xcd\xc7\xa3-4\x03\xfd:u\xdd\xcb\x1a\x1b\x96\xf5\xb6') ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000000)=""/68) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$kcm(r2, &(0x7f0000000300)={&(0x7f0000000240)=@rxrpc=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x28}}}, 0x80, &(0x7f00000002c0)}, 0x44800) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x1) preadv(r2, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:19 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:19 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="8500000007000000fa1e2d45ae3ba3d99500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) wait4(r3, 0x0, 0x60000000, &(0x7f0000000100)) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20\x00', 0x980, 0x0) ioctl$TCGETA(r4, 0x5405, &(0x7f0000000280)) 05:48:19 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:19 executing program 4: r0 = gettid() seccomp(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x10200000006, 0x0, 0x0, 0x7fc00000}]}) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x200, 0x0) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1}) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x1000000000016) 05:48:19 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000000)) fstat(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$get_persistent(0x16, r2, r3) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 722.066429] binder: 12510:12517 got transaction with invalid offset (0, min 0 max 24) or object. [ 722.088311] binder: BINDER_SET_CONTEXT_MGR already set [ 722.105324] binder: 12509:12520 ioctl 40046207 0 returned -16 05:48:19 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) [ 722.117463] binder: 12510:12517 transaction failed 29201/-22, size 24-8 line 3241 [ 722.128635] binder: 12509:12520 got transaction with invalid offset (0, min 0 max 24) or object. [ 722.154460] binder: 12509:12520 transaction failed 29201/-22, size 24-8 line 3241 05:48:19 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:19 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:19 executing program 1: inotify_init1(0x80800) r0 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0xe852, 0xb0000) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f0000000240)={0x6, 0x4, 0x7, 0xffffffff}) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ptype\x00') ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000080)=0x8) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x0, 0xfff]) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) sendmsg$can_bcm(r1, &(0x7f0000000400)={&(0x7f0000000280), 0x10, &(0x7f00000003c0)={&(0x7f0000000340)={0x4, 0x804, 0x7fffffff, {r2, r3/1000+30000}, {r4, r5/1000+10000}, {0x1, 0x1, 0x0, 0xab}, 0x1, @can={{0x2, 0x0, 0x94d}, 0x6, 0x3, 0x0, 0x0, "b60168a1db889671"}}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000004) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r6, &(0x7f0000000440)='./file0\x00', 0x40400, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) preadv(r6, &(0x7f0000000480), 0x1000000000000237, 0x0) linkat(r6, &(0x7f0000000480)='./file0\x00', r6, &(0x7f00000004c0)='./file0\x00', 0x1000) 05:48:19 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x4, 0x0, 0xfac5, 0x58, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000000700000000000000000000000000000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, &(0x7f0000000100)={0x2}) r3 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r0, 0x0, 0x0, 0x0}, 0x30) [ 722.392803] binder_alloc: 12538: binder_alloc_buf, no vma [ 722.421462] binder_alloc: 12538: binder_alloc_buf, no vma [ 722.428830] binder: 12538:12544 transaction failed 29189/-3, size 24-8 line 3147 [ 722.440525] binder: 12539:12546 transaction failed 29189/-3, size 24-8 line 3147 [ 722.675114] protocol 88fb is buggy, dev hsr_slave_0 [ 722.680253] protocol 88fb is buggy, dev hsr_slave_1 [ 722.755116] protocol 88fb is buggy, dev hsr_slave_0 [ 722.760292] protocol 88fb is buggy, dev hsr_slave_1 [ 723.235071] protocol 88fb is buggy, dev hsr_slave_0 [ 723.240160] protocol 88fb is buggy, dev hsr_slave_1 [ 723.315133] protocol 88fb is buggy, dev hsr_slave_0 [ 723.320198] protocol 88fb is buggy, dev hsr_slave_1 05:48:22 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') keyctl$set_reqkey_keyring(0xe, 0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:22 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="85000000f3ffffff250000000000000095000000000000003d872f1de729105d12ed4ec2a3e4f2d88220d5572fb38bca3618c700cbd1e8b2e37ba98bd41ec4db7f04aee36a3a1e4d9c94c1259ed8ea0f89a704e337a49438e51eaae8feb142f3304dfdf51bc137d12932edb3e85ea45d1739a22a52e033a97962ac9c931d078148179c25247c40d8365d54b84898b23a60454cd9a913921c1e04fc7518d1cf709d75118a75e8e80be02f7a8778f2c9d1e5ca0607539853b41a4c15110d761bd9826a5fc6a4a96f72c46dde8d2c6a12f591bbe0425323dcbbaf4d7f10fd7be5ddc4d0bf1ef86da4a2d4ab27ab950ab4cd405d6b3ba4450cf5bfb47b4e3b381738e758d7a79118e91281b5d0ff76801babc8b8f8785dd6658b9189837dc2555e0695885a1f4376269b210e45cdf40effa9f4da"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:22 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:22 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:22 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000009400, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:22 executing program 4: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x17) 05:48:22 executing program 4: r0 = gettid() seccomp(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x10200000006, 0x0, 0x0, 0x7fc00000}]}) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x1000000000016) [ 725.138767] binder: 12562:12565 transaction failed 29189/-22, size 24-8 line 2994 [ 725.164501] binder_alloc: 12568: binder_alloc_buf, no vma 05:48:22 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f00000001c0)={@empty, 0x0}, &(0x7f0000000280)=0x14) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x20000202, &(0x7f0000000180)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000100)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], r1, 0xf}, 0x4935738d622c7cee) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2) r3 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:22 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='stack\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:22 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 725.214469] binder: 12568:12573 transaction failed 29189/-3, size 24-8 line 3147 05:48:22 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:22 executing program 1: inotify_init1(0x807fd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f0000000000)=0x1ff) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 725.360071] binder: 12585:12586 transaction failed 29189/-22, size 24-8 line 2994 05:48:22 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:22 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="85000000070083002ed0000000000000d423ea41c12f3af8e459942e751f9ce7c5ae4c51c904179710659e041ed52679cafaed4af600fa6538361751f9650d1c0f6fd58ea444ffedbe82db5cf5128ebff5ab1cddb413"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={r2, r0, 0x0, 0x11, &(0x7f0000000280)='/dev/dlm-monitor\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0, r3}, 0x31c) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-monitor\x00', 0x400, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4040aea0, &(0x7f0000000140)={0x7fff, 0x7, 0x6, 0x0, 0x1, 0x9, 0x851d, 0x1, 0x4, 0x9, 0x100, 0xffff, 0x0, 0x68c, 0x168000000000000, 0x0, 0x136, 0x6, 0x3ff}) 05:48:22 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) [ 725.491237] binder_alloc: 12594: binder_alloc_buf, no vma [ 725.512967] binder: 12594:12595 transaction failed 29189/-3, size 24-8 line 3147 05:48:22 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 725.678334] binder: 12604:12606 got transaction with invalid offset (0, min 0 max 24) or object. [ 725.694648] binder: 12604:12606 transaction failed 29201/-22, size 24-8 line 3241 [ 725.719648] binder: 12611:12613 got transaction with invalid offset (0, min 0 max 24) or object. [ 725.745873] binder: 12611:12613 transaction failed 29201/-22, size 24-8 line 3241 [ 726.835100] net_ratelimit: 16 callbacks suppressed [ 726.835107] protocol 88fb is buggy, dev hsr_slave_0 [ 726.845148] protocol 88fb is buggy, dev hsr_slave_1 [ 726.915210] protocol 88fb is buggy, dev hsr_slave_0 [ 726.920272] protocol 88fb is buggy, dev hsr_slave_1 [ 727.395085] protocol 88fb is buggy, dev hsr_slave_0 [ 727.400178] protocol 88fb is buggy, dev hsr_slave_1 [ 727.475221] protocol 88fb is buggy, dev hsr_slave_0 [ 727.480317] protocol 88fb is buggy, dev hsr_slave_1 [ 727.485478] protocol 88fb is buggy, dev hsr_slave_0 [ 727.490537] protocol 88fb is buggy, dev hsr_slave_1 05:48:25 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x80000000000e00f, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:25 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000000)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:25 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="5bd3000007000000250000000000ceb90000000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:25 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:25 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:25 executing program 4: r0 = gettid() r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x800, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r1, 0x4010aeab, &(0x7f0000000040)={0x9, 0xf002}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syz_tun\x00', 0x402}) seccomp(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x10200000006, 0x0, 0x0, 0x7fc00000}]}) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x1000000000016) 05:48:25 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:25 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 728.230100] binder: 12627:12632 got transaction with invalid offset (0, min 0 max 24) or object. 05:48:25 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0xfffffffffffffe57) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r3, 0x28, 0x2, &(0x7f0000000140)=0x5, 0x8) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) ptrace$setregs(0xf, r2, 0x9, &(0x7f0000000280)="aaa0407ecff88e25bae65353e947837ce39f240d728290d1bfb301107f21d134298261341790dd992327d647e1d4ab315b7de4197a9ac6020781fe07354fddc39eace541942a169ac3368f7d0940d9cafcd10ed5afba8a546b360a7d420d11ade05cc143ed11c5bc7ce645952a6d75df250f74c5aa935ecfbf40108809aa919e9d382e8e2b72c49eea846bbe1fe4e2c04aed1e85313a9665d61cac979ab1574d66c512b60a22c458911f458dba4550c4d7f61a48fc4ce31db267ca13597df218b625b0ecd303e319846cecc997a6951a5f31f6") [ 728.274555] binder: 12627:12632 transaction failed 29201/-22, size 24-8 line 3241 05:48:25 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:25 executing program 1: inotify_init1(0x800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x0, 0x3) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) 05:48:25 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 728.502934] binder_alloc: 12658: binder_alloc_buf, no vma [ 728.524040] binder: 12658:12660 transaction failed 29189/-3, size 24-8 line 3147 05:48:28 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000307100, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:28 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:28 executing program 1: r0 = inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0xffffffffffffea8, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x306, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) inotify_add_watch(r0, &(0x7f0000000000)='./file0\x00', 0x4) preadv(r2, &(0x7f0000000040), 0x7a, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000080)) 05:48:28 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/commit_pending_bools\x00', 0x1, 0x0) sendmsg$nl_crypto(r2, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x120010}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)=@del={0x118, 0x11, 0x400, 0x70bd2a, 0x25dfdbff, {{'ctr-serpent-avx\x00'}, [], [], 0x2000, 0x2000}, [{0x8, 0x1, 0x40}, {0x8, 0x1, 0x64}, {0x8, 0x1, 0x9}, {0x8, 0x1, 0x100}, {0x8, 0x1, 0x6}, {0x8, 0x1, 0x9c}, {0x8, 0x1, 0x3}]}, 0x118}, 0x1, 0x0, 0x0, 0x40}, 0x1) r3 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:28 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:28 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 731.232186] binder_alloc: 12678: binder_alloc_buf, no vma [ 731.265708] binder: 12678:12679 transaction failed 29189/-3, size 24-8 line 3147 [ 731.275628] binder_alloc: 12678: binder_alloc_buf, no vma 05:48:28 executing program 1: inotify_init1(0x80800) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x2100, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000240)=0x100000001) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ip6_mr_cache\x00') ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000040)={0x0, 0x7ff, 0x29}) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x68eccb68) preadv(r2, &(0x7f0000000480), 0x1000000000000237, 0x0) ioctl$SIOCAX25GETINFO(r2, 0x89ed, &(0x7f0000000100)) 05:48:28 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 731.282539] binder: 12680:12682 transaction failed 29189/-3, size 24-8 line 3147 [ 731.286597] binder: BINDER_SET_CONTEXT_MGR already set [ 731.304126] binder: 12677:12684 ioctl 40046207 0 returned -16 05:48:28 executing program 5: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/checkreqprot\x00', 0x301000, 0x0) write$vnet(r0, &(0x7f00000004c0)={0x1, {&(0x7f0000000ac0)=""/146, 0x92, &(0x7f0000000580)=""/132, 0x1, 0x3}}, 0x68) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="a47f59e5698506000000950004000000020000000000427d17b7000000f3342b03fa0bb27f2cd26269851172fa6ca9737892302a0cd6e57cccc1ff8cbb508319a20b7e1c9570967cb6f94dc561397d282046e37aeef1b4c1f3c21d79aacff4944268db6ca37aa5f78e3a13c577f34a9d08b5da48ea97c6597ca6c7d58d94"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000a40)={0x3, 0x0, [{0x100000, 0xd6, &(0x7f0000000840)=""/214}, {0x1f000, 0x58, &(0x7f0000000940)=""/88}, {0x2, 0x62, &(0x7f00000009c0)=""/98}]}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000740)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000800)={&(0x7f0000000640)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x7, 0x10, 0x8, {0x77359400}, {}, {0x0, 0x9, 0x9, 0x2}, 0x1, @can={{0x4, 0xffffffff, 0x3}, 0x1, 0x2, 0x0, 0x0, "9a7d36fa82dc7821"}}, 0x48}, 0x1, 0x0, 0x0, 0x24040810}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x0, 0x9, &(0x7f0000000100)=ANY=[@ANYBLOB="180000f1f6ffffff0000d000001300006d95002f000000000074fd0011c3ade640644c000600000000000000000000002542fffffcffffffdd660000000000000000007f80"], &(0x7f0000000180)='syzkaller\x00', 0x8, 0xd2, &(0x7f0000000280)=""/210, 0x41000, 0x1, [], r3, 0xc}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) mount$9p_virtio(&(0x7f0000000400)='vcan0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='9p\x00', 0x1000, &(0x7f0000000b80)={'trans=virtio,'}) r4 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r4, r1, 0x0, 0x0, 0x0}, 0x30) [ 731.375327] binder: 12677:12684 transaction failed 29189/-22, size 24-8 line 2994 05:48:28 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:28 executing program 1: r0 = inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000d80)='/dev/cachefiles\x00', 0x400000, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000dc0)={0x0}, &(0x7f0000000e00)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000e40)={{{@in=@multicast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000f40)=0xe8) stat(&(0x7f0000000f80)='./file0\x00', &(0x7f0000000fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = gettid() getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000001040)={{{@in6=@ipv4={[], [], @local}, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) r10 = getegid() r11 = getpgrp(0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000001180)={{{@in6=@empty, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@mcast2}}, &(0x7f0000001280)=0xe8) stat(&(0x7f00000012c0)='./file0\x00', &(0x7f0000001300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r14 = getpgrp(0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000007a40)={0x0, 0x0}, &(0x7f0000007a80)=0xc) r16 = getegid() r17 = getpid() fstat(r2, &(0x7f0000007ac0)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x2, &(0x7f0000007b40)=[0x0, 0xffffffffffffffff]) r20 = getpid() getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000007b80)={{{@in=@multicast1, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@dev}}, &(0x7f0000007c80)=0xe8) fstat(r2, &(0x7f0000007cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r23 = fcntl$getown(r0, 0x9) stat(&(0x7f0000009240)='./file0\x00', &(0x7f0000009280)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000009300)={0x0, 0x0, 0x0}, &(0x7f0000009340)=0xc) sendmmsg$unix(r1, &(0x7f000000a640)=[{&(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000700)=[{&(0x7f0000000240)="eeb37f196595b80621fc4c9839ee5e02fe4d55ab2c165fa690e6876f59f93b2bc0e801eb48b560826515139a2122e0b0d2d71e5b42a8e1147d8908e66aad640f8c9d7f5f83a5f4083a3d7425c09881f9b8cd71f7792d26a58f23e6d3a3b5b79b10e6f22352ae9f3ab3d958e4c43c93d2da59786ed2d3463134b2bda2705cc89d3430a2bb18b0166f2a3271ae1f795d53778760ac9fdcef39686692ace3492fc163804c42e06c4410ae4d544225d709039333b599a03f642164d3dae698e67bd6f1d72a6816", 0xc5}, {&(0x7f0000000340)="233358437230fbaa98be213e3d57261241b4f198416f41bbc175d15918d490cb749a49317401e142c1959a30fe149804c8299c8349c8e46c482839a9420f9d1c5767cec158e12c373c299f4e6c74504fb14ad3c2a541f49620f9ab5958502255d6313498b722ea6de04db2343c04249c82211d68af8269358abeb2850c058adb9c16abc500f0ad677be57d00ac40d39331c01a7d1339b37c5357b9769112363394178137ec174296bd91d198", 0xac}, {&(0x7f00000013c0)="24c7003c63a39f21ca0061a55870f4ad630cbf1315c20b7e7b66914aa7d49854e28e52a1071af462d5220e9b2c34c7c1a31c48b7a5ee69af3afcbfe3be69cc430d47b084af0123a9b9b697a539a21acd71c9fab8d11470d15cfe28cbb4ab91f6a7b9df79aa870d5b28ffa5fedec539bd5e6d03d590c036a0a97ae22fbe96f06a2de4568d194b1d63a6f6925f2279318b2b081a2afd08c21f1cd488dfd513631f2d7002d02887b0c786374f30c762ab34df712e99bfd241d01ccbb9d4db8ddc51ae753e42e0a0ec4a85220576793b0cba46982f2f4544f42f35fd9b4ea7fc778685b39dee78333ab59c1bfaffe2956547f58f7e58546b723bb2caa802e58df1b9c6191c87da302742037ebe7d1a4d5c26d13ada9a5e858350f4a11fbce80051082aec15a57ec2271a0b19e5f0ce4dc8a18f1f027861a09bed1aa3930515595a6d51c6031c5a5ba604bf21eee2356d0907f6e69f9449ec94f584122e06780ce84c0224879d282edc0d058ca1e4e364c10020d92a8e9924e561d3af5f529ebab47225c500b0b8daeff70329c6240f2bdb01197a3898b2f15521f6d9ac2cff61de52effee200c2e4849911f3fef1f52a5b0f4261c8454358835b5f45588e6d1f88be759462c6da2e13fd91919d13ecaf1da8c548be70b7e2822f0b1abc36748dd410827034b2790d2861785e374490b69994deed825f47595f72f2c5bb496c57e5b5f93f6241fd9560085cab75015a36af468ff84db53efd1b94235031f3b91e72f8a8f257434ae0eeb8dab253a4c8ed8b2da54098daa66e708f95f196e59d0e205bd34f3a808c9a531741715d0a97278f8d0169483a08719d3dc251f287dfdad92ecef7230237e90d5ff6e5b786766cba4b58c1389d5f34ac587497d748b97bb9a48f737b31a88d86ba83e24a8c86657c578e6e7ca59e228929f4c20d858edc6fe848c9ffe799d59a0fd88e7fe6ce1a2e501ceab6b41533b5e0973abfb29c862102c822db73cd50b4ab5a05443753a6dce62b7869f38711cebd7773c15caadd1a4b8c1bd5d8bbd54528269e79dfb0a519ff199d9a32bb3c2c4435013d0c58f4d6c604e0beabe7f721e6a941f582ab178bc52627d921133f667cd31680508f36875ebbce3a2d552b47a0b729c7aa2fc5d8b890d7229c883f1024b57601fba0407310e1432f110ee1240caa90f1797b025516eb51a78fecfed606e1e974439788e156a71df0236b30b4a1bb80ce0dd53b00ab68a9918188bb39010115a2a087c874e4386d67b660874fb8725988a595821d48c492ecddd1437ba05e17e860e5e0d2ce1e918ad6014527494be2a543f298e466cee85e49d32ecb1f210694f7f2b7663074a387dfe2f241bb6d391ea2165e8741dcf2b07497b2b2875aba57e2f2081802ab2c2822cd7609d2e63e98d08885df34c6c4b388c911f73b02d2ca78408ef808fefc9e5c163fd53d3834f23237b3031928cd2601046a53802b01d063a233d5005989edb450263df70d70296d00acde4da67a3ef20fd75a52bb74603b3803d65b28c58a9baab0a08882edba92b239d452fe63a2766a6e5316d265da5dd061b74e564e92a5244c0633b256ebce7947cf714ef4d22e2086c5d8f1ed73882b4733a99ec0ecdc61777313b454ba6b8d12f61925d1480d24d116e5aa083f25b3b6def098ff127878255bbc12bb217f87746ed43766cc93489f82e99a3d6a851dccc6b25df1eb9632e18ec105d98d0b63ac03bef1ad40e7148f4ab5534481d81dd00216b5572459021d6d3569a546de476f60a77128d2c74457a0fd95f4c426adf76d27fdc5ac4d5e6420cfc982b898936fde14f3b5b0b390cc206d77f7e68eb958b5cb3b0340f352b816ad866f39230a7f1a0179c27c74c51fe3b56acfcdd34a1bf86b687c52fac7550080f0345310e15103eff8c2f746d8d6f5d68abff913868800d932bc0f8a6e8b54fc58c7e885745b26de752f6fa6e58ac8da4932a77a0500a58b3f8922285967277c01b998a24e04ffc480c05d741c729b298ab54f5bab0123d75c54e256ef48ddc0759b82ba2809ccc941408efe764f2c3da686feb90869cb15f2278937c3fd403e69694a3fc01e782f5bef7373516be28fd7a77914d3d8913b2c5863a16e6347bd0fdbe9165a3a19c7a8a134f59c7dbecb4d51052bbf1a3d7e39fbffd30c6ba0ebe03b37b6be915d3c0f5c0f807c298342d55e79ab4ff9a053b87a9492a5d1878da6969afdec409a92beec78d7a604407068de512b2b2381c62da1e54aebcff1caf402a05559294fbe301c051b0bbe900352bbad939fd95a01eb971f0e86ad142e0a7cf231c689a129a659bd13f5c10c80fe282b8ab9495c806863e4c0cd2282d64b729fa827e44d4c057d7b3200b4bae2f062f5d0a6245f288a0b5c0725bcfa1e16454701958053213bffcb4dc5435fb0264ff8521ce0572217d4e5b24a7d82de9491557700d8da190ac455aabd88d5322cddf27687f4c716ef48cbd4ebc57f96e492130726caf2b70d756688728548f1c54e019dcd382bb1c6ba1aac1bf83ad0866ed18da02dee74e4058f48728f543b294ac054838444bb2efaf241610aeb891c6369dd5852b89100f961a821f086dbd1276fb7cdef564fe9e2457af5143aa916aebc999b8bcbf3efff6929a28bcc86bfb8294d4cc6514d83dc6a63802c8d5a850b5340037eee4db69c4aafdaa61a8c26f00bab8a7c55dd2ce64c10cc0b6f92f0384c3509d44ad542e5d8aadfb1d7eca51846eac41f4fb6c9577742870034ab164372d622a91458eb815234dd1b9285dd1058cd8a955986dd4a8a3ad91940b7770ed56cae42becd52877aca3d1357cb113c0c5a77a66319a22dedaf12e405d7ebc480407a86b848d74cbde74786ee094c34edbf0949a24f0cefcc56d15046bd8d48092aa699016cf154b991fb4735e0578427daf66b43e09b6e3d5345b2cdbea5748a8072fbb4a0aaa16e44ad449ac23096773db6e98ee5ea649ad00c69ad96b6bb3ec9f2e6b6fff11ed8e2f8b3df87fb1cda7bb4d80a04efeed276944276acc2f66fe7deaa0360a9935de78c036f63b9ffb6a33aa3d1a6c84b2ef0816233c023c0eef7eb240e14caa5bef3150c7cd871426378588b9a7877272fc379d17ccbef456d9f1414dd7fd3ce73830018048766c4d711b07dab00ef0a90d8e2f2499d01cf411e572cbfffdf9b5e80fce59a3fdfa3998eb60ac22630364848edbfe9a23db1e5333ec5f369961d60ed63ccc7f539e0952665daaf42533453e3a442a4054e9436823f5d6bdd4ed73c919930006c0d859a250afebc1940d707040e7d26ca71acfc28b3d1854ea5f119fadc1be4fa9c97ea11743a12a3e8767659092cdb7e55449e9e07a8a09c5a51ed0c55545b73e4b8590b011d987dba0bcbf3da328466f6cdaa7ba9a34cef0a7e364505e97ea0f6824bf26c2265315b9cd4bff2788c8bc622dd0ef6f235d29f2af450e0083d05e89278bce74274f8f60f20b4074fb593862ddbfe04237e8a77e051d14f45583b841992ba666561615c3e31f3b08e738993ba05da8f9fcb629c39ba6a7efc7f708e0c7acb9bac0aebe62cac2a8b6c788a772cd8a26301e0050b09e027f9c5ac8fbb849ca9528d7cbdc10e60e8ed9878dd39acb6b8d079329ac4a56931fe37c78216a661c01898e34928d91216abdae8787ae2f24968c9cb0fa1bba24417654937067d0773cf16ea287c92a02bdfe1f2cfbe1cd765982d82e9f0a65ebde0f83527b24203a7e8a9f7ac8b27a7be5c9c12e8bbeee200a5038a8ad1739cc73a1012dbeb1ea7a1e7ed84e85d47d17cf7d3a823148002beee20c30fd3cae181038c3bbd223e5f93f885d71f363afa00ba8e9ef4c1265b6ba39e416516cef21867e7d7b1af61a990d70e286d784a56e614c6f11a32f300716469c60bf4b925bef71ff12c89495d3f7e614593aecb293ccdb2bda2307c0465f0a9c0d491a51fc1360844eaccdba4312efe79572d3bcc59f875919cd42823b0bd300d4f8b34926101f120dfa211be67357c7a21a5547e4b2448d4c85157c5b9ecd798c3e486590efc4519c81b1371a8542beffc45e9038f04010886e9ebb14539c37f8146dd7f04f8a6d72caf53433d404770d61d448a02ff84fe84bbe8c5420453874684c8b841ef5d08206e5613edfe611dcb61d978ab4561da8488e7475a726c3c2ad97642ad97dccd44baff9177f800c4ab864923eaaedf0b9002c0dc673b9921327123465055150183ac1a315d893b1cfb71e2c2cd4bec4ecd7e59dc533323fd33ecaf8f5cd09366e89c7de66d94ca9b22a8c879173683aab84f66585432b333e5bda21b0a440ab7a534a839eca864a1b7e3b1592610ec9bca17a8d9a855ad88f1387f0d1b9f50b115b567e38a151f91698ebd2842ef757bb499a8ec4e0600de165b5fbffc48a3b963d4cc236066f7c37eef90b1e57a74cf90f4f3b6d4aa3431fb052611fd54b191c30a859503d3b580408fa6c56d9d708411d8660c13b772e1347c8676893ac607142b1da9dddbe89cb02097de641bd7d58202609f7cb6ca70be87031e90118e98e1028f5b16715c95b8bc7aa2228f8aac8c61926429a47beab452e40703e3e407bdd20567c4103346ac5919e2a3ec68febd718f1ad76013c6ed6f0ea9fddd5ec839eb26fac340b80c5b7bbd2b863078b67a699f3cd48e57da6eec894a7da47141cdf6aefa50d909d36a1fb8a3d698e2ff78cc9014dc8ae9cab886d6cac10de89e4a2bc138b1b67e1b003b8f6522e2906ae308b6d948f3dc2b8623b37c1f61e1a105fdf7e76aaf4c938ce2859b8cae0545e9dfd932140a26cb54240e52e7eebe5f9c6b9825e5d3248b5f37d2800973e64d66ec2e355233e1050c752108c75fbe4f272296ce418f31948789fad29ad20f8f596cf0d696b573ab813779a5daaa34a0f0967409f4a7a6c7b6a88a932291191482ccb3d595daf1dddb963c7f9ac866b65ce0a4cfa471155108f9dce70788e268c3a697486c179879ca75125ad200f5886c13857c19387ede27c7e7b9ee5eb8e3512133816c2f7ce2e5d2be6bc363febc7179fb1635d5520360b81074f85caf01438dd31536e9fb3c448e6609f9ec9965ac92feed9d18a7e53c9a48a315ad5bb51ca408146cd5b4b107b0caeb35b548790761ee236e128ffed44f9ccbb2a30c9af06c564b1a1de332512ffe8fe09765ab7a9219c5da79abdeaf067d3463d48989764445417a925b15c3de45ee1f5a24fb02cdcfb84b72c54a93ca9d64f73cdb72e8cf0fe4d4426e48efe749f61a3d8b72642590513c8d79f29a12e85f204f79c594e44c49b328d9a2ccdcb988e8d323dd1f0761b7a94a5b326d825caa1d0a4d778fc2ecb78617534acd8f6f6621cd8ff693e04f752354b4489961547676aad5778bcdb30133e3a93c652ae577ca7cf69ae5e17d4af3c9c5359f6074e0fa4d0f8a1d03de24bbb0c0075644c01358dc636dd449f59726692fa8955d710af661ea57d73badd54eb0de95544a444581747695a1439ecb5524e10f2dc5db511cae6cc3e2a69dc3b1c6ecfeea5e99197024e5d9909f66a72523f04e520ad2d428c396de780ba6f550c443646485d03f424b72d4b5387cf6f8f9ae5c51524467d0b0c50804b9a717ac279e4b6d4746bdc5d9dee170e0b77a9421d6fb2a7583d5a5208374523d58a45b6358cd17a864d04ddfae16302d09321cd8b338d99f5dc3fbce2189c94e3db4eb8a4f67a88f8a230adb59749a26912e47b8abdad3c8610938315de96284b7e62b97ff357f13072e20ab4ac60effd6a7a9d9ab60e5", 0x1000}, {&(0x7f00000023c0)="09e491796699b71224e4a6a0ccdbdf0ea960046b6bc2d38396d001c800332cc79c3a4526136c9162afbfe3fa1da7b8430bebea576a5cb8c60ecc8f065c3c0432a43a58c7b7d4c50bfbd106c7e1eb319eb51a6bdd3cddbdd29904c94cb7fad292751f26286763b59d90205f35dcb813ccc0c229427176f8430ef7a97fffad28e6ed9e018f78bd4ce9cbacaab50c1c3e7a1c1829cd69f3dc152a3c25729a0912f860d273ce4dc62bd1977753272a2804636c0bccfe076b03321d074208d495ddc7a4d768255a766f84c478ee77161e8d7c1e20c9235699078827b0d5e33145f3825fe54e4244aa0a6670b6009bc11cbe7c47c3a3c10ef3d5f473a48a99476873287e9a70dfaa5a498ad0827b773d9e79a6db2cc1b180c850605d7f1714222886fc18f6d8942e577a5a9ae91acf576f994e952c31d80763e1b5b663077d5c711e2eede06275241e5eecaab809f53141b3cfaf9bd43da8341fb8d4c007a52755cb2becc4a589e11b027982590b2091770e2b6ed98dfa715dfbdb06c0c8f5924dc3092dab19007e1e4b47f4ed8cfeca43f3a95b6333a2d31789a10dadbcd77be86e5a2889dc0b7407b68edb163a10d03423831d45ab046eb46d51f588c5a531fdfd2d2603e94409ad6153f6616ba68da4d41f1217ab1e5dd76d677d73d53fca5a865e2ce328ceddfeb0b4afc5fc432a7703b95b3dc6be22fb249f8746b12b1145f2649ccb37f6ff66973058cc72a142ab38c1072db0a10cb48c656283ba55179a617474fcb58bffbd7d3bebade6bfa3ac4b90d8726b73bac085c21246c3ee97b979d17ff215945dbf4a0c4db699879164a03eda38a77075fbc607c55518eee6ef49bdb340143bd65f47439d7b60d3810763758cf130104bb49e984a84210c53be3eab65b400a16603bfaa9beabbe69d4b91cef41802835c36e45a1484f3e83ace7597e3b32bea779823847314749ec3ac872375936618e931d94f93a563f10aa3c699a3436e13682351fe7255bda25e44c9bdef4f455aba02f16f4ba0e06a54b68ac1bd13a623dcaac038142829e15c08d5a37756b192c1ba13daf0d537974c3d70638bcf0c14844eccbb17db6ddb5416a85f6f68c93f610299b5379ad446361f72dd9870520b187b3951de51fbd174a4167f943e200c240745a4ecc1901805962eab7626b5af1dc526f57813e2850b5635c09423b4248732b3bdb1d750e0ef048c1ed94a1751cbbe85968941cd558d5f9525e975f1940326c0a4c2b58f83fc07047c6c65855f68c50f39826553797bec0cd3d7968c070448b8760ea2671857bb797eaf578d27a2ba228e121e7a242aed9d2432b8f0d41f9651f8457bb99bf48ed874e81a1c4734ecaa5ca99fc6f56919ce3572303de07063ff58bf3b4a50f0214ef7680850c3780649e65dd89eabad4760e525f1b6793b654ccde6d100a4caca63fd2c536225997749eff12be508cb70c08ea937d37bc8f2a0c244dc819fd85143cf6258acd2edc2569016a34162ea0b3f85f4438eb0e285e3b6c4b391c52cfa024363bd0cfd0ad5bbf569e804ba9008508ae83ce4d8aa4164ad3c293ef3cafdbad28bcc19b38a1e630c8a2379928c28c6944c8aec23065823e81a4496e4efeed409219f01f1528062ac51a97432304798dceed7d8401fee87227f4653ea32f5be8cc6ed2aeac64f54052ca72af97df8fa53b656c7022268c2e8e42a0c611374aa516546f3c73367daee73a54f3ba358046465182b68fcd284f5e0cbab19b3a7c434e972d1a4e3300e9a427b21e79b81ef420f6b8cadfa5d605e6b50c0d87923de449851dc2e125ee9bfe15a6fc35151eed990926b4b5672c7dc95551df0ab920963d1174b3b9e1af11217017fdfe4a20e321fa7b367d4df32a230f70d961875cdfd989a676a5ba2bef8dfed94edce019d799a144fcdb71eb0abcaa17f51f7016cdb5af551692677fd7b89aa049209735c293b540b7bb624d49ba75f69b0b2fe055e059f95049f3faa023916150b88066e694742ac25f998254e6de2c279c95ff20e03a487f60545e4ff3561cb5f4168b652af7a11b21c7a0c05dd7c881afe0a17d49ecda893c1a8ff4c2ab1809ac0a89994c757dbf6eef40b9da302294b43a7d470c9eb77942e0c0b075a34442706c07b9bcb767ad6ec9ba61c3daa9379a314009f999d932e681dec737ce575ebc6174811fc8925fcc563562e3b9bf6635229c6d6f4adda9f3801cf717b5b4b86097ac77c930ef7bb9f9e72b04d61516f013299773a6f6a2c6d1dc58f7acfa2bbdd785af3ee4f14a2d0a770a4c9df925fb832fec9ccfc3ae845000ea1d6b0a94bc1b78f15132d70195cc73941580a49dde44c42be82e827f83e0db4ea3ee9c153bbf184f9a19350778983f66eb5cadb42058b4ad2265440b7fab48d8e36729c52821ae9db4be87c32386af320297455965cfb3b411fc92e9cd180869729570e1442c49e635e8af1aeece5901990c195708895b2bb33c9492d7750a15d4618355993db84c347a22b9782b52e8a4dae1f771cc44c4189f660402541a1d2c468a410719d68b7f561a0b6972a06d09d8946885f7069ad57ef5159639f52cad48ad799bb568d2bef1f16d772bcf7b03c2775fe2eceafb1ef65b2dbebad39b52b6f49edf1f174a9e3c61c6589ce7c31e03ba71cdebcbdf344cb7e2701b96752fe39a2e3b1a60c8f5c3848905b0ddda3f7f3a055ddcb1b602d5e690f344dda5143d7ea2e80f27f6166354ffbd870afe5e14c7fdac989ee1d9409feab19477bd55c49b7aa43a205e4e77622f8d5ab605830b6c39453eef643d19c52a3aa35e57cca2e075e09b92576962a44e4c0a51b2df69207c0134822a302f38f91ed96e7c92fa6cc1e76f7fefafde0ee42c59c9f0e3f0992ffb885ea8767cf9831dc66b564ec180d60e0d217fbbc9aa87dbb32467f4f4c82a21a887107859df4615e967630811e230731f804310432e63f4d6f3cf6cdfdd51a4190c6571767b444e37dc451e5804e7bbea96a7a28693b9f7792ca7760bfe8ec02f1900e4677f584827541f81755266d3326cdb97d69c7438b58e8a2edf59df40c777c003d36d880922b7e59ff427aaacfa548af6f251a09aea6fd28b29547eb601a6ab9d1d161bd199e002ab484075d53237cdd6ca9acce528aeb45b4efa96fdd426cd2e0215e68f8e44d3708da01854ce203097142b6ae6ae3773e86140bebab4c77a75ebe2382f2758f5a17b8e6c3b29741c437526a1815e3059c940be9d1aac1c9244e3d97e9f6532bd580dc5b1419a261356fe301d09bcf86ded841af6a5c1b1436c4ea3679fe41c96fd65e60c566b9ebcf92764ce046eeb007f1178eab9ce3b338fa4d605d90eecc830f025768f6c5530efa43fe36fa1108110004f86b3f0aebf37189aa60e018648edf04d0598a6aa8866fe62d8daf8846df815dde86de9dd425a8cec22ae3dd22bd2cc58e594a9aa36b20530d4b3d89dbba807441a8787e573714220005b6e75c2997fc8238ddd5c34e80ed36eb8b95cfe1655ba0e6191017c0a9ead0ad88badcea7f56d25a16e9d2c80b28b2ba75d688442ba92fde5067433167db51eafb4434bb1670428cde2aaeddddaeb9fcf3a15a71a69692af4ca1b4d5cd36fe846091b861e64cb62c74afa5b09a71366d9457ab5c8c4470af0210e633d1c286ab06814c500cdfa0b9238191ab6109cff71f196fc002dd1f730d885ceec3210839772db8e0aebd3505a39addb118e98f25fa2ffd0c8ca1020feee04dbbdd9275db9caf75f52a0e65d83e5706a78d190765922798b4da62a6ebe2fc722d2364478b2326b9c8fda4650f7fe3ced8588f0e109920d4efbb01dfd0e911f2bad2d497f0c901dbc03bcfefff52e3f97fa14fc17798815ebde87fe985296ee309c57572b961cd8de6378cc9d40de7c99529702e5b05715ccadf1c4adfd192ea10fee3a944e5f42f8786a553ff849816b25682e5ff91f96ce7515d5ca2a649e47fae3f6bd29af4cb0ef5aef3e5d3c87f217f7905510f4cd66c508fbb946fe08286d1f9d92f51e18eb4368dc9bc92061958758770f18f7ec0d36518cb4b059b28f069858cc16caf738678e8a1d10a4f4c94412e391d1d7cc94deb978fdfc66cbf2cefafd3867926057ee8e8b51cb25015bd9edf6311ab238e4e37d978c2f4538dcb92c49305a75c966e123b280ca4cecb04a46f448d7ad42daadf8b5002f3321bc925b8ed9ffe66a3e3f2126ad5953d1fecfed10a9202d212dcc5343a2f0a3dd66a084cb0a190fd0f3ec2b8d973f0d2f452f0f2022141a7ac0f441512a771e10d7264ec9a1139272e888f6e75957a75fe0a630c2ee6cec1aeaffcc74dcc7ddbd02ad556889be7ed2203e4d4963a786997646ce52af76869d6316996940df6ea89280c4f268e0beb3656c323e9d27d42a88daf83b34e05d926b95d656c1a23d5378133c7716c36c439d644a7a4a976b378069e23817f63c6201a1d0b97ed73bf2519ca3fb29aaed6ddaf99a2c4038f6c1c5a9d251d68dd248391c25997b82c9883e77f258a6a92f7749b2ed8929c4386feeed461bcb21e171c994c31af359501bc8f25aca9bbbb33b4dc681491f39cd1e434b2b5dee8cffc723084f42259b6e3f8fd7f73aca74178c73cea2b0d798610e5648410b243c828b1eaa068a3bb6f62ff17b6377e2647fb6faab4aa25918a40ba650273fc34310e16e98a6e3e5ea66c30d1defbfdf7e7aa82ea7eecc7a0af765a727a96ce201d46ab0b83cd59c0a85b735ddadf9e8cc4f6500dbd326aa2f5c080b3993aab2cff67b515720e03bb646752a67058c899423461ad5eb064f0b23a888d0318c70266a2ac8b34a1494af25a3227450af61b742fd416c810f16ab6f2e0a493d090c1e685432e3f553634e311f3ee5476546e4a6bd8b91e8c152abe46f0f96eef161ae853cad9b4f92498376c76687360232861929d9581ed02ba84e196febd5fcac6378580a073f8f457605cfdd3e4853b570fd57a5b183a11d4a9cba097dce28457cad0c6ff1662ed01cc14db772917155a9f5f97c326c87548893b66a487fbc5f9fb75a54f3605ac19c4a609df1eef12fb9ad5f108fbf544d49cc6592ea2e98dffc9f986481eb91bd2dd86e163bf2a385e1d2c846dc45c4149929cae6350dd00e03471059423cfdadb840233e49f334be4532def4584e8a37d306372b6b39f3f975af1e45d74ac7de2cb83655de48bb4aef089a6905fcadbc2b48abe9f0d70015e844a613eac5c1de7553f1becf4b95e9bad1cdb06522827b4768c9ea37208c559487024361f8ba63900f5c724c1e05c4dde22290e8058a39a4bb072148bf4e086ee82acbba119db7679aafb613d70f9789d1534194238fb84c47db79bf901ee187c92663db5b0f23e6c2db220bc674d174e3e6bf4d7a8fe3087ca03b0d8e5ca3471bcf8e3f4d5fe0a4945ca8c5031b7812daf510e64c7f949eaa8dabc95fcd7e2f70d0576fd1e4efab794c3d8a14e90cf77913670732b32a2e2c2eb6573716e0087ce1725d66817b0ab92b4659bce0448dba31cba3e4961641c3e6835579c687df36a177ab3c2474aea603450b2b0972642dcdb63493c4c2d5925f6dff4b2acd1f59c942a5db88a841d27e7997eabfcc654d4571e7016fe12a7d5f2b4279fe55d0362324d1455e48c1bc8330ffc3ba1088eaa1d83e6847b59748883cb3d88e3c2ef8bad5eafcaa395f57ed8b81e810f54b6c39974cb928492685a4e8e31ce32e0fee044736f786cdf95b76b0b124d703884554b85c9cbdbb1845d272110d382356a191720eefb40369dfd3376", 0x1000}, {&(0x7f0000000080)="2cc70f527ad1f78f83ece04488", 0xd}, {&(0x7f0000000480)="ef06ad4fc506581f59a5e87cbe42d054e6b772691eb10ff2f8c6572ba0ba26a65a9f3e904cd3612dfeb7be39147d89cc0e601e913eed4cb0a0ec12363c6060c8ffbe81f252bfea62260a251e86246a970252e473136ff896e310438fd73a3faf6120c824fa1c650e2ab43a89b50a2c11c9fe790958869e021d20cc8a37767f8b31375a697bee4bf28315dbba92e87284398bf3a7b636b8d215ef8d7fe6ae3bd2fcf97208922f646646dcd9e66857f237d44b961b0d288b8c5720b41de52820df949f170145d1e97ad9d284474247906adffcd9e7969c962ce26b345add13d7a7b9a8a98b6b106f04dba74c81e8026c2060589427977891", 0xf7}, {&(0x7f00000033c0)="0f12be6bf183fcae73caf393ad6d092de74181f8e69394053bc792fd02dde3d65d8376c030e9d0781eaf1ecfa34d5e267978e807073ef4990b3368f5d292b4c9ba6f12fa47bd3dcb58028613ec57fae6b79f866d18e2f5af108f561ab8334dcee5e2b382fb4c8e10585b7131bef34d77d31b3126ca0f27f2563998264f08f1ec9fa0fd27792c9997169ee0c19e4faeafd53125067ac867d45314a7c450af0ec17d10122e50f077a4a26d5b797d02bd7524de3196466114d8d5d552ce7c91c06cd3b9da1b03c42c70e0c179c6b30faa7e074d9b9025e63469f736725cd0fb22afc4386ee22ded6d422f27fbeb812248ab9e435618b4df3563c62c72ef8bc879632a18bf70e52e10eb06f2d7621c278a0abec7313f7b4539bf47e89586173fd6637b7572502ac6917549ae360a69e1729a416895c330686e25c4a378e9aa55d1bc4d9b88bb893da90db12b226336082fb2fc31800e0774844c1dd3d37ea36f43da2a3f8ca16507e8a3ffd596af3911d9354ba42484d6e2040179770c8023b6baa5a273d657cc25af6683a30df9534ebfaf26b41d86f3878cb729548c2c713f3bc0e5129186ce7a86e8c7a6d4922776ba34df03347dc653425c17b5dd540f60120005fb197145a782ddfdcff2b7dda645faf589c4062ccdc3a579384718c8d03076093ec31b1c561d8fd27224bd4f5310fd6a5720e166677960eae65db4be9611d62a84f292ebb1d9a86b585bd656d2a55249936fb1a8ba7aa707131b62ee74473f28a3f0511f0fe551c18dba7e00f1115aaabebd02ba09c36b5cdf4bcd374c4da6f51f7b6d6be91117b130b4e8ee85fc1e3e369df4dcea963d3548a4b4f9c2ef3fc5bb9c71910423f817116680ecac9c2b1bac377235fa0d236b91d2988c1ce836b9c164556ea75b22b09746b0cd82dc331d8b7bde96c0bfbb99eb98e08c07187a1e39ae65443152e5b9b06878836c25f2606c7fa968c42996771ec08cc674449f16938630ca55639ab789e69b485dd7e61b3621e4806d9ad91796f542c0ce92e59bf3b13d33c565da445af9e668767f05a72e453ee3832b71a47a37746c5d148e0d7c8671d1de0b1cce465fdab77b0c35b55b1a38f40089ae7ebd27d768163e790c24ae7376d42a5a6880dace7198f24f8cc43415385478dc8733ea8a7a22a1d69319a0ebf0284cf39258caccef7ff7ecea4c38304ca14dd743231f40b167e92736fda78323ecd69c300dabc1db84cdae06f6fb17b7cbc46ae1ad977ec0c31018a18efc6239c76f56d2a29c3c7affb72a9f4e8595bddccd1fc62980f1059f3e2acea546051c3fce70e7bc4fcee9bbba15ab9e48b6d9c87e70b88d2e0be7c7465032ec0de4b15167286c0ecefa9e9fa990433b175d12ce56dc12c4090a5102037a5af28ded0a30d31e7c25904890807eb999b879a4c4bf7d8f2ed0866b25a337651838b513b8696bf318780c5eea2692f49141f94cc4133a23d2ab9a6f3bca7b1131cecd60df76de877e7175047ead103402d02ada41397aa493b099a29fa20ffb8d50df506c56e34b4eacf039de8b1f0b2eb4fa07536a8936d9ef0c896301562270dcde23e1254ab8309ff9751257ba33baa6af4f3d9d94deb04b70993523c3f551f7481a279c1c85f89b2b9870d21ebbd75e90b76bfc32cb351e6fd388c7a6ad4a1abcf17ecff37e507a126e7701bd7c606c9a23f0b27d04b98b704890d8fa7fd04710dabafcc195811f0e1bb884f262fc695f43dfbe74d3b93fa65b1786d66252a79085046df006735874d78c2e352106d6d024aec9eb6d0914051c50a8fa9df3471ebed617a5373f97480ad74a9698d197e21ed8e100e312d905d2d32fc6a8871771c3a127aef2acb946e3cd12b0974752b24dce794ff51d74b336d31193ac27b30d5da0a613befe8d9601191fa7b62ad38ec2d497c887c585205d96f3192d87b425cbe65e86577c39cac4046f360b7e8b14d2246bd4c8765877618b50d0c6576819252467f8fc5f8a1ae23227724fb9860d806ea078a4b8e225a6ba11a8b1d4784a81e0b8f0c52300eb5e5380b390f9824b0893cba737a16fbbc3d66029f47907efbd10c74ead12644d4ccc5e860176cb5fc7a57e67a242199ecedec99d93f0f9cb980b4e154775557b215aceb175b1d83c4e62d28db72ff44a7a77cb5804c74cdcec637c3ad22959e2efd70abea63b3bfdf78654875dc46ea330d11e9bc884df7c946f40096cf1e0d3a3727dc009e49f758392f704c0b6b6c398e5d08d0b89d53fbc7ea298cb1aaebd44b751ca2c64a158d21d1d35428f84f8bca55184bfefdfe6472c3f8be000d2e40b8429e7ab6f8100eade2182590317a8058e7f8067da4becf44802f3523aec5df50f9c84d39682435b5e9e0b8badf82db984412300a098d679d752ebc750a91b0432da1cd666ce809deb69eec9b430894e5faaa2246dd7a62d2edd84d8d69be5cd1b9094e39a29562c5ba4a5fef982fe826f9053d8f8bfe68664c204603d6eb10ea1fc8474f281b137953d1a4b65e42904e8017bfb906dc9bb1e5650dd314163c17c3547b9706170cc9ee181f35e99a173c7d28a8eed4c16b8f447ea087dd2895cb5c4809832e4225b53e413c3ab983bea2a49e013b1742579f182fe78192b8e50c71bf293e15af9ed866a10a1e020ca0dedb1eebe73835f2ee9c35475d9d88fd0073ce95557d2fdbf292d229db905a4b83b4ad16fc3e045a2128d132f1249fb75183f17c8ba8c99bb6e98f711c6ed233006a248ac87a4e0e301725d0a1844fa46d82cf84ed32e5baa119fdab14c7107b2f74b08a48b8b9966fc72c16b027ff48ebe96b521b081aaca9902a6fb304efd711eec56eb4bb44e7a9453a10489146431aae2df0c5e06405427dc66bd4263156c1f49ae58ed3d0291ef85023d4c50437d849c92757ddc765c87c58df24ced053922a529c1c1601f8093ed8f9358ace66ed14ed4005a4d14bb375ce92c221ba1682552587191fe7c2daa682b891927b996b9dcbe92ebedc3874c7e3a2e6c63a6051b201fb9e0bd475d6ac03c39fac20fa218ab572af9717be683702119e37d0861eea2056e34d4666dff3399147d8da91735fb54b60f3864d799164dcae6d6e2e046a64aa19dfa49175d066412bf8332da81d1cfad4ddf76fd0137b4ed8f11009f985debe72eba7687ea9c7fda83317c8cdbdff677258b7678887fcbc483ab84820e3ffe8f6c9d76f3cc8c55e0e88d430d0da2bfec6e8e0fad19a0de4efcb6cee873cee380a5357f17a712a3b7665e6747463b2014276ddbeefbde4fb76ed69fa32727c1ff4d2309a53a0c9e648d32ba20c9b688c4ea178d7a2438ec8815562e56fe2427cdbf40d4787e3bbc269bd3294264a9c74af24336126bc4b3916e422ca29835d74e00b5a9e1dd9c5b6c70cf25223b62d9901b508ae63eecb49bd39c36d775a23a45760f2a6f2d6d799eec6dd9bd256f3a38525730b95113f645adb977d360160e052b34b2565a988f67f67426a9fb383a2cfb97e8d0816da8443389911f8c708f4230ac0e5fc056ac8ec51ee107dc82b243b92b7a9fb40d3939df28eab8d6ad4eb9586a2e88069caedd0e7e219dc22507b91c0658e48bc39d1bcd0bbe4ab0564e46914e72111f77aaf793f6fda6146b1cb7af00e091b681c3f0286e115e934edfaba0c1d4d760bd4a523662645d3adc497181f7eea2a8e007ceb28ba3d80d1fa2d478399221cec53c759c7a88d838de3186d3ff95fb54e5f9ff8ab03f498c1202b488f5d526976e02ffe1b2c0b03e2aaa552b761231a76b8ea859750847c864249af03bd11dd3cd7f0c47ba0b082549a394938acb61cb17999bba8dd5fe107de0cc36cf84da227c9c0f6d665031b01fa8faf3eebcfed494c6fbca9c7a41c91bf21bea43f55291bea7a307422ca9cae49a89b4ab9391d0e170900bcd7fd0aae1f0e617209979d24e22b7c6893f1fb42a645df2bc42c79f546794b3f05f67440dc6a5b3661db5ebefd65d9fffe53f1b7f039c26074c7348d4643a089396950400524a722588cb2d355b4622a5faed3d89c60537163a5d562b82cefdbbe5729c396cb50ef7eaba2ffdc0f05cf598b17bcc0c116288e6acc2ad14392c6a63fba61c5ed6bb53173c0df89c5f5df1f78685ad27292263e3d104e72570d58155e7d80029f779341c4c3d45cf1cdb1496d1fe50280fb27eb6f556bf5695637610092d4d1763d467034a9d883e356ee4d03aa7d7c8d30f6ce1f09ed50e0a529908e866876ea8b09cd09a9a300036cbf0bfb5a4a3ab0e6c7429333f455a7b3f3e1aa14c04291199de1bc0fe49805cfee58ba540e419433d48d9ea8dc894cf703d5da036c2308f92a4129c602ebb5d09da9a5aa07e39c23d9b369f23933409e7301f71afabc2344934670ccaf5632958ea9b7217b6440b76edc43dd8676e3b6e0c5dd19b8c431e70659e40f90509904d1e59a897a4f289bb66dc767ecd198efb1a3f4808ca139d5fd49906236da4a73029117866c3d40dd79ce4cdbed1e9c5ce6f4f8bd56459c7ebf73b438e4f395cd339de90c42171aaef67d7c42d451481a77eeda3f1a124a14845a084bb9235f310eb4f49e85ed3ea636962582f9687c8e5ae2d5d4daa8c50c8e592795ea1d5f0bc124a471210dc991fc2cd780529d859acd437871ac83d9c493d92fc01be51a2354b463febf098bc9b6540e6d898e53aead4e39b2220b14f12c222fc6729d80135c16e0dbfdebd237e4ea2e730262a86fa831b64769399240632eec75ecb363b4c13dae9554a3476dfdcc538ee3a856ff7d8bb4553089d5c2c0f67968bfb1e34c4ae2c12fcffea35dab22d3e94609abc81ad869db55e49a6efd91cc766542bb98ee15a5bc80c6739a5ab48e1db88a7ad3bc6bf1579b80d47335f68110319180b6bc85d8d149b6a90dd2554926f101e3618b9ac7bc931d780a2d92107c2ed35707740306870fdb2872a2ef16232cfcc615e73e6f56547358f3d7aa66f50ccf6e5badd34b20a74d3afb4acb697608411aa7112fa23483b0855cd3b0f0bbed446b36d43a636d743d7f01a0032e8bc5754b5184554738d02546d249eafdd6f17cd541eba0f8b73ebf4c1bcf3b3c1d175342b9a3ea9d5942d876dbf4fe83c17315df576b938c00722a206992f652d0db846767966b527ee7f5bce55fb9dc4816f968454837dfb2a6d4bdaa405faf45f1fca8f72214e62d52c8e7cd9ed4f8d6c50bda3971c07261bef2187412679405b9a5e12eaad530a068a40b06d0cb812d73eb20098d638d6ccbdc48334f79c407971558718c99af81a58b9daf67c664e9778a16c557261431fbcba93e77e509fd4dc7b308bb6893833839b115cc33515d0d676fc8a6fec4db83a550c2b224764413992c45509680917633cbfa7efef45e799e0e4e44fa3be45b9e6f7bca5003c50d255ed325ae797d8fce42035ba85ed7bf14a65a0688e3dd260edb7d786f6df74f6dfb3024b175c35003cbda64e6c1162a765f13ee486bce671c6a6308dc7ee66f08b0acaae40528845beec432b2c66ec5f5b7cc1c0a6a018873cf73395e2765c67a98058381fa01cdbbc5d9dc702611e38210050e12e0e41924f0ccb7cd57fb497d6b826b2807ebab51327b930eed70b92d6aa26c597a9543b01208d3344a74c5cada9d8531c8cdf691af0939b8e283b97a61a3545db96f8048e948d24bafbae32352319db0f16a26962aa6d0446b6f4ff950a12e61251449abc40bda4a5109e7784b2c249856506c682886b93344a7e5945fd8db2977da481f419e5fc815e5505d0f99d90ca6def1c3a88", 0x1000}, {&(0x7f0000000580)="c3298543cc2e62c357958a830e4f271db7bd4753a8d9875df48407ef2b327df647ab6adb999037fe22d109b0f0695de5cd957452d6043808cef8eec694e23f9985c2aca3f94e70e418956035d9ec7614e8be411474c1163333a36cf46096e273518d2abbc83b67c3938b109c79515089d4d75264bc3efab6c33bc8000f5bb4b8ecb1128d4c715f7287a05cbbac571f5dfb9052084f10dbec8528b009571b2af7c616e3e0022d564f46f92a44", 0xac}, {&(0x7f0000000640)="8fee480627193c84a7b0c286816882dcb2274b6cd5cc3f21012b05c4f0a4d1e644a151531280b765f019dc854b2a4d75b77c4e50771d88fb205223cb4ab68008d4adbcd4e05ec727aab1d65d5cea954b4a19d7f772256bfed4ea29a9b02107217e819fa5b6cf83b79bf7db319cdfd2843ded8e3444dd18c5d4162fd9141b4d7ae137813e2f30a3f94015850dc8", 0x8d}, {&(0x7f0000000100)="a2cd6776593626a7f64d88dee6833ae37be958189ad6543608bc157a806b94716490da09a6b5dc505306949023cbe78dc1e7476dddbe1453c4f993c7cd43c7bd62ec7b3c44a2a1c5b69c34026f309d23a21fdc3c1d57fab2b2", 0x59}], 0xa, 0x0, 0x0, 0x4000000}, {&(0x7f00000007c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000cc0)=[{&(0x7f0000000840)="050d65a73cecfda0532ec064393a4cf66b22b688e286f9eeae27690677fa6b92e94212934ce4575c67be2124fc7fbf9fbbe119eba9d4c0bd4f3427fd38454f0e4554dea5d85d921c03d9fcfa5071a487ffbb3dbcdd520e30104563ee16a3a2bea2b665f1e90e5046f84b0c1a8b007a1577538c541d254ed8738135af", 0x7c}, {&(0x7f00000008c0)="09df92987259847794db6512e606279e2adaddb1617faf81c56091c73bbde33b77e5977926ad5361b7f8d2376ff6c7f114e569c267b862e6a6a56f9be5c838178d9e479989cf93b22821d82db17f3c3a45d80d83bc5549ddd46d5223076ef51275950243b837a0ad8bf860cd1348daa994ae8bfb97526f36a965cb80356bc7dfcb485c03383475ed6c448b6f5f90e143ea207102c63e", 0x96}, {&(0x7f0000000980)="2d7dea889fa1fddf827cbf2fd9330fcdc5018b254571b12eceb14321ef019d440d794b6e965bf14740189dc643c832bb4da13c770e1432d537f65d35c103545932e7bafe27a6c0eb802afffcb36ae2", 0x4f}, {&(0x7f0000000400)="6c7c2a9b4b52812937ce73c5c178926520d859ac02a61b", 0x17}, {&(0x7f0000000a00)}, {&(0x7f0000000a40)="f029c693b5672ea6afe565ddc2c0ce3bf4e32bdc2f6f0148f04ea62767e188842f8134722502e58eec4d43f464bcf99d7b8fef455ddaf59cdb3e8f1ae46fdae068464b266a6980d40f69cfe3795b54d09fb6551c0bca44115074b1219f09d02b1456ab8254aa673628fb", 0x6a}, {&(0x7f0000000ac0)="9890437af26eb9043aefd1f61d8d727fd135eb20017e665689a1d09ce1c2dd6ecda6d97e464d32243be034497eb195ceadcbe047969a5ba89cf365f6734a4a02f79795fb4802452dc60a284e62d12173be13a4bc214a97a269490ded149f609c9fc64e7d1638700787c59037e29d9e9a22bfa3a888f34bf338749d2c0d37b2e183ac599024e21de377952e349593bd83b2cb222836b4891d57194c", 0x9b}, {&(0x7f0000000b80)="27ec05e5c0ba2450c4cbfbb63ceb03c40bb61f52eb3fcde0252da1148948ac8b6204b9f0b89574e52289c8a5a330a2b335dd730d", 0x34}, {&(0x7f0000000bc0)="9b0ad05e550b132ecae3370abdb254e97cfbee20ff89b4a101413dfdd3e9ac04c93c2332696fec2e2513a14f8b958ba61ee73f37e6df1cc075c979eefa483b4d29ddb0cc2b04b65fdff42ae1b8dc918f9d642f8fa12f6ee37a4cad027fcefb5674ffb16075250d57026deb178aa04e99baa1c99eaf69faf9b70282a3a4228d5c16168d086f9ed6d95e6873e2f5bc0a88a17f036a4914564918d895118c329308859800e8cbb0b0a9e463dcb9820ed126727bea9536541fa9cc668c1492791f91af07625529c4", 0xc6}], 0x9, &(0x7f00000043c0)=[@rights={0x20, 0x1, 0x1, [r4, r1, r1]}, @rights={0x30, 0x1, 0x1, [r1, r2, r1, r2, r0, r1, r0]}, @cred={0x20, 0x1, 0x2, r5, r6, r7}, @rights={0x18, 0x1, 0x1, [r3, r2]}, @rights={0x18, 0x1, 0x1, [r2]}, @cred={0x20, 0x1, 0x2, r8, r9, r10}, @rights={0x20, 0x1, 0x1, [r3, r2, r1, r1]}, @cred={0x20, 0x1, 0x2, r11, r12, r13}], 0x100, 0x20000000}, {&(0x7f00000044c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000007980)=[{&(0x7f0000004540)="bb634bdd39a8ce15bd88eff809a53be5f5182787a53beb0b79e03aaad3e11d152f613eb210a79ac9a56c811a18defa2dc769f4cf5d23aa8ec222d6ddce6d7d7726ce064b73c0290d307939248c698636762b37c19a3103b5b847cc684f9870656e1180fc1b8c", 0x66}, {&(0x7f00000045c0)="11717c17c1718e0d41258d0bc1c82c1213cac4dae352488db7185e3474c55cbc878504cc7dc91f825a775e01effb2ed12cde482d1a59b2b3342435e354f77896acfd0f9abfaec30549f45a47e6e2692ffce3a10c8fc7f676e094924c93b3233c723563e50db17c360d2ab1ce21b6160a9ed8a428cd3917539a7f04f17bea7f234f8d96b332655ef5c0d21bf10350ce4515e05b473211f198d9663d41955a216d3ddac6e77c8190c69b5876bef28460a45bed1e88abd5aac97065d4892509e661eedfec0b49062a6c31cf29ca9b48e863600e4bb9c847f5277e6c7672024538ead83864e53e0b54518436792e687c3395d2f93c8fd57ddc808e03ccd2276397be3edfcc511a49200e52745cb59d9a2e43a78d5c114d159037d9a8b1a29e3ae8bdc21a2c1903a74f2d666cc5e38483f5fe3eaaa67d15df56f6a755e1143a910a8a32f4b1285ba5ce94142df1ef5701159f1e8b4ae3fcbfb836b1d20ac9e3d41315105e30c52087ec5150613d358019851f24e79ae04608d8cca80934ec43ce923187d03bc1ef7ca931d25e81102b44b757054839bb2e8c23f14a4dc845c5be678e5e58cb7f0d063e514cb2edb0ce0b314dffc5926c4f83c4d64060bc7a8113a73d5a63baceeb5d6ee890630dd65c448f37d56ea9e27d10a1eae6d346e40d3a3fe17f6f5b7d8ea0ab92ebd107885822593400f388e1bea4c7b89c627022fd7d3abc84cb03e1cbbb73f5a715a907be32dd77f9e8b3ad6e2f78824c0585044f67409bc4c1a53a0c7bdcf92ba806d44c2cfc0a949fe999977ace1d34b2df860c91b46f3763360f044c55812d68ef1318ef4951579a444a99c014df1411497d4c743627109aa20c548accfa5b3fdecb920fe626dfd43814186815a36aae95b2fbddd50da529b317aa668b3343070a23e872a0bf10d0fe551ba12fdd550842d608a3da645514e3f86af1926de6a594ae282eed6371ff655a47047c1ee6deff8063f148a48363aa9f1eccb9d101f12fdd30971d4515fe8c880703b00968955589c0dc68dec56b21dc48dc0561bd01c54935db8055c2dab68e8e803985f929129de27a8f970ec6da05634f6a6310122062a65d2295a9a353afb67584e35a7c9fce11a494cb57e5f3fdb4999caa5176cf214d38caa0a9107b6d8201a25b65a11a09198517d542f88527a5ebcb5354aee147034027876973f20c8de0cde385fa3b1676afae873024ec5f93bace665470c7e7187ab7ddb46dacf021e4c1a5a30de17c067bcda9410cee3bbc68967b0f30911a36f1db13b74ba7c9f6005d3389251b45b4f2fdd2b3c1f959fbe935440b47f799d81d42f8efa0f7dfb723274340f06f78833c44fdc2a2c586e13355cc802414809ae9116d8b1d43f1a8f79862da35dd72acc3c9a51651bf7b04b1348267eaa680cd78346d27fe274f686cce50ae85478a089c6adead8d5ac494ccd18538e6dae0a814c78f5ca1332a892725aac4cd8da1764d9a7cf964713f0c245d15476852fc12a0dc693a01c8710d5583827e985bdc5c8c194a10048d090e2e948e2c6d29732b73ba17c9cbda44cc6da468b5c4d0dec53efcab536c55bec700d675f92f01f9495426a770e3d15a8e0b3c1b6bda75174e59157c9f5aa8b86cfedeec4ea9e22ea9028561492aa585b68a85cb2eefb69eabeb611276ee5aab164c828a9b78383334fd43546df80c92190fc94a5555c4430e0e45539392ac4c69841d83831ebb02886a6224d2fbb7deeef6d7bf7b16d6105d6ff6b6963f34ee57332adb69e558c5e54c82d97614a7db1c348f8a8ba9c0ae24a7dc89820af69241fad9b4f543346fb8f500dcde13e8a1c810ebb86437673dd2f1b84af2064052f743f8269cf3abbe399493b07b85ec7943bc2ec5ab9df113d87a7fa1d55bdd104e13b7408443e290b7dce1dc24c7931b8a47b38db83f0a0cedba0ac9dda4d13d9337d1b47bd627773ce7d4a54ea71c0c334ce331f198fd129edd207e8c64e086f42bb68e913bfbc24f19fabf8d1ac82ab90f5a448e69b2fbb3c0d8c859cf524b7182ded97a0f37badfd272ca8669fae78ce42f0884d78fafe2e385737859579f4ce8761dbb1d3cddbec6ebf9c04083ce302a2ac091649bc17d5513a430c03673468572e7f00c300c023883ae023d092befb466b300852a0db8e21f369b706da2c452799ad1834398cc67a0cc2a79e9aeb5693e19a564bcb7abfdf3c27ea399c9d51ddd6bdc79b80227e45e446836f8e8498fa5d25c7a665781023aaa013b00f12a783f95af511ebe8b0de8a69ffdab467c1c6366c6cccdea2d22bb8f6a7e8b27e85bcdec749220b320b549666a10cf5a64b9e2958209779dc5d764cd09c0e7283190622b99449510b37b465a7f55d5eedc78ae3426ed17584f69630ac31a23d6584d9d86b1b7ddde6f6ed7a19433131fb815eb949e4beefcf8db7ec637dc27c2e86259293886d1d803098af6574ab4e6ab8904e2f830348b37d4428b5468f8efcc0f17786a739344c403b65ccfd646edfecb51a0d6a6abdcf7634bf99c5de91f77713f022c38b85f0bfb378c2ea70387b28e9ccfef96c652a711bb345fd6c65332d3edc138606644210e21c5bd368288c0acdd5881b38a15711e9bf4849c244f1c736a0fb8b4404ba404dbb0bea8161d25b902ca3f70ff426668966ab1968fec4056d159aafa3b86e02dfe99a352205338d3143224dcd0f3a4d9003c6daa63c69d5de07e892dc7b1325987df52f6392ae45f560ec88a576e8b331c1cb65d65240293b83377087dcf34314588d15636ad1e0cdb55c6bcc4cb997937b5466571a75689ca666ac6c22be4cc81cd6d53e85a0fcc944bc235996fb62388175a38d1a8116118951df4f283a53193cfa51c93b2fe2654a5e21d6f47059dcb102b2122b76fdda5cbaf0d608aaf6a2dd26396457503a77ac4d9bce79b42916fafe586474f6f28ac57ec2c748518930b7c74e2a4f67d5d947e26d322e49935b25286f4a9c80d3393cd65b2c08d4ef4cc9d328dc8130482276b94e2c2f82ec33a77212c4bdb6f9e54d34d8309cbaa0634c0e49a4544567f7076bd66b2e783d3f07d3d3c1cf571153ef0acdcdef7d7031e68726593ac5542303cf8ef8549b36c03891a53e764a224f5065fe649e27b74dabb1961a3e24065fa7fff45f2aaf1f0c1af075d7e1e09ebf84fe8e76fe580e3e0a1c615bfd660381f4d6fe264880248998b8e547b19eb72f72d8f57464deafc7e076c3027ae20c0963e82344c42ec093b57eac9f3ebff9cad055dbffbdeb5dd3f5f443f41dacd5a7144169e0a58662e3164af8a592dd85dd1b24baa95eba5cc87c7fa996cf2d9730aa48720b7ab595b1e5fe46cd2710695d5fef2b918e7e750918129cce2a7945ed36a74118eb8f099ee68fa1bad4085448454a44d41cdf36550691e24b3fe690c6d436a14d5b0dd653b9397aaee78184341a9d724aad4f6a599aeb3bfc4dca14f6ec0a436f14f1572f8a30597b5af20c051e8f1393b2a4d8f1cc23230700c1da4ef34775f29af4a12de8b52a84ee43912bfa47a3bcbd3d8f08a640227b0b6f21e1e1c2bb8da14be811f4d4c29db5c3340b7a87b379496e18a27ec81c77f60794280c0b8e7c5d28007193464d2552941d9f30d470003817332910dae207711f8dbf274c2218a9557ec9385c5b6e6976498c1dc0bd9c9ee25e7fc9fb797e568fa6ca993e8e41a4b0f2de3e2ffcb427d54f10928987aa45ddcec2ac37c781fd1985a3bb81c61011d84b261bda34b84528539298377d59b3d231e6c51ff4090b1e800085e108ce8845e631435ef6573232615635970de99ee43e8e1af763ca16bd5acc2687cf9094409a8f720a35d87d20f351dd37364c34044e1102a30ceaaba32482ce6cbb33169ed88073dee7e0be0aa71783cb8802bd3b67fd3c32697eda563aa887d0a2c224fa6c96dc7a11e1d22cc310fcaf90ab0b217dde991b3e0d6309f647caf9800804802e5144140682b21846e48dfa601ca41465bc3329608b4958f3c58f2533aabf57134e2996a2c3f80fdf02ada5b31060b78378e599a858c46d084e531be6f61cb36bf738af333b1d1daf19939eb2f3105488d344f132779623eea308c5ce5bd91661843158c6f641f6d456098781840b6fbc312a6fde52651acf67e4021822d026c54831bdc586d690ebab25308a5778d50e52a0fcf5b584d9731b9eb7a2789f3496148c61c49ada801ababb42295e1f0959b2a20ec85051b31e39f91e4011cb4d9324a0b46de0f30feb79cd0330d8025ce3df12661a27c74ec18b5e3518e300839f1136a6e140f05e8a5535fa1b50019f44078218766fabe713af1b300eb5ac6250f80ef29698ff6f1f14c6de8d32bcdd81fa74672b17549c673a2bf3fd0b1155324e615dbe5eceea74ee0d22d1f0d84e5fb98e4c01be3319f1b0d56933646c58d9785db8375e1c087872d6068520643565eacf45173932a135bb25220b101b20c61c299226850bb3c31f8778d606630c4f825f13603805cfa60b922ba03ad98a38e49d85ce37c8bea6ed28919ea7053e968f33bb3c2c168d5b74e9b3823f187bb34c72adb12d9ad3ea15952661e8566df7424c43e3b1a45023c63c71623b366a3f658ce6b71d78a555b661766803f3fd24684494bd78ff7300715ac5d1c91de88e373e18cd5c6a389507125c1eb7c74f11aa189a70f80e4b1ab0dd059aaf909c2eb611b7e0f380af38f0e6517c42b9ea8353ab1bdd324c23e1dd717211a3d1855df5d96c57d911fbb3fb05b406aa4679426e80dacc88a509930cbeaff506eb44d53c33903dd3eaf63aee5066143e85da3762939bb59a681240437c561e99a09296a9fec5d7d9418985c3b5853eaf2470dcf9359a1d7fedff794234bb23856d764a691901d75847d4c253a1554c00e25d032e7e35de82a4d0fcfa091f97bb6a7125cf2e76e65939c596ff039ca69283915ef84db51547517976e2db63723afeb7e2389b133a25a888b62d4dbdf56daae2ab69c55b392c38480d49b87999482ab93556161a2b9409db2e35b1e52d5aae2c4b2f2433de4225dd5433bec4d4bdec5d53ae1bdd255b881905c5f2f653b9b8fa4ec0c4da1832b6aed9320f266347805d1f240808fcd042279daee0b24a13f0c564705bf3841f27e38702202e97173dd59a8915622bcce73f5ec8f6d9fff6963f5c5754a9ffe9cafe95461e6f2bb0a0d6d236652a24b4f9872707220998cb67229d1b1119dd2c65b8c3b1c7a2904ff466cf4e46e3e8ec5a62dd867506bbfbc3cd3fd8b52ac01a723995a7cce4b9a869bbd550d6b593fa8b1d43c3008e400bf0c05be51445a028fa6f70bc111ebcb1c349ad789a643a110b14890e6bb169e5373e3a414bfb5b4fe55e845858fde8dee7d3c738ef939301dadf3535eb5720ae86c148790152363211555007e9341445c65168bdcce55169261ff2f95a20ad2b2be39fafe1ff9ed9bbabef324755318a13e85fdbb78be790e80c554aa8773a6734b4b563c8b581ec5352a8e874b28b67fc8efca289195ffe57bceaa96e4ed65e564f7fa323866a3a17f1e03bde91799092b4f56e1f359d808903ff7b979aa1d59b242a7d52426c60d8eb54a88933ad7a50c528767768f2ff2819b3c965ce4cd6c946c54029137c9de5ed6f8c267a1d9740a8f96378e30eab00ad17e61dd1234f72912e78ec8c4ffc0ccb60b0291f17f0ae877a5aaaec1ef1a2803326414fbdd1329042e312b7d418008466cdc98f36d76b81a7435323539324b7a235ad94fedb3beb02457ece1647d2c7c93e4583029b1fac9066eff", 0x1000}, {&(0x7f00000055c0)="7b85463a49fd697d71559b662e22ca2e2ad02de5cdc5babe30e1c2ac32c25475261d93cf03cc2dc7cbf522536f0a81fe8e5561db431cf55207a1adb7de4498bc771886acda21d298437be20e6576b85cbabe0a96e42fcc2bbb9fd8b7048d1e2531dc7e332224b328ae185ba482778442f62360ea20ad23222ba5832864f12be98669a456ad347ae3fc545747a0b881ad2af2be3f80cd57aac53dfeab244e053dd44b666662670a3c6acf05e0d78ccc9a9a5f336453981c42654d793a31131497333d282c9b1da8f233b928b74880874ba7641fac8e19fb247f1ee99d70b943e7aee0aebd4758b0a949b6a6c6e133dd5dcba6f6f1a673d6897014bd90b02b89", 0xff}, {&(0x7f00000056c0)="ac9cc858f036b6b91a4ac8010a5df78746572514199e1849df41aacf337c77bab6e8fc6b192da1d5f58261e7c1a95e6ca222ae90baab043f831b8d9f272ff1e1b3164e4d0562668e31c2da4266ae11779719ee1e7d38aecf58b0637c081a5ce954aca0b6e28b65b59ef8b1f229d9e32400f4863bc5f2aeabd4d363fc8505084acee75ec7206e6d81e10e8083b6601415f1f07e63b442d3c67de9dc9f9dfd7cd489a22de5b3bca2bf6f3611c7ef855cd7084f7efb70358bc0b1f93ab0955dd99219ac0f70f2cf850c229d61f821a34d7ec6bc6772c3b544ba219e46787209e6e3fa7c915b859090d4207ad43998a1bda7a3155e21cdba38e0ee35f6cbe3e72f4a07d404db6bff9c58a28554afec56cc5d6b3e8e4862d9ad5c64c90bb71c32602aeb5b53032743a3477a0abfeb503bc2e4964fdb69e2d248160b28b79b190d2481c77c729b43785b289670fdf11d54ac84c60b4777ffff2b6cfd313c9141e13357b1e017589cef8e493686d32eab32ea89cf22725b75136c2861d0bb056750f676f404c0b40391e7d0ff43dee4fa145a69261104541928101b39bf53193f2d799ac2cb1151fbf8beb6d4e35f95fc57bc866b6dd2fa116e5b7b7774c430ec2061da0b2b7431241f4ee7643470bff38b81397d3a5932931e740835878f8ce2a70cf1d473f0e156bf099c01c156c8259dfca5237b4ae9064acd8f7f45c8da776ced240d057c685d378a3dc1c6c2c3657e4762af5b6c211ed04d1592d49969472093f58a075c363a9593d513ac4a9303c39680d779744f27a7628ce5eac402d2ff1c70a1dea88b122b89eeddec5b94f8e5b31b736eef4825b48c19b8469b87076fbd59218f6437adb6b846b7c53346ee396879afd7f531f7b5386d8be15507ab23eda071cb8d8c8916e862aac3b87cafc6bc9999a2957a5f07d06aec8ce30514ebf60e80745f09b680b741dd1301b9c750a510b4b0ea8f89aac81667385f67af584111330b24b4857623f9742866ee09d04562ce91673a23d2ca22bbc730f6c4fbd54f21db017aa1009f5517b50a45ecf6bdfde252d7a52429858685de61f4c5a17286475061fda5a80a3cc5910db85fd344f5748b01ec9ee9f73b36fb7657213f10610ebecb5ff0a3dd6fb2f4cdba0c959e59b1f1791fec7e50b4745924bd9de9a791fc68d5fae0b87b8207b9245ca490a6bf85ffff75464b0b7723d4b83f7c2730baef78495a48c10c2f9e0df688ddd3cd2997afd7c6105b121d0fc37d4f794f6354d502da1d759afdb2784acca6436d0783f04c356f5fd12df38a615ed289d34783150b3ed9f3bb3066dae97d005ac070bc19c7ec5e09e1edb4731aa4439bfba857f1cb08877e18f4ff9c3a670b9a99e11033a66799c7f19f85ca2f2ece3eff473a668f456acb0aa3ca6599ac2a0b1f65fc60262f1ba3b11cd8156bcf497366917fc9f3a3d39ee2df5a69e4735d4b8228ddf41a4a726b012381b08ac1f9d9c0ae4f21e8bc250bedd15c6fa7ba69e3a2788e9c68f15e7d64ac12f64280af62198772cda2d2d0def51a5276cb224a5a998eca0c4651db45ad47fbc8d0949bc991b4b4c501685dacd089cc3ee5971ebdc48adf155c99672b96d69f0438773da971c95730f3e6115ca33025ca5a56801310cf3ace495102c4d726e29d3d4c9fa55fdea86298d8489be8c00ae0e6f657b73defbbf10454638d80d4e9ac767185701819914b7eff9a14c228a47aa661937d0375572ee6fd003db7867fe0f242122e873a52dbc032f0b0b054494982acde94fa99e0dcfb0aa5719c759056499fc016012de571c02fe59b5af3f9ec172496991876462fb4832d7e66f84693c94c22b58d935be918cfcfe98ffa97a91778caca1e237de18823e0f8d60f8c249f9e7f65b9f199699ee2925f1dbac3c800876da61f1669c5a547f7f9647c9f30d7bfe7eccc20d61a6d43f6834fea0d8cd588f36e0d872840c7ee0746a40cc0c8b43db95dce25989de1bb890b08058993d1f383d247cb7a48aa12d290ad58a57fee17f46abaa2cca3a34431ba405a2d9cc19af1304c1f63a7610d1f93a760e3de9926727ee7f8de333b5f9d259ab073f7a3ff4e593d41b040234410f526df3867f8f5dbe2e1574a5a0903729a3b6affcaac988580350b2a9f113092c1dea4dfaba75436b2dc7eaeec1bd4fd60a203507ad44afa8186bd47ad5e1e39c7890f6614915bbf92426f6712383b014672669581fad5e6bc979dc60250b297c18814c4c7d8e5b6ca1158890c26f3efea9ca17526d1caa99fcab552bf98ba86447cf6d02e974afad3389ee05d6978e6d9d9bee684a4350b6a14aa14f165e0aef7a7d09b984ecf61b41c5da811fdedfaf417017b68831e205bd65cc2018e4039eeb71bfccb1481559c5aba991c1b7af1c7abffce70a139728ef985ae13f47e89df013c22fd305c6382e500e46510bebaef1d749fc976b7e43608c70d3acca38a33fb3ab5ab6ee1a8c0229572a42635a1b4264ca992be7909ebb21c2594ac0bc849c11d073c174c3de55edd6dc27859cc7b82e885c5a1fe0c73a1976fb3407f627e358bb0c7eb59ba129a1809c5adf833fcef2d890d7624d9c3079a9e4e0f3879b8ccf24687c30d036df6ea79873540634815d15e4773b67ab163f2358516cc648b5f2cf7bec592e0aacdb02612ef7e55e03775e3e8532ee3134a7ece94e096f64cd22052afd0c6eb98fd70932dc134c93df23f7ab310189980d7993e3134dde5d104a4251b060384d94c70c660e421a056a97ae3fd53812874b3c3803e64127455444b30a63089253faed0a01c56eb02d8ca0fc9f78624cb710a0d40ac5417055ffbdd3c53062f15b25ca165eff656ae933985ce869ef2b4f08b9cde1cb6f8c54e0ccbcb98a9b2e3c38d7ebfc8d8ddc509a3eebac8d6087c8a04c285ced097ed73dc65c71eeb147df46b7fcbab13dda4fd2ea88253c639b3f7544a582c0abdee59db279581025107ba1a51f4a75181d3b422cbbdf31f498d3878208a8ab7c70241edf57d059ba968562f11de515a142d078eb0a6cc09bf136768145e84312945deef9e8a744413c02683b19007d0e1dc69b267a14d85b7838235c372e3e059f55252b7065298c7e3abd960a6652423c8817279caf7e6b0a24f8f9f305f1a6a661c4d7aa97b474e5560139320e9b74aec4d142acfd4db3bf33ae9c2c105fd05e3aaa866a717c7e7d8e8ceb21f3d994f0b1d607746c072278beb0f1fa2f330304565ae3550e208f48e0eab24b9f997a7c0704edb3c6dd21c40dc493c91b44761bdc746c6ecea253a8b618ae928958c8a870ae77b2f3ed5cf4b86bb79ba984e9d11a037e354f0346ff9d58dc6ee7f61ac7115a685ba54fa0c3cb9d63fe5a0b21acb94d22a07d43f5d2eec16e6e303e48442842a72ba1e04a81c09ee9fc51ed0bc9262923f779126c3d1ad7f72da0b7d6525350c79ab00991dd6c7c021ffa03f4a9aa95cf9ef655a8824796daf4aa72443a10b24b0fe79091279469d0ee6bc3189af27ad6a389089c65a6fffb6b21fdd704a9e923062fdaa2b619fdfe2280180ae97bf6d66da9f9bc6d3f0ab7cef8339c743d5e92319b8306067af820de4541b7e2010c186934cc3f601d85bd57f8615d086eee09233a464306942d12b631d0c0bfd05bb7e826cf6f85befade959e89f4a3988d70fbe730ff1ab956fcb957cad91e983e824cf366deb82a7272069b1effd314a25056af3e2e86085726be3a57827fa7ee1711e6406ded0ca389508be7e78236f838cf2dedcbce732ae9cb4b39bd1f71feaf190a633819c8889b94ad8fc75bac10b15923ecbd9bb26f8d89fe5c86cbf015da2fbae52a0d7f019b4c8512113febd7419ec0fafe8c19d9af839026f27858e00a1b69a227169a8587b6040d15f903ed85436414f9c2dc3845e3ae449234f3a3c1da4a6106a51e5516fe9f8e35d174a260fb35f561e4909b41d60cfdc2f19968def75b180140c401028720877e30092898c7d79fd654590778b349af07bedd4688a0d7af2b9917dd6f2141a67f958112f8b535da8ea3244b16eef56ee83f5e2ee7e27855ae7d97a478f082ecbb9af49fb2ee4425df9d692c7c91499e13463df7f76e873e871f60baa2b657a4d3998495a1edff08047bb1906ca49501f3b3f693570771819671e721cd632413d22dbdf9a1a2f66767e075801435299760d15f1a55f06c6adc5ae48ece75701913a81658717f6f6ba8f5aae30ff547a6beda7d0e77ced2c6cddd4d7837dfb1d86b2acaf01bbc0ba423f7b57471d9a30fd64c1237d4fe55c052149ad355f69b8496f595cb4e81d3dc3e6321106511028437d06734316750ee87b98b6b8fec585137d3b3d478c697fc4f95aa94ff7e5a492270badfcc21c064057d5454629ab120b3b198004cb87b8a55459705ffff394c8feb8c6770a2bee247cdbddc1a1f1281d3158de05073658e5c2975b882ce324adebc970d08e7ba7385fd1326747502a6a68234472b31a4ca351b4c8360d4872864a3e54c7dc8ad5e9db3768035fb2e99b59c41779f4e38609c5fc8e3db253dfd327a5c3036a509d51f8252f786af54196a7573af71053e8af0e4a21b3cf8cd0288cb963d7a57bfdd48a59924439bdd3f28f5c2a5dda5bcae954108274383096ee7ed196a19162f33cdfc7051092f697a5b726cd380f8db136c0474285d44532240870b6feaf9770de9bd74cc6cea3313b413b7a8d302524f6a91932aef20134ac980c3cdefd268cf12da1b325af37b6032265e30133046ba26e1b59a3810ef5355b76569da9719723f739aae048f8d6f1df49dfd62b6a820d6d868ffb2170cd5836c8e6ce7bb9b76cf203a884fa355b07ad7e53fc4d08780d7ef048bd9ce141a5573c8bce7f2d0c0635ce8bba4b27b06bdf5b6edf1b3a33c01b1fe8d7f2b5a16c903bb295a0793e6de340441d46e01e998271a0f1e8acae96288aecf98d03d675fa87d7b1e0833b5aa619f44c184ada09c0d51481b696fc458fa4605d8e8adc0f32f9929ad4f2743207c72d59a6796eb8ca5d6cb1d1f8d8714437c949632b6ca4baa8cc2d3ed63b76e5083429ddd5d66da66df7cef4a552ff384a084b1b490f1fe31222f77a5c9202cb819db0aa1088e658480df89fb869cc6c85e8d0c0e0341bc546e232e790098dec1b50b90d3a57648eb72a3fbbe7357e56093ffcf0713b54f7538cf54b3a52fda5243e8ec0a6844b94730f7238fa7db0c69b529f699ec782125a7b15185348cfe2c4367269afed7cbfd741575638d3615fa52d8aaddfefaf24a5d3790a095eaf9bf9e089c91ad3d3c56f41b9ccf85f00053ec870016a8d0a62f2412f6c90e50e685af23349b76e3e993ef98acb2c278d0f6e5001958bd02448159df00c8b7fd77cf8a7bf10772635d34972867e5afc392f9604dfac864c955e8d61d7026e4ad19773af333ea4c213fcf5a0dc80278649c106bc03b6aefe632609449d4af17add58cb8e4208ee3c9e7b0e6ffd524546e6134ef5d5e140ff06b8efe99f5a92f5489371957ac65785eb41927ef2c099c6c9d42ea124fe3f5f5fd445b5dad72bc5d156a2cf0e9f22ad7c8f72e0bc1b7030fc17d7d3318ff5531c57d1520d98c4ebab517ac102d620a2eae7f55cae1984f6b7ea3c67b8805ee448f31675eac8ee5bca9a0986768284d1cff8047bffe38d17cc352af402fa9773099bab3ebd7283645104adc3c2a65c713a89b6ef8e37e49d63feb1178f158a5dc67a250d79b8d8325c5b9a289b2945f7b080b7f4b82b3f4b9bf764cf9975b1e4b77185df13ffbcc8df7973b34bbfcb", 0x1000}, {&(0x7f00000066c0)="ff7e4983b00572", 0x7}, {&(0x7f0000006700)="3c37141abc9bd3a68060bc822c62b552d54e90b7bf393a8afa3446370a81b8281dcde5fd6e980ea843efc7774dad40a79c4e4ff9c96425a0ba973303397f5dbbf9a633fb40940dbfbcc9fb0fabd208577ffad5ad05cccc13aa80292afe1b5fedeb57ae41908eb16a5b19ad72", 0x6c}, {&(0x7f0000006780)="887d4117dcab6565c9f1c6029058303a4a81e20b3c6730ca28443e2311e2d23bf575f3d8c273001d5630d2fe6cb1d4da0676e7bdd8c92385fac739368bbcf074b8b5a97ee2087dab1d76b7f0332bed564d2d616dde849504cb08e280b480273423803e03061d9dbb7c63b18b3991028924d67b18f51b555430ffc289eee694d7ee98b44884a926b33fab0c5ebdce1e42e4b4b54dd682c2482febda68be6dcc4fb8b6f4a652b3fb945e72ad8849919ab3b7e7601fb500d4d62b9686b31db30228783895f31bd1b80b94279eec01a6e4b21f54229be55856c6fca229e1049aad2f90f99d6847f73635ea40e44f44d1b28e0c0d2df838d40f116a5e9cfa0683c9aaa1f6da934dbd9efeaebda05f94854a738a69bd401e949b4f042384bb4a24cac6b511d868f77df9aebde8dd05ece6117460f3b5523796b8b5f82d5b97d0c354a4e8a5999439673c044115376a32a294c3a547abfc9b3ad9d0b8b63ba39c85a5ae59234d0357c679f2b3e58cd9379fbc8feda4df234bfa3312a645510d56d49b88ffa65a4de8ed20d153148cd955241189dae92f285220556570b22f70b0c17be1048a1127885f38b1d767cf77ccbc1ee4dfcd40516ccdd8080e164adfe5a52bc24ee02d57cf36b7c98f56d6d24f1418d2c2eeea79ab8d56971e94e367cb7b1a98fddf1f426aec57d5107f532f53601f1a6cc80db725e2cbddb54afc667ba78604635b9ee4b8710e9a0b9ea4d305883bf2c86fdbd802e6cb47429e8517ad42c6f20fd8b8b70983b93c099b5788f5ca8185bf5b45d4a98b8ab96b86e4edb1bfef68f35ac862570463cc6078568696ec22428f4054da25c819a65f5bc2aa66af571c40e75f87a8009fa2c27fb8ccfcccc0f0303c2f896b8791a237f2099ebc0adab104e07ca1974b1789437843bebe2aaea2ffe76332160b721a988c4a18954699c93f83681230d0cb73db28a2639c9d17c80e66f8efab1e6304bab9e784f8f3f142651ed1476e0989546cbfa28471e72f5099caf92273258ae8c951e0c5b9e3ec066b76376e23d24095432af3a035e9bdfe4db32cf5c52d3587c0eae8129c20b0d7d0606e606b2077294f62d346f7155a3eecc47a54e58c483a319252c28607b1b42a5d62f7a9bbf1606ee08a86be91f4e54632749e0f6049b6df337d5b22a3f9127e5dc48ccbe0c074f94fd529be634dfb76205301366715cd2afc725d095f96c33869d4a298c4c7c86400ba5630b023e185fe287e1c434fa3c6463a03f0c693750208a4260765364e8a15f7f584cd7e3aa5ba33b4384f010fb69e10138112ce9748987c9d9a5310b42fd0f67cba2a093f11ea7f034d09a1842a16cb3ee8424c71ec5c6a4fb6251017ea46931f23b483dfe744411c41a21c3099beccf8580d702ef6f317e21093f6ddfc562a35e9ca6dc6f09b9f898f7937b048739ba361b1cac2895edbb555fdde0cee9062b4cfbb048fa510b2da2e442985409a42b8eb23d8a91f1a1b498a9c56d7900764a1d79eda73a214d60e84ff5310f552475602d829f2c56674df8b673559353262d1bc42bd65da8c15e96e97bd76bff6b650d04568b15715050b734501216ccfcf77e545515e321441d789630b0966e9176898f6a232ba3eb53201d67f593f1dce30cd724c52d147dc4eb2921ea1d46f03a8b4733671956d1c8bb89b1c61880d24a6ffa3545ed79c72a166b3fa6f0ff27a5d2c11464a2671712804ecac6303e3e2c70ba8337cad1ce6d5d747c84809f3e54f29fe6688c064e5d868592c5fa8dd7c8b2206af6f165a262eed83ad8f6a476ec07c8294ac4a58adcf5a5aec12d8ead638417979d928814e87d3b90298c6d6155aa8c1fe69ad765720e4b7989644e21fb3a01a737173183d8e6f15851f2871cc1d85c4a545ead983fae0c495973be8f27d3fbfd776a6f15c390cc0eef6431e45fff16c198dc649ed800ae5c10dd9923cad662b845475d169ea98bb7f32b3be91567f96f97cbc950beb927ac47ae9f16fd5fa8ddce9642fdcc4924a8c5e8dbd79f1d3c784cbb095d4a82e720718f1aa98c10b026fac92e96f53f2ce69465efa6a2e0696678dc8ac3f0b652d7b5e6fca49aa0d4ff3cb484eef8e6b549072aa3ee6d38e9f1e35845242ed3b0e96535d01e9691ca8390b42f3181d286a69e3feb8f1fe9ef19df70792f8c081fe37dd6061c429ea85c1a597ca5bfad8fbdf1729a429be7a8deb663592d104ace4d0eddf59f5380e2ca0e5adef9399c301e8325411da77c010496a658bfb4d2266f3817553a6b5e8f38b95e0896312731775dd0ad68c542e0a8161d581a7b137ebccdc87a5d314bbf6fcbe9e78241bc4346b01a81b4b27d13ed5a36f911bf487ee931039185f69f559099c9192a490ebe68bb9cc314872ae2380a14fd80e682cc8a3c191ef8f3533902d5f57c57f423fece9c60ea7fb690774b3c6c297f5e298f3efd5162d724f7358f59aa10a83c86f7137e2478732e1a1b082ad0afd81f064ebaed090796eb445daf1ef7d61a1f47f59b06bc260a99edd531acf795e7fd1b945ccf1f0235ff1a1f35075947a345f747b6d47cfdbbef03b30cfe81709f260e7845fe3fa0c6c3567ad0998831b68a94c742cd9e0c4a81f3774b4614a93c8fbf2ef619010d09dfd7e70805fc48cb9e8d0d0f55dc8e31422387ca0d5ed8e58be6d602a4ec8e00ecdcea8e3aae223087a6a398492b29cff7cd6b960a934f59908d35dcab0e4c7cfeb4144b049bcac208a090c0dbc810636e52d9a9ff376148d8454817dc6a1bfaf8831859a2693ab121b281abee7e0d6ee81a24d1ef3a945458a2801fac2594a5561958cc829982b818e9e1826a393a884f2e56dd4b130adf5164333eb20d4b75d2c6f7d9ae6dce7c2133bf04a3b8d096b427bcaa6a2855109cf678672a1155a22b5a04d00acb8e8b1719f228b2aec5b51658709801821d3869a8cf0d9dd111986cc402efc173707975db477f70922e0dffad485e38eebc508a3b7e3c78adaca2ec5c77080f65562b0f0665bd2604901ce3bef1c6788f2bd4d3ae607ad56be8c0cfea8fa22379f498831b94d7753f3f29f895ab90f183db428b55f3a2764eca8d50ea8779f0d98c78f5c0abb901ec1be3f90fc8aae15d4b7f942f0fc8e830f28bb1ed8b830807dda27019bca5f879d2e14dd92b3e670a83a5c4907f5f7468db3eba9779e0bbc6ccd600abf9403a2dda571279f6a3038bab320097c312860bcf311794cef096644d43de0fccfecb8521c290b50ef1ee9bfeb4feedbdfb2db2a1c3f9ed2a82afe67059449bc504d804910c42a295413c243aecb4a658ff8a2585eaac4bd7da32223a59cf50bc3d3216444fb277dc3db0615b8f8fb4962488782919525d5c67560ef8cba88fd674e8aea84680c18e13ff955d4336a35324cc383a8f2702e4091fb03271cc1b6544f7d317d7d472f78e2394091a970b61830715f5f27073764529233a55e742a8b14082995c70c835dd8e9a161c3814c6b4ba0ef5fbcbd007dea73a28da0ca12e6595767234bf49b788e1e0ed6989461c5192768acfbe286765ec993b0b5c6838c88a9e28d30c163d74840b105d633678944e76aad91b36b4fb3ece4da3e29168aeda966f2d83f14ebe37f7ad15892617a958e7802a55b90eb16b195d10678099ac792b2199ee1ecf09cd443ac90bd4bb613a7ca9f7259b6f27daceec53c69628b338c4adc519031922ed3d018bbe028f7e4a7d9c1716aa417a9b7edd7cb33ec939dd690edd310f07b68fab2f95c220f6f0964e40d3a0959188ef8e20646d38dc15c381ed40e7a79af59b3cf89c1a8b290316096b749be762b8f1940d8ef5ee8ae2253523f59fc8c1af23d583c491657f215efd2575a8f7d03532e4c515129dd1fcb95a1be9aacda6705dd30efc887d2c03c18e47422f3eebdaf2d68970752e2d9190c1a0835569c958f9b7ebb651401aaf07451b89cd83803e5e1074162e0eff7a806a6a93d8e3e1a6587a4de1d2e25a40efdd22111b1f8456b6059a2d2f45dc00133bd8cdf370f775bbeebf11b0e6d00e054469ec31580f7ac09a1a3b74f514e58f04d3cc611c3e62b385f0ecfb99a8aebef7f5b569d7f3bf873a70ef9b8af15b037c402cdc15ac30069a23dc6a7129e6fc8f2d08ca6b91b79cf00464318735cf05374a837645d6ddbd1a6ad51ab628563b497c999cbf71cd17c586c7ecd6c85b196a491dfc6815132a5d139d438c13035a4e4e8652ec2027ae1ca13c4477ea67c00733a647371bdfda80280bc875c29e24e3d942ec9ec6b6308044cb17edc213e6e9561bb516cd0f7f0bf1107be6a124b786b420f6cbbee27c341dc3090a015b2190919c51f3611ec8642cbc2ae4b3b97976562673e0b288e071545a82f147ffc75211d16ac2986637a36f23634b976e86adfb96f65ae6d40ef6fa1b89e9af5aac3e2776027edc9375e0f77d71ed89535c29edeef326177d30f129d38e544883451e2589a6b8963ba7345ffa15a3245a42839695e5ead7074963ba9b5cf41da3122e291b2799756efbc7c90038ecf8604bbf2e702ee56db19c997e317b3369511ad91e95acb5e26f0a195134ca6c5512d8a5815fc84dd2b09207d9d6cc0cc5f06c692b7f855aa2bfc2ddb2635d3b6870a600dad44bd8cffb5e0af48534949b86201234b0ea878451e3391c5f5630e0e81d426de20327dfbea38c9ae70ef6c8d659db8c43e9c87ad2c80ff8af28882b604857164a84223893f39d894f59fce17d03955ff0f41a61006bff7ddcc7bf05198e0e94311046ad9b4cc113e44180dd2830272150f0cfb3d09beaad4b5b9498a69fc7b7e50982ad3aa3fa07158c616809bdb6cdc6c2d4dc7ff78ee30cc5e8a52850773f40a92b0f5c4141517f3fe1b337861b519a16dd5092f608756b722d0222e78c1a5a63270445f916033df54dc277751f7b9f8c6d5811379d7669cb13d22859109e887da06569997b08ecbfcbc7589f28d25d75647de94ac5d43447f5f3c27f9961f5db27123fafd731e3fa930a7db7f094511a12a67d15c8e00f4b6cead6dfacbbd1705c549c2779f0f9362e9c0a4266605a5a183afa1bc719de7311fa2314a851df3019e028ff793c4d1702efeb678c0d5d71a00203242b9941c51c9b1660ecd84c8fbad0a180a0ca85ca99c2ebf2e42a5957dd561ca73de18fdaf2b584bee448282cbfa23014a9bda6455cffca47315419d86aa1659ed0a6220a401ae17003ed41a7756dccf14bd975fe1dd86c7a72489a033191470fa074c4cad75039e571a257f50db15f89e0140f552187ae510ef21cc94fca8a26e093752b7e911ea1530e7eb5a3da89126170f4be03a727467eaa453113dc1cade9751e9fd41619ec35cec8485c7bc74d05612138659915f0a8a4898f40861e0778d76ac0e2f3562cd660c34687d4431683fa5b32b4ce05bfee32588762bb5eb578aebb658b3164bfd3c628a82cd8dd01e59de5eb4912569c4017e739d2c9b2f6a1ec99888f8385fc42604936419b501e28b0ddd65092cb2895adb2d4141cc3daad0010c6bb71e03e60c62d71379c09a93224e086a3c91f604b3821e097827a301d48e62e70cd48116d7be84c00fe9503281ff02eebbd2e86d004d15c0885c9bc6f18a1250327667b1eb368e0b0dcde081394b655a80f805116c2a317b8de4d4a373b7fa3fdd8177618f3fbaf667a7e843e061fe683885ed57f19c1439223c207f56e36dd633c079e75cf436040601d6dff68b4f0431b9c254dcfd5a598ef71cfc270e35e4a8880a20af317b093867f240aa6ccb8836a68759875fd209ea90bd09", 0x1000}, {&(0x7f0000007780)="f14dd27264e66aff8fccc44d9be556e873ce3d08d82314b9d16162392d629e5dbef0b91f00e45f30e5c12798a2885d72c92fd3b7690a38a6bdccea118fe27fc4ac1277267e4672e1f28a0343dcba6364f52b5b4569ecb2", 0x57}, {&(0x7f0000007800)="1b7c0b300980270d6edb7c22a784bd0b081e37c6a6fe91e5c24c41ecafd884e1422c0ac79d51cc9f21e0b5f2c949c3caa167a76f4e33ae7ef2a4a95680b4646cd740be9937fa91b2cce74a93eff52c9e8f2e707dd80cca3b82f48ca22cc5640dc194f3a60005001650862b2b0c146b15f151de16b6c54b5dfb679e71fc284f1976fcdd2c4239c507d010dd795c4d356f87951e3c1c604d5e8d99fa417cc578b2dbd6fc78fc23b49a21bcb74072b910b27cb6d5191abd9164c13a5d083a7b3d5097a2e4", 0xc3}, {&(0x7f0000007900)="29d46d0065c5a79a818ed6328f407624b74f4fc3a9497d543946a29e2519356ca1ff92a11d753ea02302fd52513596aa118d6e760aa3cfe80ca7765acec871bc180c765981cc7635d1e89339d6e98fbe114d7633", 0x54}], 0xa, &(0x7f0000007d40)=[@cred={0x20, 0x1, 0x2, r14, r15, r16}, @rights={0x18, 0x1, 0x1, [r1, r3]}, @cred={0x20, 0x1, 0x2, r17, r18, r19}, @cred={0x20, 0x1, 0x2, r20, r21, r22}], 0x78, 0x4000}, {&(0x7f0000007dc0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000091c0)=[{&(0x7f0000007e40)="375c3dcfd6ef2839fb722d1f9a1eb65e76655c3a8779ae5455acdc4dd3fb0cb886f0f051dda996523f3e823f267799703cd386e297c1dd621f002978abd2599d755acd3f5a7072dac4868da139e24992e4bda24887ec287c48478bb3bf06202d8c88f8e3ffd25d74a35eb5d1f4124025b0e48a55154f7c968648963422c09c75474daeca6c76173c2c7a07d7f2dcfb9a73285fcb80ad91aaec3ddfdc4b720637dc5116d11fd1f2ad7311958dd3e4059b0d70e54612ebc56310895749a1139b6c8dc9afa5fe25f342516f0377727956a9fd71a4dbea", 0xd5}, {&(0x7f0000007f40)="24abcf177a67bbb444758fe2b3b4b050c104983d2f5827919bd785ea666e03d38965740d5db8926d23224f86a558746cfdd7756b48b4a8e1e20197bfc4629155ff5f80eeb48dc4b664767cacc0b3a4bb69c1c1cd9eb112c37ed24debb97c1a927a8f57f93b04a3dbaa02da56f3743a39b05470b00ec90f76fec2b9", 0x7b}, {&(0x7f0000007fc0)="b1efa03d386977355b45b69958c4053e2d9b3658fa076a941f3bea1eecb91d5ddb97f0e1ae4c74d9ff0e79d9b8f7567a14233108d66c66b2001399fe9dfe8e15bf949165c1a97518f531061528f16d9e23d04b0f", 0x54}, {&(0x7f0000008040)="9ca89de1edde84472975c19580b90ce8a1ac7657257d5b9f94b83b98e272ea8278fd2b2a9f1725d8db21888701c83e", 0x2f}, {&(0x7f0000008080)="b5d9f43be8635d44058f16e4b23c317f5fb79e6ee28eee46cf5a4c94a0896601a24a85a507c3187a3167b78a7c78c0c6340f5a45f857412526656c2ab7fb4cb289a0fb9f545890aeb842d5addde2ca806da625487b69472ce58805897285e1193cc9769512980b501b9ab1ab51f1722c347864c0e838717de5", 0x79}, {&(0x7f0000008100)="b4db179f46d23c928f4a018eac61cd5cd2882d94d1ab12d3e03db393824712a5cd03774da62bda70ca63b3af1ad67220d5c30d4a3ce200bc4fb933dd34245a80823fc050766d673ef76f01f0841b1e06fa8cbfaadaeea95dafdd951a6b18d7c3ffe350c93525d9d0de57a59e191f4a51ae1e28c65d5be27b92ab1b2a3e832f1694aa1fed4478d96a839cef184d038ed9ba1ae649ecde38c0bc96f50830436ef3302542685bb1ce708eb3809bb9e1f0d967858e010f132fcbb7f2897b8bbbbe002c8f142c54fdbfff431e4a83779668e39d3152f6affb45d78a53de0cd26312ed28459d7ec4e33608fb2f1a97edea2043b8caac72b4144e60fb809cdfda800fbe090a83e05057c7ea6641acde7bbd87f7b76883f882486afb56f2db568d0ce2bb10604de4f84727be9393e26efc4309e0437e163acb7979c629467d452aa92d6c5cd967e9f43ebd57afc4f46d8d88940b8f4c4e364e3927c2164b20f090c153877d30e7046073476d63ee0a3151c312de2d94028bb4531293ed3b323c8fface97c6871d37403613dad10cc03f5b465a9c7d46ab32874315d8f8995c84aab2c4384fd31017500206292d5ab9c5543f834b22cdcee04a498f53b8b8284130399afcc20832055935908b6b4baac4146e2da983a48c3f56f414e4d71f3fd30b785fa6cd4caa07cfa4362e3ae797e49be948c5295ac5fd3663521896ea76e9f23a7ec1cc1fcc4fbd3ab9552413fbce47910b8b37c9d1b7efaa9dc042a766d343e7e73ff3031b0c997de7bf54e7a1949963bac09edae0bb8a1e90a228dabfc7f702cd7b6524985204410e8b5f359799e0db557f5dce069c6258ffa58f2141da7e1af749e6a7eb95098acbb70c18d9cd525d1e2610aac4b8af724627ab17818d796369dfe2a5e1a8b68fc3dcf6a0ea4d12021ba45ad4d2591941f3639305e9f463b6c7dcdb3d9621a0ee810d47f98ae09fc8b9bfc40e7dea06f95fb507c37525dd2b03832e7297030624196daa5d5741617b8b481bebcf8f603bb022378676e9484385c254a291d1b8305e9880c7388dd79a521ac1b39697e60764f2c430f0c8280adc78ea6cc320ae04d4e0cc178530cbe214e5465b21db62ed067048ad8f86890691371b4bf625b5aeaae1df8c2bdd69accb857045f9ca07de55721333f374f7ac51e2053c59a59ec1268cd14272adb21846864512974c6653a2090cfb14711af09a5f8ae1ae57f32a4365e73bffbc970612aeb2699f6edd748621aae76f67d934192e875d8fbd00d731dabb8d867ed18243ac5ef8dfad213055ed2374e615f7406e777ec1bdc698d698a2288772777df8c157292974e55ac8b0985867ea1aa2f35036efab13dd5e4d67c3a412f4c6e8ef0a301731fe4b5618b807a9dd9ae63c301252d0382210c67415822ff8c6d22fa3e00208ffd51814cd085732dc4be2409bd2a1edd2cae699ec31914c7ef54407ab56ff45b84c0d6a3e578d99f558b66965dfd6ee78617a11f27971bcf372a3f5b7af14dba78b4c19c99381001f603656c85298d21a4dc86f3e0c905aaa188f5d40717a3cca3a9008f1dabd76482c64e730d912a6126255871fa9c71d07c95b02257cd1285b989e0190eb850d4d0e42a47f4505b1cd7639ebc534db094c7c08cb93f4b80967181adb917959b57a557d819efda9d1f64be4ef2fbcb522ba0ec7f04dc0cb46845d201f977c27c36a61f1917442a7fe15bf7e6f257fbcb032353c78c01a60e1b364c350a57413da259f6e2a51cfecd5f9d9b4da1af5afa7942bace857d46d26a2923c51b9d7a88718ed2988f780bb409f21750695db4f51bcbdebabf95b96af6abdd0e0f9a23855c1a3d3700a2e8572dcbc533283ac02eaf036ba31f5aefac1be08c1b6c115b0f832dcbbe77a7903b76c78437d7862144939ac37d1a8e2144c68b233cfd330d1c04a7240993ab85ce7ffebe995ddd1a6d4fb78f746fc16206ec7eec4428d90f175ad8e5361945c971d1e814e4dac71ca11392b77ee6f04b54aaa987e174137470ffcc073b51c76faf4630db7db021d4b9c27280796c72543bc6942b2379239c8b0362b28b78aac4badf4dc514a62fc6363c327f8f7a322f4119e839cf2f6472aa41f990e7091efa1be7070649a827f2fa060a471f06dfe2de5b5a6fbe5300718238ea922ed56cf522ee4692a13e95c0030f9906a224a4ea9e5b4847b3db72d33b73bd660dffc304a42c2481b1e47bc464a49888cc27a3b46b67028126bea8a55df85d772ea43477e33e4cece36cb4444a9be050c5ec77d82038c858d1185cf94f1951cedd2a34acfe6174e4c1f00657c4fb58f7aecf039fe15330d5527ed6a6b9b2db1e25d25d20499cf42ffb7bbfe4ce4e850830b10a9373fa86b9b17e02d72ea716f82404108d6d0987307bc24d191f2278b1eb32696b2c52ff315a8b5bf9493c88b0f3870dacb561fbec9d2e05957d07a912e4d335cd5a64593dde235e70ab17206cb783ca9d4c288d76e6226d15076202864a2654af809d68a4cf513dc35aaf6de2610ee17cf233199952aa1e529d331559a6fad2215d78c0488c18f11206a92eb21de64f14cbea432f4a1bd74de65ec774f20fa5c12fea68699c0935b976ceab7b2de9167113f8f25032d619932ea0a32bfcabfb06e21c52020870e74cb5d96e88d04df83bd2224028c22ecd52051ae80c7e62e3af93aa3e82f46c239bb3ef389ff851b75abdbd1863fd9d3ef545bd2e7e3d70b2094c2a191f8c1cd6cf67fc1a338fe851460a4b8ebe8137af577ac97a9412b2255553f83cb43dbecf591dc646825586c827eb2b01888f27a5c948f0bc0d20b4e90489344e4005762d1cf045fcef3c2a9cb79f32893e0895400f943ddeaf43b7cf1f37f5a06efb0996de14d3794dd80195f3f5c168e664e135f785cd2fd74ed3532d43866e3d027646a9660ff5a0d241cf8cf0ab3de4febbef374e3918be2c5015803ea414125eae9e818fefffbe8e1109c1b826f0b201b40c3fbf7105ba820dcbf4cc7e58a0a33347abdc1932d1f169912df528bf0330ae40ea5c5ed000ad752886871a6a03f4350208c5c270e60c316787cbc82bf067703088404c7804b79c1612b1c04e3f22a6429cfd93245d2261f8a5378916fc7c4051115b584ce02007b0717ed2a45fc6ee30fe60cc8847ce475f23c6d8ecfeb43416945476bdf5515916b98b1bf063f765ce5f7c141ed1df8de532918d5439bbc55afb6b755e2d9046be10a215fc3abc1b7c6ea6bb3602a364353c28bf262c213812b5f08d955480417cb246e4f2c361b0ea7f241e8e236e4c80088f3f730b5b181bc3a11f12da74181f19f159d91c084d2c9a4e6e95d031f6ed61a8bc2b0a34bbc3a5f3926649e4d2b08a5f10dbb0034f7756df1d5366c9737ace27d617bb5ab195e4def162d9dcd39afea6c5714b2c31b047937b00fdf6ec99f470da49b41fdb72e8679d3772f5a20297623421b809ad29a746fbc795edde0d3a0bb41071054c39713da0cf20f92d78eac1999b1f7d539d06eab9d12d2e183382a3cefb668e9430460958d906aaa1e6e2ce055bd16ad7dfca839d06a65708b3d476938fedf1365b141c9a925c528187216cba9ce0469284c2e785a8ee05e19cc86c20c48d726b72e738114f48b4d8c99924557353eaf091308c471feadb587967dd586d81fb177a237fe01baee84741193ccd7f787188250c099e0e5f0510cfae4c8a97e1b1485cc0c82d0de987f1162557591b1603db99d8796ce04e5b7ad6a65bc80740a139370d140ef4a24a1c90ce5496132a31a15b0be4c492452b9c608b99d4aa6ff71b690e70ac293d4e1c7cc8a884fc9852be5d02c8574bb583ff63bace62e6237c05dcd9285cb65993b9c2d9a86454b3a45ce8158a7072b09a8a4b7e03709ccbbdbe3de965caca8e92469ecaad1dc2ffab809d06088a4ed5481229b2baea05c3419b502016fb91ce327d2b6594b4d2b28443d358b740f7c4be5b36beba73a7092097a3d02b2465c8e5b6630b9b00809b6ba359d3b3b0690d9003fc906201542797f194e5a73a4c6143f201f473cdbc64e7c966f6378ec1eb3ccd79e29690f73b3ddc83908167cb9e95b33171b448b5540d3db6f37c0e2fb14dbd3d3ee48d754c4e26919a660eb1709fd83d1d8b5e8b79018bb86b1ba22252eeda251ffdc7917e324d650c2b07af165d3aa661e572f0b2bd23a5b77d167c6b343b7e2574c39f2144265450a53e9130983489c2db9a12f972f35cabf68bc37fcd1e87faafb01fbf754a31c706fd4a5f942578e24384bbb90d7df5c15476b8b16b3c4b0f94e6c1e2cb2e78f4934ffd34874aa99bf6eca20f606b42a71bee817fac4fa72719b525e7fecdb500f97661e0e23735f8484593246cbdae9e99fc5183d1293906da86770f2fabe9532c8cc713af76f6ba95bdd2beff77cc1872bde0a369f7d6789803bbbdab42ed7390d9db247cb3fed69d23714dcdb2af6b162a45c180228b9d9288c627cf7024ef14cb46d48a1756519457e1504cdf571dd175f99cc909300a75f8d086807baf284b27510aaa3fe361ed7d40130667596e9a2956a4271cd8f2ec8d64b20b09e47dd48afff46c4a50c57e9fd9a30cee0ecdbd858cecab6edad58ad2eac432a9f070bafb2e1d8c6ddcec80c2ea4150d056169ba93275ebf4b112c6edf4a2d4668c767d8db3f6cde7f4e394817f24912831414beef57133fb0567fedd101e053d446b03c23825396f195f8b7e78ca34e6d34f717c36fc7b3db54968e51150e2aaa70459547ae3da7fe3d6149d76129fcca1f1dd7b620f35c939b1a4ab81245a5f97d314048c1310856d7b2d6ac64ff17e9b94b4889e997fa372a95a443ca1d57192ca9f7bf33b87e33e16ae232431db1953d8af7dc8d6e876a7b862e87f8951d1c50e582de74d8edb0db3d8225dc84fe771d6b71d128dd8241279f2d4a87def89f7dad655c7fc67588e9d3ba1e161ffc20d607c043c4db199894552f3dc17c9ae7864dc6ef61cb4d88c6624165bec4feb051c12dd5e0ce7b17ddab422311c9eb5ec711e3abf9fa08266a685c7a0b1d67a1df99cf9f8e8223c0d79a723b2c34af578d68fed2f9db5cdbdd10211c6831151e94af6c7320543b169c90fab2dfe1476adda3ccbcbcb21f42ff8de14ae1eded87c0b8b0215e620158f88cce680414118b14531dabfe949df65209e46aaf19f9cf6a3c1a5842862b7bc77205342c50db68f951b266980d0b59bcafefd78996f84103cc6e0ffd454c0fa18ad152243ddb47c80656681785def314d7635977ef11dea37cc38c15145654395b793eff90b2d6b02b092318f41c70abfad741266309ee50e052c27482ee2f6212601d9a0e214b1222bc2e8c65507eb1d9d344418f720bc59ead5fbcf25e4e2f25f049cdc67ef03504373e7f83ccb136b47f4453773f824769a64eee6ac89754323ea89bbcbbae7f2849cfe553283018c0970d6cfb149c3266c0cc9cafc80a348b3ecd5f92d11d2943614e4ce6320adfa8bf9fc7ece6a8d49837f31a7cfd306f6e6c2c772755b5ee9993f08e3de24f9140a4c0b1179725a0d34374be3d45f47540dae64a03ed4080a7609cacd977c1747f5992d87abd10601015222e4be85fef4b0004e5b340688699141d4da5448a71ea62337c2108fb659fbc765b7419790e5e8f769f1ce98f10e4c485be1e6a2d071008dd3e177a6c22f9b4f2bb122c4705503ea15f7e7d359848a0857bf3b6d0994544a33a4ba35fd50aff499c14d0cc05e061cbda5eabc3f1477c2238a9a2398cb14bcdcecc3d9c5ba6d55f1b01c5f45063", 0x1000}, {&(0x7f0000009100)="4b17bc2fadc5261463f3b26b0f5055c797dc92b63f6c0dabfeebbc8647fd598a06e29b", 0x23}, {&(0x7f0000009140)="2298ea378e6d75f0fd915e4322df5718421cc7fe0fb521ccd069b34badbab84330ee23a26799cce87749dfc9354ebd382173b2fdb9e9047cd1f5616e258e9ea53c501b192205965d4218602282efed1a80f1e7ef1352", 0x56}], 0x8, &(0x7f0000009380)=[@cred={0x20, 0x1, 0x2, r23, r24, r25}], 0x20, 0x4000}, {&(0x7f00000093c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f000000a5c0)=[{&(0x7f0000009440)="ec53cb2a3d060bea99319f0c45342d1a7f73bed5604c00c66be8f7f427c83857bf810107589dcbc702575b6a9769e016936b662c7316cf7a08e4a3693ad8bbeb3d4f3fb4d491368efedc9505f04b5e81a2eec764c9ed54387170ef27a5266b2c3a689d81703aa8039356c4cb2cea63e9e2efb4726ef873fc7d9d96598c3fe9fc12a73a97591215f73866b45dbfbec3104e7827169698c5e978", 0x99}, {&(0x7f0000009500)="651f48a83592176106319bb7bbf79ad8748433058d495d978d1d759be216798112e8cc0afda18b4f6b42ec18254dae4464bcd5e97e4bc6513b676723f2cebc110ef92559c8b933eb20e84ed27efe5659fe0d094788299ab42849b0629e8f7cbbff047edfb34df091f709f950eedfac5cd913427dda6cfb2bc7e9df82ab0eb1f99e1daeeb2ae084d3f88e98e9265b33f7f90d7c78c0461a1525a5430f527341bd9e138ae811f80b22a3cf8ae9f4164233dfd9f4a47a4d33043992afa0bc06ec9de22e62d8eec5e87c578400808077c12ec905a4e961d3b03d07ec2d5ed42c9b096f66360648b8f9b4bc0a0c43c8827df725669e95bf03efb6b992bbb730c518ff2b8e8a00ada91efc76b2998adec898c33c886b5f656540dd871b958f6a2707ea2d3b1b10974389c9a5381c6158685d77da9ceeaea5e79be171042c23a792c29f41f61b180c5da3df93582f6533a7f088e178ad70078371771b0f0bf13a17ca3fd047ecd37cd7e7d2d69bfbae1b8794f88cf465ed0441eb96ce47241273f476099ff27364ffca5916abb8d1cf96fd7de232123d9487dd0d51a5cddc27d1132dc9d9eae0b779e17ed588a5f4404b69b39424e6a137055f7a55deafc8f45576090b726e72e1f84578700b447c49d25b1231d21048e24cac9a48c8584b6c69776ce9f6015c646a62db09dbd2b32fb52f9733724f7cc972afe56cca8b8514286bebb8cfe151dce4ffb7c348f020ba94c6ca084a890f2def750ee8eacaea0bfbcef03eeaa7b5a6c703e7b117301e28e62ff233d59124feff4cb6f7c219349afeeec2e9b7c4980056df7ef4f487fb658a5cf0825d04066991337339775942a799f8dc56a82920e2031fe477a8b7c7c7e9d4f03ec3044c791cda6f74f04b37ddc49509a6e158fe638e909057d8ba60495f2139dbc674dbf1b0c51b957d12dcc39e520e8cdc576b064dbbc92e3af39f5a25276c2bd6e33269e01495a61e380792cfc824b299a2c55484f5f1725fd7ffb7d401d3e31eb4eb4c4df4713f5aebc728578355b14f80fc72c2d18093d6614172c79d6f65f672791daa857800ae1ee206a3f7ed3547fd388dc17dd1893b5575792a6b9fcb91c486cc2a1804f156f890dcc08164ad37ad62fef2d7f1656dea4b6b82bdfcb9438e90167a7840ee9d458ef3558138619a0b986db7f9007202cf5dfc1d7ce6e84f5559580445963886af3f2c2aa35b1b10e705b313af2feaeb10e4207032bb18df1489864844fd6c933e4631eef0be1e7ade14e4bda6a315ac0cac9046210de442cf07a44a2a71025b05de07dc22c17ad1e18ce74f53a4afedac780f6a8edbf00489c87389bf32e53d45e4da72ef663d73c2b7ae41c8e66b4219e6231a64c1b0a7ff8fca956f8bbfb983e973ac4b0a72d59218eb16a70a1df82bba5e25d56687c38d148350cf232560b3881285f5664950d629f3fe285a00a5a35e2e6f568c111ce8343ded3cd3b0380449caf03476113904a57f12a2890f36d3426338d3b336bd7f90afaa8d1fbabdb857b4e3eea6f3baa0f2fb7955811bc151754422edb5aab117d40b1c9d65cafe87e385680834b5caa1313d58bc09df28a76ad3f2f5aba6a52015f52921981ab4d61ce0ef6170a6c094bb50892ff6149cb2672c61e12493af9edd1430749d662ee1a7ab7f090bc4a8dbd05d84c91e6689566b6864cca41e7fd84a1d1ac38d1b082f54120746e4831a256ccc926d37db9c050dceae622e2942c03cd388b03cd7b77af7abb8230aa308a6621e5a26c7647a19cd4995e527d1e7b084c9b0323c872fd4ee58b0346142df2f93623f19fd5d18000dad3af2203c2d823f0a0794cf7939ac352ef6940926b4e23cb833deae328738bc1ecbc31794c62551f37383e2e3fafdfb9ae68e8402b7baf252802a20f61bff2a1e5153549c6534be9d80f155303aa358183c0f23fca7e9a49688ee26a11f73010ef007d4c67a506e5b565cad60d8b9842a5456a2e354071e08cc1a87050500429e9deb1ab43451aa35c8ca1e945a2ba5bdae9943be9f480c940d30e69f358bddc42765f25a1a0133d5a31b01a516c883960bbfe8b506858c5ecd4aad792cec50c444c35fc497a3acb4108fdaca1ae337fbbe6c81a80856a4fa7a2cc5e9e4630a3eccc5074c72104aad48cc28226a5821a96c5660f8b27498d31c55e12934a8e358e78b2466cca7a31d2171fe3ba3fdda809da12f93ffe43180d2ee00119220cf4f92b844b12644acd228bf9e67b571ab686ad636ec27df10679a7da0da0eb55c216f4d154890cc3e4322a44f81a9a312b014b79da4738f28bcc6dbf2fbd398d1c76fc9213fe5dc2792d25b9e5ea6693df14366190dcb1fcf80fedf6be3331a1cbdfd078c6063e4b6c895ecd445be5cb4268d43ded455274c248b4ae6dfe6cf70c8aa6444f4d57453293173fae527181046cd5c1bbcfc4b3f8b91adfb2a4d809c758bb7668dd51b7ab57f6564624f49cc4025b4691f5852f436e407a4767c811098dce2003147e56bd46e1792f4ca8b0e8948d78aaf27436dcf766732b279d5c185751175e0d0fd92b396aa71e95988baeb9fcc0f3f8c3874368b584d9b41b0cb88e3cbca72533bb8b9310fc6b78c8acb88729c5b4d57886307f8ef24188183bb404d91a71d9daba8c19ad605d0affd0e0c56d190f578232e7d5c20016882b7514ca234f4ca27b39a2f5195542ba708c7c85b79efd62122945b71818e2696628809b55afbe0331c124304e0c366e12fb4034b820a431b553637f3b6e2ef44e87b0679e1e0440913c5cc15e17a20823ee8acd8cd60ebde7a0bdc1758151a582827014ea123950c6aa795e83f0dd3e4d2aaf1cc2e9aba94f32347cf076b6a6292e76a2b40699e700288bd00029bffa1223fbe3120a1a079537a790454b7c77fa74f36ef3a32a4b05b1910ea780d487bfd6bcc455ec67b655c5b5ffd43239dd6aa4dfeaefe90a6e238ed84c66523677e78ac8af56473d3c9f83532e6f7f8aa1a96c9974e7ae9ce5da236abd421128e71a32c2797ae8a5a91357fc5167b0039789256f5987a385c9d1c4150ef5b5ca5665c37eeedd2c8f3ae58336d1e52a7e74b77585a81a02a151acdf4bc1b0fe8449842cbf2dfeb4722bf4484adc0a4bad21b3d51245161cb9a0f599859db43388c9357998fbd168653d431d08ba708dc4db954065775f90c45c7060cdd38b6b6bb8396196a6868afeeb5dceaa574532241ee018fa7f9598ffe9e4bbcb933a34d29c616b875ad0a15bec6bc261307e6e181ce11eae92376147615cc7cacedff3adee090ee1d920af62fefefe7aabee6a25ac81772f784aceb9b97e012dbc562a573e6a2ea72b3181de8f9d66ed18b6bdb9fe98e11886df695bab934cca44a78ebc2362820116fd8291112cb71ac1306d48c633228a2380c8e5b5824e9156f876559c1337ef5c1a7bac4951152cca93cf79d5532e51abab8441c2f6712657ce509337116ffcbf7ddee819e7dd5edac3f286ac7538218848709e4ce68051e83c5756acf294aa7f6e15643be3ed6f57addacba44e5a33bc3b2e1ad066f612121fc338356801c61d064cf2d685c627d5fc6dd4d1e0c9fcec56448e20ac81fef8538b90470a305db29039daa53d583af7016939112411c32578e4f1ed18b893cf4810664bfb6bec2b68361f3f020a89404021a920708923cbeb69f03999785cfe9cbb9872d73093f251f66808fbb27e1e331cc0806ce0c16b31db68eeb82936fd3276a7dc2284d43a90e970e0e33aed1f901406b6a865f0f4ba27cda6c2bdb5c24204f4f89cfff6e00ff88f3b8b384e75993253b030e322cf4524e9cfd82961932cca4751601bcdb7e2d8c0d146599f85c749024ca3aae4e45e0ab4b23d429a90ebfcd9a0df37b19c60ee29b1a4d2d1c9a83ffeefc251fe3222e3df460ff8fc651d68212177bd3910e8ca590053adc8074c8e37ffbafdb9d02fa7ae9fb5c197d8d470a758fe9fe7fba0c8708268e75e094400ad442c2c7563df59ead03ec2f5ff3a8a226e9abd0da49dde2244fa1173144d1cfbfb8c50e34bcc2c929fafdfee04abbbe9e292173faa46da454e0843cfa230c0ca888bc1a0298b41d05cc4b755a85305a931fbe44ba21c8db7d4b12959b55b5a8388fac1270b9be84acdb8ae09cd133e020fb58a3f11a42d16cca54d69a42c77b1867fcc6841aec9b1fd4ca8f4949ff070cdeee81e645123a48736c5422840d6c8e04278a2ad114e84542e109e4704837c64deb4c1e266ff2be1695803cb0e34c31cd3696b425556a3abf03639da4ffdcc0217b1be18bdcf3d205b2cc38034873d744fc968e4a52a8d5f717a058657dfc5596fb7ad27af07c1867d049c6bdb6b2d1c811028306c4f055702cadf8a609aad9fe8d69bd3794385debdae1a93c9f63e60b8ce6948c2a8ae993b0c3382d78542640d427de998bf031865c7b5da72708dcaac8f0385eec4faf1c0073c232dc117d4b8d984406355f71db4ffbe57118c26cd43bf09b4970e6ac08d44e8a1c5b1967ef4e6ec8f41bb175cc841fe59febc6e8288e9561a8b9456b044f23bf65fc4fa98b713beca3816c2adbfbab727b16070ddbeb043403fca026ca07db2749ef8b2eb7526b33386822f679f0b302e6b0b3a24cacfb97c0a3495ee9f2f2a55dff32d600cca497b3ae4822ee43eabc31c93be0cf53a81033d979f0559bccfe05a8be8ad901d715bbd660bc3a910ffccdf5a2c78f4449c0b3263ba0ed907958858b50bfc5442bc992e85f0aa39e48477ba5f8a7ff1d708ceb7588995d7aa0327fbeb17a62df1ef42032bb90236f30370010f850d61b7229d91375ec8e9fda08a5b19d97c6a948aa44e5f5763e91e008023cb1534012e3d539a4e2625d0baeee8e133fab18a41639782b95364e1f05935bec1bd12dfd822a8bbe45ac72ca656aa05d8aef099b8839cf4c0e25ef404946cc72a4d766a673d4a1c1873876505631a2d5aa26cb1fa625fdde79eb3860a230ddf1271bdbc9c324f1bd15fe81598c8436c6d1affbf09e15da921013b2bf8c356dd9189ad2c750bf834fcd1cec7d8d34bc38d619ce513aed226d22ec5ca9be500c7136c2b1642ba929a41ba29e4475804405bbf0b3db626f2fa5e552356ecd2a3bd2bc1ef65cf8511efc231e0e063ced4758661a221bfefb69de488d4c29b3a37af396f676f86d6847c808b3a7c4c796b5fd658e4b50eded1a552cdcbcd76597bf578366a9c82c4f6e353b65a2eb8a8711ad16afe0aad01b697202ce3d3eb4eb8df1fa4b38fe39a364031428e71157330cb0135ba654dc1bb67cf0cb09ee270c92a93a34b8f9d4e7261efc2b2663027c23ddf0f064feeb790a003263887136c74965427e62bcbbef96e38b82c087ebbf8cf75917694a92b83fa333e182a03f2b70fcaffa3d905246cf20fd1463d67ff232bc82a40b0eb3f441f079a91898f0084bc345b104d3853de9c393ecf338d1073f98a0ee151d9864124c9a949351475b31f8a7089cae7323137904ce4528132b296ea8bdea9af3acff671e1162f8c36db68239356eca2b31d5e2cf9d291827b84b387e6ff74e0d293ea8854244b7c1958b58c4f5d39411a11456f5196d3630eb23101749aad591be38ce40de04eb33052d0a5416cd5136bc90f10b5f49dd7134a93f6b5c2a56f359d61f933897184958440401e977197eb52f2c687e6ae3f6ccbe2f4100dd00a419cd1b953abd066b05b8d431300348d4251eec63906e3760c4db89105a2379f6331b2b1ad9a1c61a47aca7c98614ec751d768450a6ace70adf89faecb895c5ca2193dd46ec", 0x1000}, {&(0x7f000000a500)="4c64d793e84b7fe354b6c828effa6fca93def5ea11d1abf9821b62afcc", 0x1d}, {&(0x7f000000a540)="aef967b37bb8d9418a22274a1bee20d57d2203a7a2f93bc44db5248db78ed25d810542097b843b5a77fbcd840b8ff02c80a68d9b0886a8b84e9ff7ce2c46e769342982fb30d423f737cd5a4b2487ba38069a474878d136044046f9a82b873b606bbde02e0da6a326af", 0x69}], 0x4, &(0x7f000000a600)=[@rights={0x18, 0x1, 0x1, [r0, r2]}], 0x18, 0x40080}], 0x5, 0x844) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:28 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 731.500088] binder_alloc: 12691: binder_alloc_buf, no vma [ 731.521752] binder: 12691:12695 transaction failed 29189/-3, size 24-8 line 3147 [ 731.612183] binder: 12703:12704 transaction failed 29189/-22, size 24-8 line 2994 [ 731.695977] binder: 12712:12713 transaction failed 29189/-22, size 24-8 line 2994 [ 731.965168] net_ratelimit: 24 callbacks suppressed [ 731.965177] protocol 88fb is buggy, dev hsr_slave_0 [ 731.975286] protocol 88fb is buggy, dev hsr_slave_1 [ 733.075124] protocol 88fb is buggy, dev hsr_slave_0 [ 733.080219] protocol 88fb is buggy, dev hsr_slave_1 [ 733.155162] protocol 88fb is buggy, dev hsr_slave_0 [ 733.160246] protocol 88fb is buggy, dev hsr_slave_1 [ 733.635093] protocol 88fb is buggy, dev hsr_slave_0 [ 733.640191] protocol 88fb is buggy, dev hsr_slave_1 [ 733.725133] protocol 88fb is buggy, dev hsr_slave_0 [ 733.730199] protocol 88fb is buggy, dev hsr_slave_1 05:48:31 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000400000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:31 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:31 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:31 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="8500c284070000007077d6b70000000095000000e96b000000009895e17896c7411ad00fb23f75a912499c743af49a45f3c3a2b573e0ab5e45c34edba10923b5b1fee93951476477af0c68c80adf6437d5609c3234d468ff5811fa243e0b8539769df787c9c1089075cbd823a7d07de1c6f554dfd9e9f18fb8863bbc39ee65913bf53727d426319d62ca66795b34eb9730dad2f4adee297c4f9e97"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x9, 0x5, 0x81, 0x6, 0x0, 0x8000, 0x500, 0x8, 0x220, 0xffff, 0x6, 0x8, 0x4, 0x4, 0xe1, 0x40, 0xa7, 0xfffffffffffffff9, 0xeb3, 0x3, 0x4, 0x80000001, 0x8, 0x2, 0x5, 0x80000000, 0xc159, 0x9, 0x2, 0x0, 0x1f, 0x7fff, 0x40, 0x1, 0x5, 0x6, 0x0, 0x5, 0x0, @perf_config_ext={0xe, 0x6}, 0x4180, 0x0, 0x96c, 0x2, 0x885, 0x1, 0x95}, 0xffffffffffffffff, 0xe, r0, 0x8) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:31 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:31 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$PPPIOCSMRU1(r0, 0x40047452, &(0x7f0000000000)=0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$rose(r0, &(0x7f0000000040)=@full={0xb, @remote, @netrom, 0x0, [@netrom, @netrom, @null, @null, @remote, @default]}, &(0x7f0000000080)=0x40, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 734.458288] binder: 12726:12727 transaction failed 29189/-22, size 24-8 line 2994 [ 734.467482] binder: 12724:12725 transaction failed 29189/-22, size 24-8 line 2994 [ 734.485502] binder: 12720:12721 transaction failed 29189/-22, size 24-8 line 2994 05:48:31 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) getpeername(r0, 0x0, &(0x7f0000000140)) 05:48:31 executing program 1: inotify_init1(0x80800) r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x6, 0x400000) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f0000000040)={0x5, 0x16, 0xffffffff7fffffff, 0x7ff, "734dce8c9a9066a6e46f533755f5a6527f1dc54a91812e5509cdbb2d4c467ad2"}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f0000000480), 0x1000000000000237, 0x0) fcntl$dupfd(r2, 0x406, r1) 05:48:31 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/checkreqprot\x00', 0x20000, 0x0) setsockopt$sock_void(r2, 0x1, 0x3f, 0x0, 0x0) r3 = gettid() r4 = syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0xb894, 0x200) ioctl$VIDIOC_ENCODER_CMD(r4, 0xc028564d, &(0x7f0000000180)={0x3, 0x1, [0x6, 0x1, 0xa6a, 0x80000000, 0x9, 0xfe3, 0xffff, 0x2]}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r0, 0x0, 0x0, 0x0}, 0x30) openat$uhid(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uhid\x00', 0x802, 0x0) 05:48:31 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:31 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:32 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x0, 0x0) r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x2, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000240)={&(0x7f0000000100)=[0xffffffffffffffff], 0x1, 0x101, 0x3, 0x7ff, 0x0, 0x5, {0x8, 0x3, 0x96, 0x1, 0x8001, 0x3, 0x7fff, 0xf0, 0xfff, 0xbc, 0x2, 0x7, 0x8, 0x0, "7aca69eb1935523d2cf9a87a895aa7375702e4ba3d8ba0b2cbcac40ca555837a"}}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f00000002c0)={0x0, 0x4, 0x19d, 'queue0\x00', 0x1}) ioctl$PPPIOCGNPMODE(r1, 0xc008744c, &(0x7f0000000000)={0x0, 0x2}) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000380)={0x200, {{0x2, 0x4e23, @loopback}}}, 0x88) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000040)={0x9, 0x3}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 734.692883] binder: 12749:12750 transaction failed 29189/-22, size 24-8 line 2994 [ 737.235132] net_ratelimit: 16 callbacks suppressed [ 737.235143] protocol 88fb is buggy, dev hsr_slave_0 [ 737.245195] protocol 88fb is buggy, dev hsr_slave_1 [ 737.315123] protocol 88fb is buggy, dev hsr_slave_0 [ 737.320257] protocol 88fb is buggy, dev hsr_slave_1 05:48:34 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x80000000050a000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:34 executing program 4: 05:48:34 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:34 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:34 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x20000000000005, 0xc3, &(0x7f000000cf3d)=""/195, 0x41f00, 0x0, [], 0x0, 0xf}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) ioctl$KDSKBLED(r0, 0x4b65, 0x100) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={0x0, r0, 0x0, 0x0, 0x0}, 0x30) 05:48:34 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:34 executing program 4: 05:48:34 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000000095140000000000000000000000000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) fcntl$getown(r0, 0x9) r2 = gettid() r3 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0xfffffffffffffff9, 0x208400) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) utimensat(r3, &(0x7f0000000140)='./file0\x00', &(0x7f0000000280)={{r4, r5/1000+10000}, {r6, r7/1000+10000}}, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) [ 737.516463] binder_transaction: 1 callbacks suppressed [ 737.516522] binder: 12771:12772 transaction failed 29189/-22, size 24-8 line 2994 [ 737.545691] binder: 12769:12776 transaction failed 29189/-22, size 24-8 line 2994 05:48:34 executing program 1: inotify_init1(0x80800) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/mcfilter\x00') getsockname$packet(0xffffffffffffff9c, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@ipv6_getaddr={0x48, 0x16, 0xc1a, 0x70bd28, 0x25dfdbff, {0xa, 0x0, 0x20, 0xff, r1}, [@IFA_LOCAL={0x14, 0x2, @rand_addr="0d013910b1996c5f9da4f9f538955847"}, @IFA_LOCAL={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @IFA_FLAGS={0x8, 0x8, 0x400}]}, 0x48}, 0x1, 0x0, 0x0, 0x400c000}, 0x20000004) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'tunl0\x00', &(0x7f0000000000)=@ethtool_link_settings={0x4772bf4b6d4d839e, 0x7fff, 0x2, 0x5, 0x1, 0x4ad, 0x60000000000000, 0x6, 0x9, 0x8000, [0x4, 0x9, 0x0, 0x2d1e, 0x1, 0x9, 0xf84, 0x1000], [0x1a0f]}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:34 executing program 4: 05:48:35 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:35 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 737.795130] protocol 88fb is buggy, dev hsr_slave_0 [ 737.796728] binder_alloc: 12792: binder_alloc_buf failed to map pages in userspace, no vma [ 737.800298] protocol 88fb is buggy, dev hsr_slave_1 [ 737.828738] binder: 12798:12799 transaction failed 29189/-3, size 24-8 line 3147 [ 737.875132] protocol 88fb is buggy, dev hsr_slave_0 [ 737.880247] protocol 88fb is buggy, dev hsr_slave_1 [ 737.885424] protocol 88fb is buggy, dev hsr_slave_0 [ 737.890488] protocol 88fb is buggy, dev hsr_slave_1 05:48:38 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x80000000070a000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:38 executing program 4: 05:48:38 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:38 executing program 1: inotify_init1(0x80004) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:38 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="8540000000003fb20000950000000000000000c0f520ab59000000000036ea3cba07ded6b1e0830b37e06a6aacb53187f592b57b0814b73e29bdb17b446b09ee5b86d6e5d38c846bcdce8f36b351d9ad318580d4818ad40aa222dd450a81831c74804f43a9a582893f9418544fafcabd6e9608b5b3b0be82ac47fb177a759deec9f01ce98309b5de5d9196267ce2d0b90e8d03977741a339dea1feaf61152054508f8ba2177abf309eed44f53bf6b368e3f375cd7414cb7dd3ca89c754e2aa33d9b05f4b8e5509adf8bb1884927b25c7a4a6e305bf9d0949640015de1f54ba6f3e24d19a2ef26982a15758017231da2e5aff6f50000000000000000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) r3 = syz_open_dev$sndpcmp(&(0x7f0000000280)='/dev/snd/pcmC#D#p\x00', 0x8, 0x20000) openat$cgroup_subtree(r3, &(0x7f00000002c0)='cgroup.subtree_control\x00', 0x2, 0x0) 05:48:38 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:38 executing program 4: [ 740.738548] binder: 12816:12817 transaction failed 29189/-22, size 24-8 line 2994 05:48:38 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) setsockopt$IP_VS_SO_SET_DEL(r0, 0x0, 0x484, &(0x7f0000000000)={0x32, @remote, 0x4e23, 0x1, 'none\x00', 0x8, 0x2, 0x66}, 0x2c) 05:48:38 executing program 5: 05:48:38 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:38 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:38 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setrlimit(0x0, &(0x7f0000000180)) [ 741.028251] binder: 12833:12836 transaction failed 29189/-22, size 24-8 line 2994 [ 742.355212] net_ratelimit: 24 callbacks suppressed [ 742.355222] protocol 88fb is buggy, dev hsr_slave_0 [ 742.368629] protocol 88fb is buggy, dev hsr_slave_1 [ 743.475136] protocol 88fb is buggy, dev hsr_slave_0 [ 743.480250] protocol 88fb is buggy, dev hsr_slave_1 [ 743.555189] protocol 88fb is buggy, dev hsr_slave_0 [ 743.560277] protocol 88fb is buggy, dev hsr_slave_1 05:48:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000713000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:41 executing program 5: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0xd, 0x401) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0x300}) 05:48:41 executing program 1: r0 = dup(0xffffffffffffffff) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x1ff, 0xa, 0x12, 0x11, "d1fe13fcd58182b1a7c03223f0da321ff7460d4177e893c2d0d184b9b6f5fe4698dd8580971848cce01d0ef0cb330c215b501d2476758dd243183ec2751cd232", "6cb9b5cb5226bb9233eb5a5b6c80f365f7253f028bc48725272ee5ace1b408d7", [0x7]}) inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:41 executing program 2: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:41 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:41 executing program 4: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000e80)=ANY=[@ANYBLOB="000429bd7000fcdbdf2103000600040002005400030008000300010000020008368600000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) r1 = dup3(r0, 0xffffffffffffff9c, 0x80000) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r3, 0x4068aea3, &(0x7f0000000240)={0x79}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f00000007c0)={"a523fb9656eb871ffcd7ffeb51d84e738a55eba841ae487e33cdd921e8a51ce6c924020f0ac3562dd8cdeb31deac16f46da4ac16ee8165bce439eddce671c5b0a1103ea3f86a43cbb78504f6f9c77c2f09dc27632ec6036ee52a87e321e707c0cfe15576c26d52d0334c8d4693e127b3a046a5ed7796c9c5017cfd58ec871ed76369846fea9ebfa2f7f96496abf4ef57ed1ecd930eb9e13396875f01e932804ffe8a34c8fbedd97cdfb3176ec59fbbfd20a6ff17795431c3908530e4f5f703480a5211cc6a7e2084e4a9b6aedf60b7b8084b00ca2cbed255b4cc4679c967432fea5e95119f9635e94794aab6ef54f290677fa08d0ee2cc8eae468efd02417055d3f3ccc86b629dfb878c4d115c16c75fe352cffa93648cf49577256b5d2faf0634335c97ffff966ae90cbf81250df3613c25d2789c869c9cc95a6e9d364c4c684059c593f9950e66cf81cd9f36d73fade4f0cbb795010364d13ff32c12efd91d0ebb6533700945f2db6113a630bd521eec89a74c46e1733b72d6e4d2ccee3b40f99809a9a4fb5fc2d1c53e1366d455bcbe81893100ab56b2556b55c1a0c5787356b464c3bf7011488e55f587a6d4420d46d69a74ee5bbfbcb0d6cb00aae8c3dfd6dd2e9f76d7a542f20553207b668dce69f1b463ee9166e81bb109f461b8885f15c9e525d72260ccdbd69e3345612158114780b9409ea856cb724faa6ed27ba836b35c10e7c7d43f2fa34f98f16a00f31565e16a213eaf4a7f438c89733ebe6d16328b930fd942bc64d631dd1f2aa1cc2ccdaff2324076c83e1ba4d2a0e40e010c96b42e7a4a76cd7a89ef592b9b3030f62d9fbd565ee5908ab90b42620b61e5d1e08621a31d21003cd12a450461636472fa64a7e1b98778bfb482fb4b4da31b42ee98b10f9c0f4c085d08c37ee2e3a9e4a5aff72a0ab844fcbfa224842c85f6cdfd25829c44760e3859624f891df4824f7d17938ac2def6721639176fad9512ee9b4c5de1412cf3083e1d5ee2d29b63267ccba535409da7bef05d3fa79a3ef037ee609e01ad345ee17f48b5e8510f767de35df4dfb856f7533ad88866c6b01fe345107ba7191a8809e2e014492acf9c4f35cad664198a65c55f884490f4b30b4526324be842c393f336f16bea2bf6c6b917fdb751e12ff689ab4ffa44625a8b2bc1de4e88682abe5ce9d1942792747681ad23c31046d825140987f19a9cf10323c3f50a20f35a6d1dd8ca6758296b4537a0da1a853011b777623c8774b3689897cf9264a7782470847f36a8093faee04114663438ab39d8a777fb3e10cb4a2402a939a98d387087c5ca5fd8fbc4d96ae698b5bb84a0a8484e2b85743e623a033eb5b1889ccfb4b95885bc69d4c1cb819b95e7923e557c9ec9ec10e94d1e1295fc2f256fa095036f6cfc04c414fc57fc72c120614a586089c93741e97a61c466"}) ioctl$sock_x25_SIOCADDRT(r1, 0x890b, &(0x7f0000000c80)={@null=' \x00', 0xa, 'erspan0\x00'}) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000000)=0xefff) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text32={0x20, &(0x7f0000000380)="0f0766b818008ed80f20e035000040000f22e00faea66647000066ba2000b801000000efc4c13565d4b805000000b9f4ce05c80f01d9670f01750c66b8e3000f00d8c4c2e99626", 0x47}], 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000100)={[{0x0, 0x631, 0x3b0, 0x9, 0x9, 0x1, 0x7, 0x0, 0x7, 0x7, 0x7d41, 0x3, 0x400}, {0x0, 0x81, 0x1, 0x7, 0x9, 0x3, 0x91f2, 0x5, 0xffff, 0x0, 0x0, 0x5, 0x6281832c}, {0x4, 0x1, 0x7, 0xffffffff, 0x9, 0x528, 0xce2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3}], 0x892}) socket$inet6(0xa, 0x6, 0x0) 05:48:41 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 743.776426] binder: 12852:12853 transaction failed 29189/-22, size 24-8 line 2994 05:48:41 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x800000000000012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setrlimit(0x0, &(0x7f0000000180)) setrlimit(0x0, &(0x7f00000000c0)={0xfffffffffffff801, 0xfffffffffffffffc}) [ 743.843152] binder: 12849:12859 got transaction with invalid offset (0, min 0 max 24) or object. 05:48:41 executing program 2: inotify_init1(0x80800) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 743.906248] binder: 12849:12859 transaction failed 29201/-22, size 24-8 line 3241 05:48:41 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:41 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) close(r0) ioctl$sock_inet_SIOCGIFPFLAGS(0xffffffffffffffff, 0x8935, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) pipe(0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000080), 0x4) [ 744.035119] protocol 88fb is buggy, dev hsr_slave_0 [ 744.040295] protocol 88fb is buggy, dev hsr_slave_1 05:48:41 executing program 1: r0 = inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) inotify_add_watch(r0, &(0x7f0000000000)='./file0\x00', 0x2000044) r1 = dup3(r0, r0, 0x80000) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000040)={0x3}) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 744.115200] protocol 88fb is buggy, dev hsr_slave_0 [ 744.120142] binder: 12877:12880 transaction failed 29189/-22, size 24-8 line 2994 [ 744.120365] protocol 88fb is buggy, dev hsr_slave_1 [ 744.170564] binder: 12876:12878 got transaction with invalid offset (0, min 0 max 24) or object. [ 744.190617] binder: 12876:12878 transaction failed 29201/-22, size 24-8 line 3241 05:48:44 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000740000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:44 executing program 2: inotify_init1(0x80800) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:44 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:44 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:44 executing program 1: r0 = inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VIDIOC_S_CROP(r1, 0x4014563c, &(0x7f0000000000)={0xf, {0x8001, 0x1ff, 0x69, 0x7}}) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f0000000480), 0x1000000000000237, 0x0) tee(r2, r3, 0x0, 0xa) 05:48:44 executing program 4: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000e80)=ANY=[@ANYBLOB="000429bd7000fcdbdf2103000600040002005400030008000300010000020008368600000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) r1 = dup3(r0, 0xffffffffffffff9c, 0x80000) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r3, 0x4068aea3, &(0x7f0000000240)={0x79}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f00000007c0)={"a523fb9656eb871ffcd7ffeb51d84e738a55eba841ae487e33cdd921e8a51ce6c924020f0ac3562dd8cdeb31deac16f46da4ac16ee8165bce439eddce671c5b0a1103ea3f86a43cbb78504f6f9c77c2f09dc27632ec6036ee52a87e321e707c0cfe15576c26d52d0334c8d4693e127b3a046a5ed7796c9c5017cfd58ec871ed76369846fea9ebfa2f7f96496abf4ef57ed1ecd930eb9e13396875f01e932804ffe8a34c8fbedd97cdfb3176ec59fbbfd20a6ff17795431c3908530e4f5f703480a5211cc6a7e2084e4a9b6aedf60b7b8084b00ca2cbed255b4cc4679c967432fea5e95119f9635e94794aab6ef54f290677fa08d0ee2cc8eae468efd02417055d3f3ccc86b629dfb878c4d115c16c75fe352cffa93648cf49577256b5d2faf0634335c97ffff966ae90cbf81250df3613c25d2789c869c9cc95a6e9d364c4c684059c593f9950e66cf81cd9f36d73fade4f0cbb795010364d13ff32c12efd91d0ebb6533700945f2db6113a630bd521eec89a74c46e1733b72d6e4d2ccee3b40f99809a9a4fb5fc2d1c53e1366d455bcbe81893100ab56b2556b55c1a0c5787356b464c3bf7011488e55f587a6d4420d46d69a74ee5bbfbcb0d6cb00aae8c3dfd6dd2e9f76d7a542f20553207b668dce69f1b463ee9166e81bb109f461b8885f15c9e525d72260ccdbd69e3345612158114780b9409ea856cb724faa6ed27ba836b35c10e7c7d43f2fa34f98f16a00f31565e16a213eaf4a7f438c89733ebe6d16328b930fd942bc64d631dd1f2aa1cc2ccdaff2324076c83e1ba4d2a0e40e010c96b42e7a4a76cd7a89ef592b9b3030f62d9fbd565ee5908ab90b42620b61e5d1e08621a31d21003cd12a450461636472fa64a7e1b98778bfb482fb4b4da31b42ee98b10f9c0f4c085d08c37ee2e3a9e4a5aff72a0ab844fcbfa224842c85f6cdfd25829c44760e3859624f891df4824f7d17938ac2def6721639176fad9512ee9b4c5de1412cf3083e1d5ee2d29b63267ccba535409da7bef05d3fa79a3ef037ee609e01ad345ee17f48b5e8510f767de35df4dfb856f7533ad88866c6b01fe345107ba7191a8809e2e014492acf9c4f35cad664198a65c55f884490f4b30b4526324be842c393f336f16bea2bf6c6b917fdb751e12ff689ab4ffa44625a8b2bc1de4e88682abe5ce9d1942792747681ad23c31046d825140987f19a9cf10323c3f50a20f35a6d1dd8ca6758296b4537a0da1a853011b777623c8774b3689897cf9264a7782470847f36a8093faee04114663438ab39d8a777fb3e10cb4a2402a939a98d387087c5ca5fd8fbc4d96ae698b5bb84a0a8484e2b85743e623a033eb5b1889ccfb4b95885bc69d4c1cb819b95e7923e557c9ec9ec10e94d1e1295fc2f256fa095036f6cfc04c414fc57fc72c120614a586089c93741e97a61c466"}) ioctl$sock_x25_SIOCADDRT(r1, 0x890b, &(0x7f0000000c80)={@null=' \x00', 0xa, 'erspan0\x00'}) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000000)=0xefff) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text32={0x20, &(0x7f0000000380)="0f0766b818008ed80f20e035000040000f22e00faea66647000066ba2000b801000000efc4c13565d4b805000000b9f4ce05c80f01d9670f01750c66b8e3000f00d8c4c2e99626", 0x47}], 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000100)={[{0x0, 0x631, 0x3b0, 0x9, 0x9, 0x1, 0x7, 0x0, 0x7, 0x7, 0x7d41, 0x3, 0x400}, {0x0, 0x81, 0x1, 0x7, 0x9, 0x3, 0x91f2, 0x5, 0xffff, 0x0, 0x0, 0x5, 0x6281832c}, {0x4, 0x1, 0x7, 0xffffffff, 0x9, 0x528, 0xce2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3}], 0x892}) socket$inet6(0xa, 0x6, 0x0) [ 746.817168] binder: 12899:12906 transaction failed 29189/-22, size 24-8 line 2994 [ 746.860405] binder: 12900:12904 got transaction with invalid offset (0, min 0 max 24) or object. [ 746.878291] binder: BINDER_SET_CONTEXT_MGR already set 05:48:44 executing program 2: inotify_init1(0x80800) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 746.908050] binder: 12900:12904 transaction failed 29201/-22, size 24-8 line 3241 [ 746.910611] binder: 12907:12908 ioctl 40046207 0 returned -16 05:48:44 executing program 1: r0 = inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x2ff914ee063d7729, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getpeername$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f0000000040)=0x1c) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000080)={0xc, 0x8, 0xfa00, {&(0x7f0000000240)}}, 0x10) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:44 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 747.067491] binder: 12907:12908 transaction failed 29189/-22, size 24-8 line 2994 [ 747.070211] binder: 12920:12924 transaction failed 29189/-22, size 24-8 line 2994 05:48:44 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:44 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 747.171451] binder: 12926:12929 got transaction with invalid offset (0, min 0 max 24) or object. 05:48:44 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0xfffffffffffffffd) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='fdhnfo/3\x00\xa5H\x04;\x8e\x9b4E1\xb3\x84\x14\xb0\xc1@c\xf3\xdc\x7f\x00\xbc?L]\x98\x9f\xcb\xabk\xe3hx\xbc\"\xba\xed\x83-\x01\xeaE\x9d\x93\x1as\xfc?\xe4[\x86\xea\xb3\x9bM\x9c7!\xe9\xce\x83*W\xf9\xc1\x0e\xbb3\xc1y\xe1\x04\x89A\xb4\xc0\xd8\xfdG\xb1\x84[\xf1`b\x17>7\xdb0!\x06\vm\x97\xaf\n~!Xf\xd9\x95\xc1\x9a\xd5\xb5\x95\xe4A\xd0\xa2\nN\xa9\x81\xa7\xe8\xc6\xb7Fd\xd5|U\x80\xb5L\xfb\xf9\x02\xdf\xdc\x1f,\x8f\x9b\xcf]\xedP\x90\x15\xeb\x93\xa6\xfbRU\x88\x91aN\x94\xe5S[\x99Kb\x96\xb0\r\xba\xdd\xca\xf3\x8f\xe866B<\x91fFj$\xb0R\x831\xf9\x94\xf1\x98W]q\x02\xbb\xcb\xa8\xb9\xac\xdd\xf3k{\x8dy\xfbi\xae\xbdB8\xd2\xfa\x8c\x03\xae]l\xd4P\xe9\x9d&D+\xd4\xf7\xbcM\x184\xca') write$P9_RLERROR(r0, &(0x7f0000000000)={0xf5, 0x7, 0x1, {0xec, 'fdhnfo/3\x00\xa5H\x04;\x8e\x9b4E1\xb3\x84\x14\xb0\xc1@c\xf3\xdc\x7f\x00\xbc?L]\x98\x9f\xcb\xabk\xe3hx\xbc\"\xba\xed\x83-\x01\xeaE\x9d\x93\x1as\xfc?\xe4[\x86\xea\xb3\x9bM\x9c7!\xe9\xce\x83*W\xf9\xc1\x0e\xbb3\xc1y\xe1\x04\x89A\xb4\xc0\xd8\xfdG\xb1\x84[\xf1`b\x17>7\xdb0!\x06\vm\x97\xaf\n~!Xf\xd9\x95\xc1\x9a\xd5\xb5\x95\xe4A\xd0\xa2\nN\xa9\x81\xa7\xe8\xc6\xb7Fd\xd5|U\x80\xb5L\xfb\xf9\x02\xdf\xdc\x1f,\x8f\x9b\xcf]\xedP\x90\x15\xeb\x93\xa6\xfbRU\x88\x91aN\x94\xe5S[\x99Kb\x96\xb0\r\xba\xdd\xca\xf3\x8f\xe866B<\x91fFj$\xb0R\x831\xf9\x94\xf1\x98W]q\x02\xbb\xcb\xa8\xb9\xac\xdd\xf3k{\x8dy\xfbi\xae\xbdB8\xd2\xfa\x8c\x03\xae]l\xd4P\xe9\x9d&D+\xd4\xf7\xbcM\x184\xca'}}, 0xf5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r0, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x64, r2, 0x204, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfd0}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x20008000}, 0x40010) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 747.221736] binder: 12926:12929 transaction failed 29201/-22, size 24-8 line 3241 [ 747.341345] binder_alloc: 12926: binder_alloc_buf, no vma [ 747.368012] binder: 12932:12934 transaction failed 29189/-3, size 24-8 line 3147 [ 747.422646] binder: 12936:12940 got transaction with invalid offset (0, min 0 max 24) or object. [ 747.635084] net_ratelimit: 16 callbacks suppressed [ 747.635090] protocol 88fb is buggy, dev hsr_slave_0 [ 747.645228] protocol 88fb is buggy, dev hsr_slave_1 [ 747.715160] protocol 88fb is buggy, dev hsr_slave_0 [ 747.720282] protocol 88fb is buggy, dev hsr_slave_1 [ 748.195088] protocol 88fb is buggy, dev hsr_slave_0 [ 748.200164] protocol 88fb is buggy, dev hsr_slave_1 [ 748.275133] protocol 88fb is buggy, dev hsr_slave_0 [ 748.280273] protocol 88fb is buggy, dev hsr_slave_1 [ 748.285458] protocol 88fb is buggy, dev hsr_slave_0 [ 748.290511] protocol 88fb is buggy, dev hsr_slave_1 05:48:47 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x8000000008001a0, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:47 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:47 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:47 executing program 4: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000e80)=ANY=[@ANYBLOB="000429bd7000fcdbdf2103000600040002005400030008000300010000020008368600000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) r1 = dup3(r0, 0xffffffffffffff9c, 0x80000) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r3, 0x4068aea3, &(0x7f0000000240)={0x79}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f00000007c0)={"a523fb9656eb871ffcd7ffeb51d84e738a55eba841ae487e33cdd921e8a51ce6c924020f0ac3562dd8cdeb31deac16f46da4ac16ee8165bce439eddce671c5b0a1103ea3f86a43cbb78504f6f9c77c2f09dc27632ec6036ee52a87e321e707c0cfe15576c26d52d0334c8d4693e127b3a046a5ed7796c9c5017cfd58ec871ed76369846fea9ebfa2f7f96496abf4ef57ed1ecd930eb9e13396875f01e932804ffe8a34c8fbedd97cdfb3176ec59fbbfd20a6ff17795431c3908530e4f5f703480a5211cc6a7e2084e4a9b6aedf60b7b8084b00ca2cbed255b4cc4679c967432fea5e95119f9635e94794aab6ef54f290677fa08d0ee2cc8eae468efd02417055d3f3ccc86b629dfb878c4d115c16c75fe352cffa93648cf49577256b5d2faf0634335c97ffff966ae90cbf81250df3613c25d2789c869c9cc95a6e9d364c4c684059c593f9950e66cf81cd9f36d73fade4f0cbb795010364d13ff32c12efd91d0ebb6533700945f2db6113a630bd521eec89a74c46e1733b72d6e4d2ccee3b40f99809a9a4fb5fc2d1c53e1366d455bcbe81893100ab56b2556b55c1a0c5787356b464c3bf7011488e55f587a6d4420d46d69a74ee5bbfbcb0d6cb00aae8c3dfd6dd2e9f76d7a542f20553207b668dce69f1b463ee9166e81bb109f461b8885f15c9e525d72260ccdbd69e3345612158114780b9409ea856cb724faa6ed27ba836b35c10e7c7d43f2fa34f98f16a00f31565e16a213eaf4a7f438c89733ebe6d16328b930fd942bc64d631dd1f2aa1cc2ccdaff2324076c83e1ba4d2a0e40e010c96b42e7a4a76cd7a89ef592b9b3030f62d9fbd565ee5908ab90b42620b61e5d1e08621a31d21003cd12a450461636472fa64a7e1b98778bfb482fb4b4da31b42ee98b10f9c0f4c085d08c37ee2e3a9e4a5aff72a0ab844fcbfa224842c85f6cdfd25829c44760e3859624f891df4824f7d17938ac2def6721639176fad9512ee9b4c5de1412cf3083e1d5ee2d29b63267ccba535409da7bef05d3fa79a3ef037ee609e01ad345ee17f48b5e8510f767de35df4dfb856f7533ad88866c6b01fe345107ba7191a8809e2e014492acf9c4f35cad664198a65c55f884490f4b30b4526324be842c393f336f16bea2bf6c6b917fdb751e12ff689ab4ffa44625a8b2bc1de4e88682abe5ce9d1942792747681ad23c31046d825140987f19a9cf10323c3f50a20f35a6d1dd8ca6758296b4537a0da1a853011b777623c8774b3689897cf9264a7782470847f36a8093faee04114663438ab39d8a777fb3e10cb4a2402a939a98d387087c5ca5fd8fbc4d96ae698b5bb84a0a8484e2b85743e623a033eb5b1889ccfb4b95885bc69d4c1cb819b95e7923e557c9ec9ec10e94d1e1295fc2f256fa095036f6cfc04c414fc57fc72c120614a586089c93741e97a61c466"}) ioctl$sock_x25_SIOCADDRT(r1, 0x890b, &(0x7f0000000c80)={@null=' \x00', 0xa, 'erspan0\x00'}) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000000)=0xefff) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text32={0x20, &(0x7f0000000380)="0f0766b818008ed80f20e035000040000f22e00faea66647000066ba2000b801000000efc4c13565d4b805000000b9f4ce05c80f01d9670f01750c66b8e3000f00d8c4c2e99626", 0x47}], 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000100)={[{0x0, 0x631, 0x3b0, 0x9, 0x9, 0x1, 0x7, 0x0, 0x7, 0x7, 0x7d41, 0x3, 0x400}, {0x0, 0x81, 0x1, 0x7, 0x9, 0x3, 0x91f2, 0x5, 0xffff, 0x0, 0x0, 0x5, 0x6281832c}, {0x4, 0x1, 0x7, 0xffffffff, 0x9, 0x528, 0xce2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3}], 0x892}) socket$inet6(0xa, 0x6, 0x0) 05:48:47 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:47 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 749.951297] binder: BINDER_SET_CONTEXT_MGR already set [ 749.954851] binder: 12947:12950 got transaction with invalid offset (0, min 0 max 24) or object. [ 749.982998] binder_transaction: 1 callbacks suppressed [ 749.983060] binder: 12947:12950 transaction failed 29201/-22, size 24-8 line 3241 05:48:47 executing program 1: r0 = inotify_init1(0x80800) fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000040)='TRUE', 0x4, 0x1) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:47 executing program 0: inotify_init1(0x80800) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 749.991265] binder: 12948:12955 ioctl 40046207 0 returned -16 [ 749.997730] binder: 12952:12953 got transaction with invalid offset (0, min 0 max 24) or object. [ 750.024954] binder: 12952:12953 transaction failed 29201/-22, size 24-8 line 3241 [ 750.028784] binder: 12948:12962 got transaction with invalid offset (0, min 0 max 24) or object. 05:48:47 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 750.149220] binder: 12968:12969 got transaction with invalid offset (0, min 0 max 24) or object. [ 750.165321] binder: 12948:12962 transaction failed 29201/-22, size 24-8 line 3241 [ 750.192579] binder: 12968:12969 transaction failed 29201/-22, size 24-8 line 3241 [ 750.207005] binder: 12971:12973 got transaction with invalid offset (0, min 0 max 24) or object. [ 750.224519] binder: 12971:12973 transaction failed 29201/-22, size 24-8 line 3241 05:48:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:47 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x83c01296d847f42a, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r0, 0x4008ae48, &(0x7f0000000000)=0x6000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:47 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 750.353005] binder: 12978:12979 got transaction with invalid offset (0, min 0 max 24) or object. [ 750.398258] binder: 12978:12979 transaction failed 29201/-22, size 24-8 line 3241 [ 750.448488] binder: 12982:12983 got transaction with invalid offset (0, min 0 max 24) or object. [ 750.503655] binder: 12982:12983 transaction failed 29201/-22, size 24-8 line 3241 [ 752.755227] net_ratelimit: 24 callbacks suppressed [ 752.755237] protocol 88fb is buggy, dev hsr_slave_0 [ 752.765362] protocol 88fb is buggy, dev hsr_slave_1 05:48:50 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000940000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:50 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:50 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:50 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:50 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000500)=r0) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000040)={'veth0_to_hsr\x00'}) inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) accept4$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x14, 0x80800) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f0000000300)={@xdp={0x2c, 0x4, r3, 0x23}, {&(0x7f0000000240)=""/175, 0xaf}, &(0x7f0000000140), 0x4}, 0xa0) clock_gettime(0x0, &(0x7f0000000480)={0x0, 0x0}) mq_timedsend(r0, &(0x7f00000003c0)="5a77183adcad33078354955e664738be57a4daa84c7329afb1b8fb625d1b02f474d55b8028c4c2d21644f1935e1cb61bd841b514536f53b6f8bb489066d244944f279e3162356e2b5a3668cefcff92fb4c1c685f2d8d231646e03ed61cab1d4718e3bc7ab8deb7", 0x67, 0x400, &(0x7f00000004c0)={r4, r5+30000000}) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:48:50 executing program 4: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000e80)=ANY=[@ANYBLOB="000429bd7000fcdbdf2103000600040002005400030008000300010000020008368600000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) r1 = dup3(r0, 0xffffffffffffff9c, 0x80000) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r3, 0x4068aea3, &(0x7f0000000240)={0x79}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f00000007c0)={"a523fb9656eb871ffcd7ffeb51d84e738a55eba841ae487e33cdd921e8a51ce6c924020f0ac3562dd8cdeb31deac16f46da4ac16ee8165bce439eddce671c5b0a1103ea3f86a43cbb78504f6f9c77c2f09dc27632ec6036ee52a87e321e707c0cfe15576c26d52d0334c8d4693e127b3a046a5ed7796c9c5017cfd58ec871ed76369846fea9ebfa2f7f96496abf4ef57ed1ecd930eb9e13396875f01e932804ffe8a34c8fbedd97cdfb3176ec59fbbfd20a6ff17795431c3908530e4f5f703480a5211cc6a7e2084e4a9b6aedf60b7b8084b00ca2cbed255b4cc4679c967432fea5e95119f9635e94794aab6ef54f290677fa08d0ee2cc8eae468efd02417055d3f3ccc86b629dfb878c4d115c16c75fe352cffa93648cf49577256b5d2faf0634335c97ffff966ae90cbf81250df3613c25d2789c869c9cc95a6e9d364c4c684059c593f9950e66cf81cd9f36d73fade4f0cbb795010364d13ff32c12efd91d0ebb6533700945f2db6113a630bd521eec89a74c46e1733b72d6e4d2ccee3b40f99809a9a4fb5fc2d1c53e1366d455bcbe81893100ab56b2556b55c1a0c5787356b464c3bf7011488e55f587a6d4420d46d69a74ee5bbfbcb0d6cb00aae8c3dfd6dd2e9f76d7a542f20553207b668dce69f1b463ee9166e81bb109f461b8885f15c9e525d72260ccdbd69e3345612158114780b9409ea856cb724faa6ed27ba836b35c10e7c7d43f2fa34f98f16a00f31565e16a213eaf4a7f438c89733ebe6d16328b930fd942bc64d631dd1f2aa1cc2ccdaff2324076c83e1ba4d2a0e40e010c96b42e7a4a76cd7a89ef592b9b3030f62d9fbd565ee5908ab90b42620b61e5d1e08621a31d21003cd12a450461636472fa64a7e1b98778bfb482fb4b4da31b42ee98b10f9c0f4c085d08c37ee2e3a9e4a5aff72a0ab844fcbfa224842c85f6cdfd25829c44760e3859624f891df4824f7d17938ac2def6721639176fad9512ee9b4c5de1412cf3083e1d5ee2d29b63267ccba535409da7bef05d3fa79a3ef037ee609e01ad345ee17f48b5e8510f767de35df4dfb856f7533ad88866c6b01fe345107ba7191a8809e2e014492acf9c4f35cad664198a65c55f884490f4b30b4526324be842c393f336f16bea2bf6c6b917fdb751e12ff689ab4ffa44625a8b2bc1de4e88682abe5ce9d1942792747681ad23c31046d825140987f19a9cf10323c3f50a20f35a6d1dd8ca6758296b4537a0da1a853011b777623c8774b3689897cf9264a7782470847f36a8093faee04114663438ab39d8a777fb3e10cb4a2402a939a98d387087c5ca5fd8fbc4d96ae698b5bb84a0a8484e2b85743e623a033eb5b1889ccfb4b95885bc69d4c1cb819b95e7923e557c9ec9ec10e94d1e1295fc2f256fa095036f6cfc04c414fc57fc72c120614a586089c93741e97a61c466"}) ioctl$sock_x25_SIOCADDRT(r1, 0x890b, &(0x7f0000000c80)={@null=' \x00', 0xa, 'erspan0\x00'}) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000000)=0xefff) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text32={0x20, &(0x7f0000000380)="0f0766b818008ed80f20e035000040000f22e00faea66647000066ba2000b801000000efc4c13565d4b805000000b9f4ce05c80f01d9670f01750c66b8e3000f00d8c4c2e99626", 0x47}], 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000100)={[{0x0, 0x631, 0x3b0, 0x9, 0x9, 0x1, 0x7, 0x0, 0x7, 0x7, 0x7d41, 0x3, 0x400}, {0x0, 0x81, 0x1, 0x7, 0x9, 0x3, 0x91f2, 0x5, 0xffff, 0x0, 0x0, 0x5, 0x6281832c}, {0x4, 0x1, 0x7, 0xffffffff, 0x9, 0x528, 0xce2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3}], 0x892}) socket$inet6(0xa, 0x6, 0x0) [ 753.185212] binder: 13000:13001 transaction failed 29189/-22, size 24-8 line 2994 05:48:50 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:50 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x200, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={r0, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000140)='fdinfo/3\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={r0, r1, 0x0, 0x9, &(0x7f0000000100)='fdinfo/3\x00', r2}, 0x30) r3 = syz_open_procfs(r0, &(0x7f0000000000)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) preadv(r3, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 753.269448] binder: BINDER_SET_CONTEXT_MGR already set 05:48:50 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 753.314980] binder: 12995:13007 ioctl 40046207 0 returned -16 [ 753.315606] binder_alloc: 12996: binder_alloc_buf failed to map pages in userspace, no vma [ 753.321570] binder: 12995:13013 transaction failed 29189/-3, size 24-8 line 3147 [ 753.394805] binder: 13016:13019 transaction failed 29189/-22, size 24-8 line 2994 05:48:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:50 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:50 executing program 1: inotify_init1(0x80000) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) timerfd_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, &(0x7f0000000080)) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') exit(0xff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 753.615848] binder: 13028:13032 got transaction with invalid offset (0, min 0 max 24) or object. [ 753.630771] binder: 13029:13033 got transaction with invalid offset (0, min 0 max 24) or object. [ 753.875133] protocol 88fb is buggy, dev hsr_slave_0 [ 753.880322] protocol 88fb is buggy, dev hsr_slave_1 [ 753.955134] protocol 88fb is buggy, dev hsr_slave_0 [ 753.960285] protocol 88fb is buggy, dev hsr_slave_1 [ 754.445188] protocol 88fb is buggy, dev hsr_slave_0 [ 754.450334] protocol 88fb is buggy, dev hsr_slave_1 [ 754.515214] protocol 88fb is buggy, dev hsr_slave_0 [ 754.520366] protocol 88fb is buggy, dev hsr_slave_1 05:48:53 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000a05000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:53 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:53 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:53 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:53 executing program 1: r0 = inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x78, r1, 0x34, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x81}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x10}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x39}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x4) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 756.276685] binder_transaction: 2 callbacks suppressed [ 756.276735] binder: 13050:13053 transaction failed 29189/-22, size 24-8 line 2994 [ 756.294441] binder: 13049:13055 got transaction with invalid offset (0, min 0 max 24) or object. [ 756.299358] binder: BINDER_SET_CONTEXT_MGR already set 05:48:53 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 756.326665] binder: 13052:13056 ioctl 40046207 0 returned -16 [ 756.343835] binder: 13049:13055 transaction failed 29201/-22, size 24-8 line 3241 [ 756.362347] binder: 13052:13056 got transaction with invalid offset (0, min 0 max 24) or object. 05:48:53 executing program 1: inotify_init1(0x807f9) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='oom_score\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$getownex(r1, 0x10, &(0x7f0000000000)) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 756.389544] binder: 13052:13056 transaction failed 29201/-22, size 24-8 line 3241 05:48:53 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 756.509327] binder: 13066:13068 got transaction with invalid offset (0, min 0 max 24) or object. [ 756.517229] binder: BINDER_SET_CONTEXT_MGR already set [ 756.526790] binder: 13063:13069 ioctl 40046207 0 returned -16 [ 756.568368] binder: 13063:13069 got transaction with invalid offset (0, min 0 max 24) or object. [ 756.571361] binder: 13066:13068 transaction failed 29201/-22, size 24-8 line 3241 [ 756.598581] binder: 13074:13078 got transaction with invalid offset (0, min 0 max 24) or object. [ 756.603218] binder: 13063:13069 transaction failed 29201/-22, size 24-8 line 3241 05:48:54 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 756.612969] binder: 13074:13078 transaction failed 29201/-22, size 24-8 line 3241 [ 756.632109] binder: BINDER_SET_CONTEXT_MGR already set [ 756.648431] binder: 13075:13079 ioctl 40046207 0 returned -16 [ 756.696329] binder: 13075:13079 transaction failed 29189/-22, size 24-8 line 2994 [ 756.786737] binder: 13085:13086 transaction failed 29189/-22, size 24-8 line 2994 [ 758.035103] net_ratelimit: 16 callbacks suppressed [ 758.040084] protocol 88fb is buggy, dev hsr_slave_0 [ 758.045185] protocol 88fb is buggy, dev hsr_slave_1 [ 758.115153] protocol 88fb is buggy, dev hsr_slave_0 [ 758.120246] protocol 88fb is buggy, dev hsr_slave_1 [ 758.595101] protocol 88fb is buggy, dev hsr_slave_0 [ 758.600194] protocol 88fb is buggy, dev hsr_slave_1 [ 758.675123] protocol 88fb is buggy, dev hsr_slave_0 [ 758.680258] protocol 88fb is buggy, dev hsr_slave_1 [ 758.685436] protocol 88fb is buggy, dev hsr_slave_0 [ 758.690503] protocol 88fb is buggy, dev hsr_slave_1 05:48:56 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000a07000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:48:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:56 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:56 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:56 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:56 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 759.556535] binder: BINDER_SET_CONTEXT_MGR already set [ 759.561882] binder: 13099:13101 ioctl 40046207 0 returned -16 [ 759.563518] binder: 13093:13102 got transaction with invalid offset (0, min 0 max 24) or object. [ 759.568379] binder: 13095:13097 got transaction with invalid offset (0, min 0 max 24) or object. [ 759.592184] binder: BINDER_SET_CONTEXT_MGR already set 05:48:56 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 759.604357] binder: 13096:13100 ioctl 40046207 0 returned -16 [ 759.612952] binder: 13093:13102 transaction failed 29201/-22, size 24-8 line 3241 [ 759.620542] binder: 13095:13097 transaction failed 29201/-22, size 24-8 line 3241 [ 759.628849] binder: 13099:13105 got transaction with invalid offset (0, min 0 max 24) or object. [ 759.637408] binder: 13096:13107 got transaction with invalid offset (0, min 0 max 24) or object. 05:48:57 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:57 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:57 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:48:57 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 759.884420] binder: 13114:13117 got transaction with invalid offset (0, min 0 max 24) or object. [ 759.906031] binder: BINDER_SET_CONTEXT_MGR already set [ 759.941999] binder: 13118:13123 ioctl 40046207 0 returned -16 [ 759.948628] binder: BINDER_SET_CONTEXT_MGR already set [ 759.964897] binder: 13120:13122 ioctl 40046207 0 returned -16 05:49:00 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000001000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:00 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:00 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:00 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:00 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 762.803903] binder_transaction: 4 callbacks suppressed [ 762.803932] binder: 13139:13148 transaction failed 29189/-22, size 24-8 line 2994 05:49:00 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 762.852269] binder_transaction: 1 callbacks suppressed [ 762.852317] binder: 13140:13145 got transaction with invalid offset (0, min 0 max 24) or object. [ 762.852498] binder: 13141:13147 got transaction with invalid offset (0, min 0 max 24) or object. [ 762.858626] binder: 13140:13145 transaction failed 29201/-22, size 24-8 line 3241 05:49:00 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:00 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 762.937414] binder: 13141:13147 transaction failed 29201/-22, size 24-8 line 3241 [ 763.027765] binder: 13160:13161 transaction failed 29189/-22, size 24-8 line 2994 05:49:00 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 763.155153] net_ratelimit: 24 callbacks suppressed [ 763.155161] protocol 88fb is buggy, dev hsr_slave_0 [ 763.165236] protocol 88fb is buggy, dev hsr_slave_1 [ 763.220853] binder: 13167:13171 transaction failed 29189/-22, size 24-8 line 2994 [ 763.244854] binder: 13168:13173 transaction failed 29189/-22, size 24-8 line 2994 [ 764.275092] protocol 88fb is buggy, dev hsr_slave_0 [ 764.280198] protocol 88fb is buggy, dev hsr_slave_1 [ 764.355143] protocol 88fb is buggy, dev hsr_slave_0 [ 764.360230] protocol 88fb is buggy, dev hsr_slave_1 [ 764.835120] protocol 88fb is buggy, dev hsr_slave_0 [ 764.840216] protocol 88fb is buggy, dev hsr_slave_1 [ 764.915226] protocol 88fb is buggy, dev hsr_slave_0 [ 764.920333] protocol 88fb is buggy, dev hsr_slave_1 05:49:03 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000002000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:03 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:03 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:03 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:03 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:03 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:03 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 766.011236] binder: 13181:13184 transaction failed 29189/-22, size 24-8 line 2994 [ 766.020544] binder: 13182:13183 transaction failed 29189/-22, size 24-8 line 2994 05:49:03 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:03 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:03 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:03 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:03 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 766.215828] binder: 13199:13200 transaction failed 29189/-22, size 24-8 line 2994 [ 766.321131] binder: 13208:13209 transaction failed 29189/-22, size 24-8 line 2994 [ 766.345433] binder: BINDER_SET_CONTEXT_MGR already set [ 766.358404] binder: 13207:13210 ioctl 40046207 0 returned -16 [ 768.435108] net_ratelimit: 16 callbacks suppressed [ 768.435115] protocol 88fb is buggy, dev hsr_slave_0 [ 768.445162] protocol 88fb is buggy, dev hsr_slave_1 [ 768.515135] protocol 88fb is buggy, dev hsr_slave_0 [ 768.520217] protocol 88fb is buggy, dev hsr_slave_1 05:49:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000020000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:06 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 05:49:06 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:06 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:06 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 768.995142] protocol 88fb is buggy, dev hsr_slave_0 [ 769.000219] protocol 88fb is buggy, dev hsr_slave_1 [ 769.073793] binder: 13222:13227 ioctl c0306201 0 returned -14 [ 769.075135] protocol 88fb is buggy, dev hsr_slave_0 [ 769.084823] protocol 88fb is buggy, dev hsr_slave_1 [ 769.089973] protocol 88fb is buggy, dev hsr_slave_0 [ 769.095064] protocol 88fb is buggy, dev hsr_slave_1 05:49:06 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 769.119581] binder_alloc: 13225: binder_alloc_buf, no vma 05:49:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 769.155536] binder_transaction: 1 callbacks suppressed [ 769.155571] binder: 13225:13226 transaction failed 29189/-3, size 24-8 line 3147 05:49:06 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 769.217885] binder: BINDER_SET_CONTEXT_MGR already set [ 769.251518] binder: 13223:13230 ioctl 40046207 0 returned -16 [ 769.274150] binder: BINDER_SET_CONTEXT_MGR already set 05:49:06 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:06 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 769.314492] binder: 13237:13240 ioctl 40046207 0 returned -16 [ 769.314754] binder: 13223:13230 transaction failed 29189/-22, size 24-8 line 2994 [ 769.346468] binder: 13237:13246 ioctl c0306201 0 returned -14 05:49:06 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 769.442280] binder: 13248:13250 transaction failed 29189/-22, size 24-8 line 2994 05:49:09 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000030000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 05:49:09 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:09 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:09 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:09 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 772.374453] binder: 13274:13275 ioctl c0306201 0 returned -14 [ 772.384078] binder: 13265:13266 ioctl c0306201 0 returned -14 05:49:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) [ 772.437779] binder: 13268:13269 got transaction with invalid offset (0, min 0 max 24) or object. [ 772.463017] binder: BINDER_SET_CONTEXT_MGR already set 05:49:09 executing program 1: inotify_init1(0x80800) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:09 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 772.484886] binder: 13268:13269 transaction failed 29201/-22, size 24-8 line 3241 [ 772.488446] binder: 13273:13277 ioctl 40046207 0 returned -16 [ 772.546682] binder: 13273:13280 got transaction with invalid offset (0, min 0 max 24) or object. [ 772.584146] binder: BINDER_SET_CONTEXT_MGR already set 05:49:10 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 772.608923] binder: 13284:13285 ioctl 40046207 0 returned -16 [ 772.610069] binder: 13273:13280 transaction failed 29201/-22, size 24-8 line 3241 [ 772.632786] binder: 13287:13288 ioctl c0306201 0 returned -14 05:49:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 05:49:10 executing program 1: inotify_init1(0x80800) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 772.832129] binder: 13293:13297 got transaction with invalid offset (0, min 0 max 24) or object. [ 772.865879] binder: 13293:13297 transaction failed 29201/-22, size 24-8 line 3241 [ 773.555196] net_ratelimit: 24 callbacks suppressed [ 773.555206] protocol 88fb is buggy, dev hsr_slave_0 [ 773.565349] protocol 88fb is buggy, dev hsr_slave_1 [ 774.675107] protocol 88fb is buggy, dev hsr_slave_0 [ 774.680257] protocol 88fb is buggy, dev hsr_slave_1 [ 774.755144] protocol 88fb is buggy, dev hsr_slave_0 [ 774.760231] protocol 88fb is buggy, dev hsr_slave_1 [ 775.235154] protocol 88fb is buggy, dev hsr_slave_0 [ 775.240271] protocol 88fb is buggy, dev hsr_slave_1 [ 775.315131] protocol 88fb is buggy, dev hsr_slave_0 [ 775.320242] protocol 88fb is buggy, dev hsr_slave_1 05:49:12 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:12 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 05:49:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 05:49:12 executing program 1: inotify_init1(0x80800) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:12 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x80000003f000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:12 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 775.419080] binder: 13309:13311 ioctl c0306201 0 returned -14 05:49:12 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 05:49:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 775.514572] binder: 13307:13315 got transaction with invalid offset (0, min 0 max 24) or object. [ 775.552965] binder: BINDER_SET_CONTEXT_MGR already set 05:49:12 executing program 1: inotify_init1(0x80800) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 775.571233] binder: 13307:13315 transaction failed 29201/-22, size 24-8 line 3241 [ 775.596058] binder: 13313:13316 ioctl 40046207 0 returned -16 [ 775.605635] binder: 13313:13324 got transaction with invalid offset (0, min 0 max 24) or object. [ 775.615189] binder: BINDER_SET_CONTEXT_MGR already set 05:49:13 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 05:49:13 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 775.641618] binder: 13322:13326 ioctl 40046207 0 returned -16 [ 775.653162] binder: 13313:13324 transaction failed 29201/-22, size 24-8 line 3241 [ 775.672914] binder: 13322:13333 got transaction with invalid offsets ptr [ 775.702799] binder: 13322:13333 transaction failed 29201/-14, size 24-8 line 3193 05:49:13 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:13 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 775.781027] binder: undelivered TRANSACTION_ERROR: 29201 05:49:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:13 executing program 1: preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:13 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) [ 775.954540] binder_alloc: 13343: binder_alloc_buf, no vma [ 775.971796] binder: BINDER_SET_CONTEXT_MGR already set [ 775.985519] binder: 13343:13345 transaction failed 29189/-3, size 24-8 line 3147 [ 776.012038] binder: 13346:13350 ioctl 40046207 0 returned -16 [ 776.018760] binder_alloc: 13343: binder_alloc_buf, no vma [ 776.032175] binder: 13342:13347 transaction failed 29189/-3, size 24-8 line 3147 [ 776.033062] binder_alloc: 13343: binder_alloc_buf, no vma [ 776.136922] binder: 13346:13354 transaction failed 29189/-3, size 24-8 line 3147 [ 776.157641] binder: undelivered TRANSACTION_ERROR: 29189 05:49:15 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000040000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:15 executing program 1: preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:15 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:15 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:15 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:16 executing program 1: preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 778.710697] binder_alloc: 13370: binder_alloc_buf, no vma [ 778.717806] binder: BINDER_SET_CONTEXT_MGR already set [ 778.723721] binder: 13370:13373 transaction failed 29189/-3, size 24-8 line 3147 [ 778.729739] binder: 13364:13369 ioctl 40046207 0 returned -16 [ 778.731589] binder_alloc: 13370: binder_alloc_buf, no vma [ 778.761291] binder: 13366:13374 transaction failed 29189/-3, size 24-8 line 3147 [ 778.770315] binder_alloc: 13370: binder_alloc_buf, no vma [ 778.799043] binder: undelivered TRANSACTION_ERROR: 29189 05:49:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) [ 778.800773] binder: 13367:13372 transaction failed 29189/-3, size 24-8 line 3147 [ 778.809615] binder_alloc: 13370: binder_alloc_buf, no vma [ 778.830330] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.836013] net_ratelimit: 16 callbacks suppressed [ 778.836021] protocol 88fb is buggy, dev hsr_slave_0 [ 778.836071] protocol 88fb is buggy, dev hsr_slave_1 05:49:16 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:16 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 778.884739] binder: 13364:13369 transaction failed 29189/-3, size 24-8 line 3147 [ 778.915135] protocol 88fb is buggy, dev hsr_slave_0 [ 778.920242] protocol 88fb is buggy, dev hsr_slave_1 05:49:16 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 778.968860] binder_alloc: 13384: binder_alloc_buf, no vma [ 779.006421] binder: undelivered TRANSACTION_ERROR: 29189 05:49:16 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 779.028129] binder: undelivered TRANSACTION_ERROR: 29189 [ 779.395096] protocol 88fb is buggy, dev hsr_slave_0 [ 779.400192] protocol 88fb is buggy, dev hsr_slave_1 [ 779.475232] protocol 88fb is buggy, dev hsr_slave_0 [ 779.480385] protocol 88fb is buggy, dev hsr_slave_1 [ 779.485580] protocol 88fb is buggy, dev hsr_slave_0 [ 779.490649] protocol 88fb is buggy, dev hsr_slave_1 05:49:19 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000060000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:19 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:19 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:19 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:19 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 781.772936] binder_alloc: 13407: binder_alloc_buf, no vma [ 781.796921] binder_transaction: 4 callbacks suppressed [ 781.796939] binder: 13407:13416 transaction failed 29189/-3, size 24-8 line 3147 [ 781.813832] binder_alloc: 13407: binder_alloc_buf, no vma 05:49:19 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 781.834011] binder: 13409:13415 transaction failed 29189/-3, size 24-8 line 3147 [ 781.842012] binder_alloc: 13407: binder_alloc_buf, no vma [ 781.843452] binder: BINDER_SET_CONTEXT_MGR already set [ 781.867547] binder: 13410:13411 transaction failed 29189/-3, size 24-8 line 3147 [ 781.869618] binder: 13413:13414 ioctl 40046207 0 returned -16 05:49:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) [ 781.892774] binder: undelivered TRANSACTION_ERROR: 29189 [ 781.908606] binder: undelivered TRANSACTION_ERROR: 29189 [ 781.916076] binder: 13413:13422 transaction failed 29189/-22, size 24-8 line 2994 05:49:19 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:19 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:19 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{0x0}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 782.038478] binder_alloc: 13427: binder_alloc_buf, no vma [ 782.064679] binder: 13427:13429 transaction failed 29189/-3, size 24-8 line 3147 05:49:19 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 782.088014] binder: undelivered TRANSACTION_ERROR: 29189 [ 782.127590] binder: 13431:13435 transaction failed 29189/-22, size 24-8 line 2994 [ 782.140536] binder_alloc: 13432: binder_alloc_buf, no vma [ 782.169607] binder: undelivered TRANSACTION_ERROR: 29189 [ 782.175882] binder: 13432:13433 transaction failed 29189/-3, size 24-8 line 3147 [ 782.239963] binder: 13437:13440 got transaction with invalid offset (0, min 0 max 24) or object. [ 782.272964] binder: 13437:13440 transaction failed 29201/-22, size 24-8 line 3241 [ 783.955205] net_ratelimit: 24 callbacks suppressed [ 783.960220] protocol 88fb is buggy, dev hsr_slave_0 [ 783.965382] protocol 88fb is buggy, dev hsr_slave_1 05:49:22 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:22 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{0x0}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:22 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:22 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x8000000a0018000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:22 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 784.861060] binder_alloc: 13452: binder_alloc_buf, no vma [ 784.890238] binder: BINDER_SET_CONTEXT_MGR already set 05:49:22 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{0x0}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 784.908081] binder_alloc: 13452: binder_alloc_buf, no vma [ 784.909534] binder: 13449:13457 ioctl 40046207 0 returned -16 [ 784.913772] binder: 13448:13458 transaction failed 29189/-3, size 24-8 line 3147 [ 784.920214] binder: BINDER_SET_CONTEXT_MGR already set [ 784.928054] binder: 13452:13454 transaction failed 29189/-3, size 24-8 line 3147 [ 784.944537] binder: 13451:13453 ioctl 40046207 0 returned -16 [ 784.951088] binder: undelivered TRANSACTION_ERROR: 29189 05:49:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 784.988640] binder: undelivered TRANSACTION_ERROR: 29189 05:49:22 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:22 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 785.075090] protocol 88fb is buggy, dev hsr_slave_0 [ 785.080216] protocol 88fb is buggy, dev hsr_slave_1 [ 785.084271] binder_alloc: 13466: binder_alloc_buf, no vma [ 785.108385] binder: undelivered TRANSACTION_ERROR: 29189 05:49:22 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 785.155163] protocol 88fb is buggy, dev hsr_slave_0 [ 785.160303] protocol 88fb is buggy, dev hsr_slave_1 05:49:22 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 785.221842] binder: undelivered TRANSACTION_ERROR: 29189 [ 785.230694] binder_alloc: 13473: binder_alloc_buf, no vma 05:49:22 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:22 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:22 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 785.280063] binder_alloc: 13478: binder_alloc_buf, no vma [ 785.312000] binder: undelivered TRANSACTION_ERROR: 29189 [ 785.405420] binder: 13483:13485 got transaction with invalid offset (0, min 0 max 24) or object. [ 785.442813] binder: 13489:13491 got transaction with invalid offset (0, min 0 max 24) or object. [ 785.460076] binder: BINDER_SET_CONTEXT_MGR already set [ 785.481189] binder: 13490:13493 ioctl 40046207 0 returned -16 [ 785.481227] binder: undelivered TRANSACTION_ERROR: 29201 [ 785.503298] binder: 13490:13493 got transaction with invalid offset (0, min 0 max 24) or object. [ 785.635128] protocol 88fb is buggy, dev hsr_slave_0 [ 785.640255] protocol 88fb is buggy, dev hsr_slave_1 [ 785.715147] protocol 88fb is buggy, dev hsr_slave_0 [ 785.720262] protocol 88fb is buggy, dev hsr_slave_1 05:49:25 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x8000000e00f0000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:25 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:25 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:25 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:25 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) [ 787.966947] binder_transaction: 9 callbacks suppressed [ 787.966965] binder: 13505:13507 transaction failed 29189/-22, size 24-8 line 2994 [ 787.968626] binder_alloc: 13508: binder_alloc_buf, no vma [ 787.988244] binder: undelivered TRANSACTION_ERROR: 29189 [ 787.992826] binder: 13508:13512 transaction failed 29189/-3, size 24-8 line 3147 [ 788.004469] binder: undelivered TRANSACTION_ERROR: 29189 05:49:25 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 788.037266] binder: 13506:13514 transaction failed 29189/-22, size 24-8 line 2994 05:49:25 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 788.081260] binder: 13504:13513 got transaction with invalid offset (0, min 0 max 24) or object. 05:49:25 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 788.145909] binder: 13504:13513 transaction failed 29201/-22, size 24-8 line 3241 [ 788.186456] binder: BINDER_SET_CONTEXT_MGR already set [ 788.207854] binder: 13525:13527 got transaction with invalid offsets ptr [ 788.215685] binder: 13517:13523 ioctl 40046207 0 returned -16 [ 788.224540] binder: 13517:13523 got transaction with invalid offset (0, min 0 max 24) or object. 05:49:25 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 788.250992] binder: 13528:13529 got transaction with invalid offset (0, min 0 max 24) or object. [ 788.266633] binder: 13525:13527 transaction failed 29201/-14, size 24-8 line 3193 [ 788.269028] binder: 13517:13523 transaction failed 29201/-22, size 24-8 line 3241 05:49:25 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 788.306420] binder: 13528:13529 transaction failed 29201/-22, size 24-8 line 3241 [ 788.325560] binder: undelivered TRANSACTION_ERROR: 29201 [ 788.352335] binder: undelivered TRANSACTION_ERROR: 29201 [ 788.520445] binder: 13533:13536 got transaction with invalid offset (0, min 0 max 24) or object. [ 788.534025] binder: 13533:13536 transaction failed 29201/-22, size 24-8 line 3241 [ 789.235163] net_ratelimit: 16 callbacks suppressed [ 789.235174] protocol 88fb is buggy, dev hsr_slave_0 [ 789.245319] protocol 88fb is buggy, dev hsr_slave_1 [ 789.315202] protocol 88fb is buggy, dev hsr_slave_0 [ 789.320336] protocol 88fb is buggy, dev hsr_slave_1 [ 789.795163] protocol 88fb is buggy, dev hsr_slave_0 [ 789.800254] protocol 88fb is buggy, dev hsr_slave_1 [ 789.875154] protocol 88fb is buggy, dev hsr_slave_0 [ 789.880245] protocol 88fb is buggy, dev hsr_slave_1 [ 789.885438] protocol 88fb is buggy, dev hsr_slave_0 [ 789.890501] protocol 88fb is buggy, dev hsr_slave_1 05:49:28 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x8000000f0ffffff, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:28 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:28 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:28 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:28 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 791.047031] binder_alloc: 13550: binder_alloc_buf, no vma [ 791.067914] binder_alloc: 13550: binder_alloc_buf, no vma [ 791.073613] binder: 13550:13552 transaction failed 29189/-3, size 24-8 line 3147 [ 791.084809] binder: 13545:13555 transaction failed 29189/-3, size 24-8 line 3147 [ 791.095415] binder: BINDER_SET_CONTEXT_MGR already set 05:49:28 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:28 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 791.119957] binder: undelivered TRANSACTION_ERROR: 29189 [ 791.119983] binder: 13548:13549 ioctl 40046207 0 returned -16 [ 791.132568] binder: undelivered TRANSACTION_ERROR: 29189 05:49:28 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR, @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:28 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 791.305981] binder: undelivered TRANSACTION_ERROR: 29189 [ 791.352167] binder_alloc: 13571: binder_alloc_buf, no vma [ 791.408753] binder: undelivered TRANSACTION_ERROR: 29189 [ 791.443312] binder_alloc: 13576: binder_alloc_buf, no vma [ 791.467804] binder: undelivered TRANSACTION_ERROR: 29189 05:49:31 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x8000000ff600000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:31 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:31 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR, @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:31 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:31 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 794.133370] binder_transaction: 4 callbacks suppressed [ 794.133388] binder: 13589:13593 transaction failed 29189/-22, size 24-8 line 2994 [ 794.135365] binder: 13588:13590 transaction failed 29189/-22, size 24-8 line 2994 [ 794.158781] binder: undelivered TRANSACTION_ERROR: 29189 [ 794.167118] binder_alloc: 13592: binder_alloc_buf, no vma 05:49:31 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:31 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR, @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 794.179771] binder: 13592:13595 transaction failed 29189/-3, size 24-8 line 3147 05:49:31 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 794.235601] binder: undelivered TRANSACTION_ERROR: 29189 05:49:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:31 executing program 4: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x4) [ 794.355194] net_ratelimit: 24 callbacks suppressed [ 794.355203] protocol 88fb is buggy, dev hsr_slave_0 [ 794.365317] protocol 88fb is buggy, dev hsr_slave_1 [ 794.376173] binder: 13603:13607 transaction failed 29189/-22, size 24-8 line 2994 [ 794.378807] binder: 13606:13610 transaction failed 29189/-22, size 24-8 line 2994 [ 794.385695] binder: undelivered TRANSACTION_ERROR: 29189 05:49:31 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 794.458435] binder_alloc: 13612: binder_alloc_buf, no vma [ 794.487575] binder: 13612:13613 transaction failed 29189/-3, size 24-8 line 3147 [ 794.511495] binder_alloc: 13612: binder_alloc_buf, no vma [ 794.524607] binder: undelivered TRANSACTION_ERROR: 29189 [ 794.537890] binder: 13617:13619 transaction failed 29189/-3, size 24-8 line 3147 [ 794.571623] binder: undelivered TRANSACTION_ERROR: 29189 [ 795.475246] protocol 88fb is buggy, dev hsr_slave_0 [ 795.480381] protocol 88fb is buggy, dev hsr_slave_1 [ 795.555146] protocol 88fb is buggy, dev hsr_slave_0 [ 795.560233] protocol 88fb is buggy, dev hsr_slave_1 [ 796.035124] protocol 88fb is buggy, dev hsr_slave_0 [ 796.040201] protocol 88fb is buggy, dev hsr_slave_1 [ 796.115202] protocol 88fb is buggy, dev hsr_slave_0 [ 796.120315] protocol 88fb is buggy, dev hsr_slave_1 05:49:34 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x8000000fffffff0, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:34 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:34 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:34 executing program 4: 05:49:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:34 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 797.242821] binder: 13636:13637 transaction failed 29189/-22, size 24-8 line 2994 [ 797.251133] binder_alloc: 13634: binder_alloc_buf, no vma [ 797.271066] binder: 13634:13635 transaction failed 29189/-3, size 24-8 line 3147 [ 797.271206] binder_alloc: 13634: binder_alloc_buf, no vma 05:49:34 executing program 4: 05:49:34 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 797.295628] binder: 13629:13630 transaction failed 29189/-3, size 24-8 line 3147 [ 797.304463] binder: undelivered TRANSACTION_ERROR: 29189 [ 797.330949] binder: undelivered TRANSACTION_ERROR: 29189 05:49:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:34 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:34 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:34 executing program 4: [ 797.472482] binder_alloc: 13650: binder_alloc_buf, no vma [ 797.504640] binder_alloc: 13650: binder_alloc_buf, no vma [ 797.511727] binder: undelivered TRANSACTION_ERROR: 29189 [ 797.521596] binder: undelivered TRANSACTION_ERROR: 29189 [ 799.635145] net_ratelimit: 16 callbacks suppressed [ 799.640132] protocol 88fb is buggy, dev hsr_slave_0 [ 799.645220] protocol 88fb is buggy, dev hsr_slave_1 [ 799.715187] protocol 88fb is buggy, dev hsr_slave_0 [ 799.720271] protocol 88fb is buggy, dev hsr_slave_1 [ 800.195122] protocol 88fb is buggy, dev hsr_slave_0 [ 800.201071] protocol 88fb is buggy, dev hsr_slave_1 05:49:37 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000380)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) syz_execute_func(&(0x7f0000000780)="f30fb80af3400faec33e66450fe7250000008067660fae7a0040732bc4818dd28200800000430ffa6c6b0c6566420f2b770d0f5dc7e300") clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000340)) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:37 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:37 executing program 4: 05:49:37 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:37 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 800.275129] protocol 88fb is buggy, dev hsr_slave_0 [ 800.280352] protocol 88fb is buggy, dev hsr_slave_1 [ 800.285538] protocol 88fb is buggy, dev hsr_slave_0 [ 800.290587] protocol 88fb is buggy, dev hsr_slave_1 05:49:37 executing program 4: [ 800.364492] binder_transaction: 3 callbacks suppressed [ 800.364510] binder: 13671:13672 transaction failed 29189/-22, size 24-8 line 2994 [ 800.371554] binder_alloc: 13666: binder_alloc_buf, no vma [ 800.409900] binder_alloc: 13666: binder_alloc_buf, no vma [ 800.415732] binder: 13666:13675 transaction failed 29189/-3, size 24-8 line 3147 [ 800.429516] binder: 13669:13670 transaction failed 29189/-3, size 24-8 line 3147 [ 800.451583] binder: undelivered TRANSACTION_ERROR: 29189 05:49:37 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:37 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 800.467170] binder: undelivered TRANSACTION_ERROR: 29189 05:49:37 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='huge\xfelb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prctl$PR_SVE_GET_VL(0x33, 0x17069) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000400)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0xe}, &(0x7f0000044000)=0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r6, r7+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) ioctl$SIOCAX25ADDFWD(r3, 0x89ea, &(0x7f0000000340)={@bcast, @bcast}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(r5) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:37 executing program 4: 05:49:37 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 800.619622] binder: 13686:13688 transaction failed 29189/-22, size 24-8 line 2994 05:49:38 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:38 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:38 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001140)='/dev/ion\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000080)={0x34, 0x0, &(0x7f0000000040)}) [ 800.692009] binder_alloc: 13695: binder_alloc_buf, no vma [ 800.706271] binder_alloc: 13695: binder_alloc_buf, no vma [ 800.712057] binder: 13695:13697 transaction failed 29189/-3, size 24-8 line 3147 [ 800.728279] binder: 13694:13696 transaction failed 29189/-3, size 24-8 line 3147 [ 800.757635] binder: undelivered TRANSACTION_ERROR: 29189 05:49:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:38 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@ipv6_newaddr={0x2c, 0x14, 0x509, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @local={0xfe, 0x80, [0x6000000]}}]}, 0x2c}}, 0x0) [ 800.819482] binder: undelivered TRANSACTION_ERROR: 29189 [ 800.851580] binder: 13701:13707 transaction failed 29189/-22, size 24-8 line 2994 05:49:38 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:38 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:38 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 800.947436] binder_alloc: 13711: binder_alloc_buf, no vma [ 801.007104] binder: 13711:13715 transaction failed 29189/-3, size 24-8 line 3147 [ 801.024462] binder_alloc: 13711: binder_alloc_buf, no vma [ 801.052221] binder: undelivered TRANSACTION_ERROR: 29189 [ 801.053483] binder: 13717:13720 transaction failed 29189/-3, size 24-8 line 3147 [ 801.072341] binder: 13721:13722 transaction failed 29189/-22, size 24-8 line 2994 [ 801.091202] binder: undelivered TRANSACTION_ERROR: 29189 05:49:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0xfffffffffffffffb}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x3f, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0xffff, 0x8, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x7fff}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2002}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r3, 0x80045300, &(0x7f0000000340)) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:41 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:41 executing program 4: openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(0xffffffffffffffff, 0x4) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x6c0000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000540)={0x0, @in6={{0xa, 0x4e24, 0x0, @mcast2}}, [0x46e, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffff, 0x81]}, 0x0) socket$netlink(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000001240)={0x3, 0x0, 0x77ffff, 0x0, 0x10020000000, 0x0}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x3, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000480)="64f5d9f700", 0x5) fcntl$setstatus(r1, 0x4, 0x4800) prctl$PR_SET_FPEXC(0xc, 0x120000) getpgrp(0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, r0, 0x0, 0x16, &(0x7f00000000c0)='}trusted}^ppp1keyring\x00', 0xffffffffffffffff}, 0x30) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000640)=0xc) r4 = syz_open_procfs(r3, &(0x7f0000000700)='net/route\x00') prctl$PR_SET_UNALIGN(0x6, 0x1) ioctl$FS_IOC_ENABLE_VERITY(r4, 0x6685) sendfile(r2, r4, 0x0, 0x10000000000443) writev(r2, &(0x7f00000006c0)=[{&(0x7f0000000600), 0x60020}], 0x1) 05:49:41 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000237, 0x0) 05:49:41 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:41 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 803.783772] binder: 13732:13738 unknown command 536871488 [ 803.789678] binder: undelivered TRANSACTION_ERROR: 29189 [ 803.818333] binder_alloc: 13732: binder_alloc_buf, no vma 05:49:41 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 803.846366] binder: 13732:13738 ioctl c0306201 20000440 returned -22 05:49:41 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:41 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, 0x0, 0x0, 0x0) [ 803.955541] binder: undelivered TRANSACTION_ERROR: 29189 05:49:41 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 804.128197] binder: 13759:13760 unknown command 536871488 [ 804.134653] binder_alloc: 13759: binder_alloc_buf, no vma [ 804.138850] binder: 13759:13760 ioctl c0306201 20000440 returned -22 [ 804.162795] binder: undelivered TRANSACTION_ERROR: 29189 [ 804.755175] net_ratelimit: 24 callbacks suppressed [ 804.755185] protocol 88fb is buggy, dev hsr_slave_0 [ 804.765308] protocol 88fb is buggy, dev hsr_slave_1 [ 805.875141] protocol 88fb is buggy, dev hsr_slave_0 [ 805.880217] protocol 88fb is buggy, dev hsr_slave_1 [ 805.955184] protocol 88fb is buggy, dev hsr_slave_0 [ 805.960314] protocol 88fb is buggy, dev hsr_slave_1 [ 806.435173] protocol 88fb is buggy, dev hsr_slave_0 [ 806.440247] protocol 88fb is buggy, dev hsr_slave_1 [ 806.515235] protocol 88fb is buggy, dev hsr_slave_0 [ 806.520313] protocol 88fb is buggy, dev hsr_slave_1 05:49:44 executing program 5: inotify_init1(0x80800) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:44 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r0, 0x4040ae75, 0x0) r4 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r4, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r4, 0x0, 0x4000010) syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r4, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(0x0, 0x100c000000016) fgetxattr(r3, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r4, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r0, 0xc0385720, &(0x7f0000000340)={0x1, {}, 0x7fffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:44 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, 0x0, 0x0, 0x0) 05:49:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:44 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:44 executing program 4: bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes192\x00'}, 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') pipe2(&(0x7f0000000240), 0x80800) openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x200000, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x6000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0c0005000401000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004845}, 0x440d0) modify_ldt$write2(0x11, &(0x7f0000000440)={0x2, 0xffffffffffffffff, 0x0, 0x0, 0x7, 0x2, 0x5, 0x6, 0xa4e, 0x94c}, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000480)={0x1b8abab, {0x2, 0xfffffffffffffffe, @multicast1}, {0x2, 0x0, @dev}, {0x2, 0x0, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f0000000000)=0x7fffffff, 0x2) getsockopt$inet_udp_int(r1, 0x11, 0x67, &(0x7f00000003c0), &(0x7f0000000400)=0x4) [ 807.001353] binder_transaction: 5 callbacks suppressed [ 807.001373] binder: 13774:13777 transaction failed 29189/-22, size 24-8 line 2994 [ 807.027699] binder: 13775:13781 unknown command 536871488 [ 807.034459] binder_alloc: 13775: binder_alloc_buf, no vma [ 807.038589] binder: 13775:13781 ioctl c0306201 20000440 returned -22 05:49:44 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, 0x0, 0x0, 0x0) [ 807.043383] binder: undelivered TRANSACTION_ERROR: 29189 [ 807.053737] binder: 13770:13776 transaction failed 29189/-3, size 24-8 line 3147 05:49:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:44 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:44 executing program 5: inotify_init1(0x80800) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:44 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair(0x11, 0x3, 0x0, 0x0) write$binfmt_misc(r0, 0x0, 0x0) [ 807.230988] binder: 13793:13794 unknown command 0 [ 807.258611] binder: 13793:13794 ioctl c0306201 20000440 returned -22 [ 807.273881] binder_alloc: 13793: binder_alloc_buf, no vma 05:49:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:44 executing program 1: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 807.304161] binder: 13798:13800 transaction failed 29189/-22, size 24-8 line 2994 [ 807.309887] binder: 13791:13792 transaction failed 29189/-3, size 24-8 line 3147 [ 807.385234] binder: undelivered TRANSACTION_ERROR: 29189 [ 807.448247] binder: 13807:13810 unknown command 0 [ 807.468705] binder: 13807:13810 ioctl c0306201 20000440 returned -22 [ 807.487603] binder: BINDER_SET_CONTEXT_MGR already set [ 807.499472] binder: 13805:13809 ioctl 40046207 0 returned -16 [ 807.512237] binder: 13805:13809 transaction failed 29189/-22, size 24-8 line 2994 05:49:45 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) r6 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) socket$bt_bnep(0x1f, 0x3, 0x4) accept4$llc(r6, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r6, 0x0, 0x4000010) r7 = gettid() ioctl$KVM_GET_REGS(r3, 0x8090ae81, &(0x7f0000000340)) syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r6, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r8, r9+30000000}}, 0x0) tkill(r7, 0x1004000000016) fgetxattr(r5, 0x0, 0x0, 0x77) close(r5) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) fsetxattr$trusted_overlay_nlink(r4, &(0x7f0000000400)='trusted.overlay.nlink\x00', &(0x7f0000000440)={'L-', 0x6}, 0x28, 0x3) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r6, 0xc0106426, &(0x7f0000000280)={0x60f, &(0x7f0000000480)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) 05:49:45 executing program 1: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:45 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:45 executing program 5: inotify_init1(0x80800) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:45 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) [ 807.962325] binder: 13818:13827 transaction failed 29189/-22, size 24-8 line 2994 [ 807.970881] binder: 13821:13824 unknown command 0 [ 807.985754] binder_alloc: 13821: binder_alloc_buf, no vma [ 808.000736] binder: 13821:13824 ioctl c0306201 20000440 returned -22 [ 808.012050] binder: 13819:13828 transaction failed 29189/-3, size 24-8 line 3147 [ 808.013955] binder: BINDER_SET_CONTEXT_MGR already set [ 808.048392] binder: undelivered TRANSACTION_ERROR: 29189 [ 808.054104] binder: BINDER_SET_CONTEXT_MGR already set 05:49:45 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:45 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 808.060569] binder: 13820:13826 ioctl 40046207 0 returned -16 [ 808.068622] binder: 13822:13823 ioctl 40046207 0 returned -16 [ 808.075199] binder: 13820:13831 transaction failed 29189/-22, size 24-8 line 2994 [ 808.092831] binder: 13822:13832 transaction failed 29189/-22, size 24-8 line 2994 [ 808.199524] binder: 13837:13840 transaction failed 29189/-22, size 24-8 line 2994 [ 808.212685] binder: 13842:13843 unknown command 536871488 [ 808.223272] binder: undelivered TRANSACTION_ERROR: 29189 [ 808.227880] binder: 13842:13843 ioctl c0306201 20000440 returned -22 05:49:45 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:45 executing program 1: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 808.248069] binder_alloc: 13842: binder_alloc_buf, no vma 05:49:45 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 808.412834] binder: undelivered TRANSACTION_ERROR: 29189 [ 808.456250] binder: 13850:13851 got transaction with invalid offset (0, min 0 max 24) or object. [ 810.035184] net_ratelimit: 16 callbacks suppressed [ 810.035191] protocol 88fb is buggy, dev hsr_slave_0 [ 810.045241] protocol 88fb is buggy, dev hsr_slave_1 [ 810.115154] protocol 88fb is buggy, dev hsr_slave_0 [ 810.120241] protocol 88fb is buggy, dev hsr_slave_1 [ 810.595160] protocol 88fb is buggy, dev hsr_slave_0 [ 810.600245] protocol 88fb is buggy, dev hsr_slave_1 [ 810.675128] protocol 88fb is buggy, dev hsr_slave_0 [ 810.680267] protocol 88fb is buggy, dev hsr_slave_1 [ 810.685460] protocol 88fb is buggy, dev hsr_slave_0 [ 810.690509] protocol 88fb is buggy, dev hsr_slave_1 05:49:48 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) write$P9_RUNLINKAT(r0, &(0x7f0000000340)={0x7, 0x4d, 0x1}, 0x7) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:48 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:48 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:48 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 811.098710] binder: 13863:13866 unknown command 536871488 [ 811.110553] binder_alloc: 13863: binder_alloc_buf, no vma [ 811.124439] binder: 13863:13866 ioctl c0306201 20000440 returned -22 [ 811.136589] binder: BINDER_SET_CONTEXT_MGR already set [ 811.142472] binder_alloc: 13863: binder_alloc_buf, no vma 05:49:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:48 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 811.163261] binder: 13865:13867 ioctl 40046207 0 returned -16 [ 811.163732] binder: undelivered TRANSACTION_ERROR: 29189 [ 811.175997] binder_alloc: 13863: binder_alloc_buf, no vma 05:49:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:48 executing program 1: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:48 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:48 executing program 5: inotify_init1(0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 811.372884] binder: 13882:13887 unknown command 536871488 [ 811.393659] binder_alloc: 13882: binder_alloc_buf, no vma [ 811.401190] binder: 13882:13887 ioctl c0306201 20000440 returned -22 [ 811.436624] binder: undelivered TRANSACTION_ERROR: 29189 [ 811.461564] binder: BINDER_SET_CONTEXT_MGR already set [ 811.495769] binder: 13883:13888 ioctl 40046207 0 returned -16 [ 811.557271] binder: 13883:13897 got transaction with invalid offset (0, min 0 max 24) or object. [ 811.560313] binder: 13890:13892 got transaction with invalid offset (0, min 0 max 24) or object. 05:49:51 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x13}, 0x9}, 0x1c) sendto$inet6(r2, &(0x7f0000000040)="df", 0x1, 0x40041, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r4 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r4, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000003c0)=0x10, 0x800) sendmsg$alg(r4, 0x0, 0x4000010) r5 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r4, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r6, r7+30000000}}, 0x0) tkill(r5, 0x1004000000016) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000340)=0x5, 0x4) fgetxattr(r3, 0x0, 0x0, 0x77) close(r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0xffffffffffffffff, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x3fffffe, 0xffffffffffffffff}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x62, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) 05:49:51 executing program 5: inotify_init1(0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:49:51 executing program 1: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:51 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:51 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 814.181637] binder_transaction: 13 callbacks suppressed [ 814.181656] binder: 13906:13912 transaction failed 29189/-22, size 24-8 line 2994 [ 814.218891] binder: 13909:13914 unknown command 536871488 [ 814.232837] binder: undelivered TRANSACTION_ERROR: 29189 [ 814.236304] binder_alloc: 13909: binder_alloc_buf, no vma [ 814.247109] binder: 13904:13910 transaction failed 29189/-3, size 24-8 line 3147 [ 814.247209] binder: BINDER_SET_CONTEXT_MGR already set [ 814.266470] binder: 13909:13914 ioctl c0306201 20000440 returned -22 05:49:51 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 814.283583] binder: 13905:13911 ioctl 40046207 0 returned -16 [ 814.291429] binder: BINDER_SET_CONTEXT_MGR already set [ 814.311699] binder: 13907:13915 ioctl 40046207 0 returned -16 [ 814.332318] binder: 13905:13917 transaction failed 29189/-22, size 24-8 line 2994 05:49:51 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x41) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:51 executing program 5: inotify_init1(0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) [ 814.375435] binder: 13907:13915 transaction failed 29189/-22, size 24-8 line 2994 [ 814.412184] binder: 13919:13920 transaction failed 29189/-22, size 24-8 line 2994 [ 814.485209] binder: undelivered TRANSACTION_ERROR: 29189 [ 814.501910] binder: 13925:13929 unknown command 536871488 [ 814.512375] binder_alloc: 13925: binder_alloc_buf, no vma [ 814.528977] binder: 13925:13929 ioctl c0306201 20000440 returned -22 05:49:51 executing program 4: inotify_init1(0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:51 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x13}, 0x9}, 0x1c) sendto$inet6(r2, &(0x7f0000000040)="df", 0x1, 0x40041, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r4 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r4, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000003c0)=0x10, 0x800) sendmsg$alg(r4, 0x0, 0x4000010) r5 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r4, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r6, r7+30000000}}, 0x0) tkill(r5, 0x1004000000016) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000340)=0x5, 0x4) fgetxattr(r3, 0x0, 0x0, 0x77) close(r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0xffffffffffffffff, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x3fffffe, 0xffffffffffffffff}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x62, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) 05:49:51 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 814.536805] binder: 13924:13928 transaction failed 29189/-3, size 24-8 line 3147 05:49:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:49:51 executing program 5: inotify_init1(0x80800) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 814.724629] binder: 13940:13943 transaction failed 29189/-22, size 24-8 line 2994 [ 814.728630] binder: 13942:13947 transaction failed 29189/-22, size 24-8 line 2994 [ 814.733083] binder: 13938:13946 unknown command 536871488 [ 814.760085] binder: 13938:13946 ioctl c0306201 20000440 returned -22 05:49:52 executing program 5: inotify_init1(0x80800) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 814.782974] binder: undelivered TRANSACTION_ERROR: 29189 05:49:52 executing program 0: inotify_init1(0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 814.811159] binder: 13944:13945 transaction failed 29189/-22, size 24-8 line 2994 05:49:52 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:52 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) [ 814.963106] binder: 13949:13951 transaction failed 29189/-22, size 24-8 line 2994 [ 815.041250] binder: undelivered TRANSACTION_ERROR: 29189 [ 815.165157] net_ratelimit: 24 callbacks suppressed [ 815.165166] protocol 88fb is buggy, dev hsr_slave_0 [ 815.175315] protocol 88fb is buggy, dev hsr_slave_1 [ 815.217481] binder: 13958:13960 got transaction with invalid offset (0, min 0 max 24) or object. 05:49:52 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) bind$pptp(r2, &(0x7f0000000340)={0x18, 0x2, {0x2, @empty}}, 0x1e) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:52 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 05:49:52 executing program 5: inotify_init1(0x80800) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:52 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:52 executing program 1: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) 05:49:52 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) [ 815.462784] binder: undelivered TRANSACTION_ERROR: 29189 05:49:52 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 815.540993] binder: 13972:13976 got transaction with invalid offset (0, min 0 max 24) or object. [ 815.569455] binder: BINDER_SET_CONTEXT_MGR already set 05:49:52 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYBLOB='\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:53 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) [ 815.587109] binder: 13975:13977 ioctl 40046207 0 returned -16 [ 815.593370] binder: BINDER_SET_CONTEXT_MGR already set [ 815.600477] binder: 13970:13980 ioctl 40046207 0 returned -16 [ 815.623281] binder: 13975:13984 got transaction with invalid offset (0, min 0 max 24) or object. [ 815.658185] binder: 13970:13980 got transaction with invalid offset (0, min 0 max 24) or object. [ 815.679690] binder: 13987:13993 got transaction with invalid offset (0, min 0 max 24) or object. [ 815.704932] PKCS8: Unsupported PKCS#8 version 05:49:53 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:53 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) [ 815.732230] binder: 13992:13997 got transaction with invalid offset (0, min 0 max 24) or object. [ 815.757130] binder: undelivered TRANSACTION_ERROR: 29201 05:49:53 executing program 1: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) [ 815.902315] binder: 13998:14001 got transaction with invalid offset (0, min 0 max 24) or object. [ 815.945671] PKCS8: Unsupported PKCS#8 version [ 815.950862] binder: BINDER_SET_CONTEXT_MGR already set [ 815.980800] binder: 14004:14007 ioctl 40046207 0 returned -16 [ 816.008797] binder: 14004:14007 got transaction with invalid offset (0, min 0 max 24) or object. [ 816.024178] binder: BINDER_SET_CONTEXT_MGR already set [ 816.030303] binder: 14008:14010 ioctl 40046207 0 returned -16 [ 816.042229] binder: 14008:14010 got transaction with invalid offset (0, min 0 max 24) or object. [ 816.063599] PKCS8: Unsupported PKCS#8 version [ 816.275101] protocol 88fb is buggy, dev hsr_slave_0 [ 816.280181] protocol 88fb is buggy, dev hsr_slave_1 [ 816.355149] protocol 88fb is buggy, dev hsr_slave_0 [ 816.360310] protocol 88fb is buggy, dev hsr_slave_1 [ 816.835131] protocol 88fb is buggy, dev hsr_slave_0 [ 816.840215] protocol 88fb is buggy, dev hsr_slave_1 [ 816.915127] protocol 88fb is buggy, dev hsr_slave_0 [ 816.920214] protocol 88fb is buggy, dev hsr_slave_1 05:49:55 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) sendfile(r0, r0, &(0x7f0000000340), 0x7fffffff) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:55 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:55 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:55 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="8500000025000000000000009500000000000000e078483a1fda988dc79fae88f78744526851efe40b45b53156b05a21617fe713f50b07000000000000009af6e9dfc34d71c20c50cff135e4a85769a88882dc1d138b0b24b9ecc690aa6e053c29a3645bf869ce26c0c367af4af911154eaeba803f8719130085f0087ed391614c13d48e823900005518346e3f693433eb290000000000000000000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() r3 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x7fffffff, 0x212200) getsockopt$bt_BT_CHANNEL_POLICY(r3, 0x112, 0xa, &(0x7f0000000180)=0xd8b6, &(0x7f00000001c0)=0x4) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r1, &(0x7f0000000140)={0xd0002000}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r2, r0, 0x0, 0x0, 0x0}, 0x30) 05:49:55 executing program 1: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) 05:49:55 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) [ 818.560721] binder: 14020:14021 got transaction with invalid offset (0, min 0 max 24) or object. [ 818.576789] binder: undelivered TRANSACTION_ERROR: 29201 05:49:56 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:56 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x00\x00\x00\x00r\x0f\x80s\x98\x13+\xc9\xcc}\xd1!!\x8e\xa6\xe8\xceT(\xce\xe3\xc1+\n@\xb89\xeb1\x81\xdf\xd0;\x1e:\x05l\xcfN\xdf\xd2\x81\x8e1\xc1\xbd\xafti\\\x92S\xbb9a\xe2\xb3\x13EX\x01\x1f\xb4\xd9\xb0\xe7|\x1c\xfbi\xce\xf1cc\x93\xa02z)\"\to\xda\xd4l\xa1!\x88j\xf1\x06r\xea\f\xfd\xe5F\xb3\x8b\b\x1e(\xb1\xb8T\xcc\x84_8\xe34\xd3\'\xc8\'J\xca\x8d:\xa7\xc8j\xbcd\x9d\xd3 \xef,I\xbb\xcf\xd8N\xda\x96-\x8a\x96*\xbb\x96\x03\xaf') 05:49:56 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 818.664113] binder: BINDER_SET_CONTEXT_MGR already set [ 818.711164] binder: 14023:14026 ioctl 40046207 0 returned -16 [ 818.719888] PKCS8: Unsupported PKCS#8 version [ 818.728102] binder: BINDER_SET_CONTEXT_MGR already set [ 818.728310] PKCS8: Unsupported PKCS#8 version [ 818.742903] binder: 14024:14025 ioctl 40046207 0 returned -16 05:49:56 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 818.792004] binder: undelivered TRANSACTION_ERROR: 29201 05:49:56 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x00\x00\x00\x00r\x0f\x80s\x98\x13+\xc9\xcc}\xd1!!\x8e\xa6\xe8\xceT(\xce\xe3\xc1+\n@\xb89\xeb1\x81\xdf\xd0;\x1e:\x05l\xcfN\xdf\xd2\x81\x8e1\xc1\xbd\xafti\\\x92S\xbb9a\xe2\xb3\x13EX\x01\x1f\xb4\xd9\xb0\xe7|\x1c\xfbi\xce\xf1cc\x93\xa02z)\"\to\xda\xd4l\xa1!\x88j\xf1\x06r\xea\f\xfd\xe5F\xb3\x8b\b\x1e(\xb1\xb8T\xcc\x84_8\xe34\xd3\'\xc8\'J\xca\x8d:\xa7\xc8j\xbcd\x9d\xd3 \xef,I\xbb\xcf\xd8N\xda\x96-\x8a\x96*\xbb\x96\x03\xaf') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) 05:49:56 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 818.896646] binder: BINDER_SET_CONTEXT_MGR already set [ 818.930377] binder: 14043:14046 ioctl 40046207 0 returned -16 [ 818.959683] binder: 14048:14053 unknown command 536871552 [ 818.998367] binder: 14048:14053 ioctl c0306201 20000440 returned -22 [ 819.001457] PKCS8: Unsupported PKCS#8 version [ 819.073193] binder: BINDER_SET_CONTEXT_MGR already set [ 819.098242] binder: 14051:14056 ioctl 40046207 0 returned -16 [ 819.154934] PKCS8: Unsupported PKCS#8 version [ 820.435140] net_ratelimit: 16 callbacks suppressed [ 820.435146] protocol 88fb is buggy, dev hsr_slave_0 [ 820.445202] protocol 88fb is buggy, dev hsr_slave_1 [ 820.515291] protocol 88fb is buggy, dev hsr_slave_0 [ 820.520387] protocol 88fb is buggy, dev hsr_slave_1 [ 820.995147] protocol 88fb is buggy, dev hsr_slave_0 [ 821.000242] protocol 88fb is buggy, dev hsr_slave_1 [ 821.075124] protocol 88fb is buggy, dev hsr_slave_0 [ 821.080221] protocol 88fb is buggy, dev hsr_slave_1 [ 821.085378] protocol 88fb is buggy, dev hsr_slave_0 [ 821.090464] protocol 88fb is buggy, dev hsr_slave_1 05:49:58 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x6, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:49:58 executing program 4: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x00\x00\x00\x00r\x0f\x80s\x98\x13+\xc9\xcc}\xd1!!\x8e\xa6\xe8\xceT(\xce\xe3\xc1+\n@\xb89\xeb1\x81\xdf\xd0;\x1e:\x05l\xcfN\xdf\xd2\x81\x8e1\xc1\xbd\xafti\\\x92S\xbb9a\xe2\xb3\x13EX\x01\x1f\xb4\xd9\xb0\xe7|\x1c\xfbi\xce\xf1cc\x93\xa02z)\"\to\xda\xd4l\xa1!\x88j\xf1\x06r\xea\f\xfd\xe5F\xb3\x8b\b\x1e(\xb1\xb8T\xcc\x84_8\xe34\xd3\'\xc8\'J\xca\x8d:\xa7\xc8j\xbcd\x9d\xd3 \xef,I\xbb\xcf\xd8N\xda\x96-\x8a\x96*\xbb\x96\x03\xaf') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 05:49:58 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:58 executing program 1: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x00\x00\x00\x00r\x0f\x80s\x98\x13+\xc9\xcc}\xd1!!\x8e\xa6\xe8\xceT(\xce\xe3\xc1+\n@\xb89\xeb1\x81\xdf\xd0;\x1e:\x05l\xcfN\xdf\xd2\x81\x8e1\xc1\xbd\xafti\\\x92S\xbb9a\xe2\xb3\x13EX\x01\x1f\xb4\xd9\xb0\xe7|\x1c\xfbi\xce\xf1cc\x93\xa02z)\"\to\xda\xd4l\xa1!\x88j\xf1\x06r\xea\f\xfd\xe5F\xb3\x8b\b\x1e(\xb1\xb8T\xcc\x84_8\xe34\xd3\'\xc8\'J\xca\x8d:\xa7\xc8j\xbcd\x9d\xd3 \xef,I\xbb\xcf\xd8N\xda\x96-\x8a\x96*\xbb\x96\x03\xaf') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) 05:49:58 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:49:58 executing program 0: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x00\x00\x00\x00r\x0f\x80s\x98\x13+\xc9\xcc}\xd1!!\x8e\xa6\xe8\xceT(\xce\xe3\xc1+\n@\xb89\xeb1\x81\xdf\xd0;\x1e:\x05l\xcfN\xdf\xd2\x81\x8e1\xc1\xbd\xafti\\\x92S\xbb9a\xe2\xb3\x13EX\x01\x1f\xb4\xd9\xb0\xe7|\x1c\xfbi\xce\xf1cc\x93\xa02z)\"\to\xda\xd4l\xa1!\x88j\xf1\x06r\xea\f\xfd\xe5F\xb3\x8b\b\x1e(\xb1\xb8T\xcc\x84_8\xe34\xd3\'\xc8\'J\xca\x8d:\xa7\xc8j\xbcd\x9d\xd3 \xef,I\xbb\xcf\xd8N\xda\x96-\x8a\x96*\xbb\x96\x03\xaf') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) [ 821.678284] binder_transaction: 8 callbacks suppressed [ 821.678301] binder: 14072:14074 got transaction with invalid offset (0, min 0 max 24) or object. [ 821.700584] binder: 14071:14075 unknown command 536871552 [ 821.725369] binder_transaction: 23 callbacks suppressed [ 821.725386] binder: 14072:14074 transaction failed 29201/-22, size 24-8 line 3241 [ 821.736359] binder: BINDER_SET_CONTEXT_MGR already set [ 821.751894] binder: 14069:14076 ioctl 40046207 0 returned -16 [ 821.752577] binder: 14071:14075 ioctl c0306201 20000440 returned -22 [ 821.758553] binder: BINDER_SET_CONTEXT_MGR already set [ 821.774571] binder: BINDER_SET_CONTEXT_MGR already set [ 821.782364] binder: 14068:14077 ioctl 40046207 0 returned -16 [ 821.795502] binder: 14070:14078 ioctl 40046207 0 returned -16 [ 821.806660] binder: 14069:14076 got transaction with invalid offset (0, min 0 max 24) or object. [ 821.808498] binder: 14068:14077 got transaction with invalid offset (0, min 0 max 24) or object. [ 821.825572] binder: 14068:14077 transaction failed 29201/-22, size 24-8 line 3241 [ 821.831820] binder: 14070:14078 got transaction with invalid offset (0, min 0 max 24) or object. [ 821.854159] binder: 14069:14076 transaction failed 29201/-22, size 24-8 line 3241 [ 821.855368] PKCS8: Unsupported PKCS#8 version [ 821.867062] binder: 14070:14078 transaction failed 29201/-22, size 24-8 line 3241 05:49:59 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:49:59 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 821.884965] PKCS8: Unsupported PKCS#8 version [ 821.894095] PKCS8: Unsupported PKCS#8 version 05:49:59 executing program 1: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000380)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x00\x00\x00\x00r\x0f\x80s\x98\x13+\xc9\xcc}\xd1!!\x8e\xa6\xe8\xceT(\xce\xe3\xc1+\n@\xb89\xeb1\x81\xdf\xd0;\x1e:\x05l\xcfN\xdf\xd2\x81\x8e1\xc1\xbd\xafti\\\x92S\xbb9a\xe2\xb3\x13EX\x01\x1f\xb4\xd9\xb0\xe7|\x1c\xfbi\xce\xf1cc\x93\xa02z)\"\to\xda\xd4l\xa1!\x88j\xf1\x06r\xea\f\xfd\xe5F\xb3\x8b\b\x1e(\xb1\xb8T\xcc\x84_8\xe34\xd3\'\xc8\'J\xca\x8d:\xa7\xc8j\xbcd\x9d\xd3 \xef,I\xbb\xcf\xd8N\xda\x96-\x8a\x96*\xbb\x96\x03\xaf') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)) 05:49:59 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) [ 822.010284] binder: 14090:14093 got transaction with invalid offset (0, min 0 max 24) or object. [ 822.031007] binder: 14091:14094 unknown command 536871552 [ 822.048343] binder: 14090:14093 transaction failed 29201/-22, size 24-8 line 3241 05:49:59 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x40, 0x0) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={r2, r0, 0x0, 0x0, 0x0, r3}, 0xfffffde7) [ 822.054099] binder: 14091:14094 ioctl c0306201 20000440 returned -22 05:49:59 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR, @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 822.144903] block nbd0: shutting down sockets [ 822.179286] binder: BINDER_SET_CONTEXT_MGR already set [ 822.211062] binder: 14095:14099 ioctl 40046207 0 returned -16 [ 822.254684] binder: 14095:14099 got transaction with invalid offset (0, min 0 max 24) or object. [ 822.268657] binder: 14095:14099 transaction failed 29201/-22, size 24-8 line 3241 [ 822.277342] binder: 14105:14108 unknown command 0 [ 822.293085] binder: 14105:14108 ioctl c0306201 20000440 returned -22 [ 822.334315] PKCS8: Unsupported PKCS#8 version 05:50:02 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000340)={0x80000000}) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r2, 0x4040ae75, 0x0) r4 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r4, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000380)=0x10, 0x800) sendmsg$alg(r4, 0x0, 0x4000010) r5 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r4, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r6, r7+30000000}}, 0x0) tkill(r5, 0x1004000000016) fgetxattr(r3, 0x0, 0x0, 0x77) close(r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r4, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:02 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) 05:50:02 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:02 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR, @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:02 executing program 1 (fault-call:4 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:02 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x40, 0x0) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={r2, r0, 0x0, 0x0, 0x0, r3}, 0xfffffde7) [ 824.749212] binder: 14120:14123 unknown command 0 [ 824.754458] binder: BINDER_SET_CONTEXT_MGR already set [ 824.764115] binder: 14120:14123 ioctl c0306201 20000440 returned -22 [ 824.774993] block nbd0: shutting down sockets [ 824.785709] binder: 14121:14127 ioctl 40046207 0 returned -16 [ 824.785894] binder: 14119:14125 got transaction with invalid offset (0, min 0 max 24) or object. [ 824.811296] FAULT_INJECTION: forcing a failure. [ 824.811296] name failslab, interval 1, probability 0, space 0, times 0 [ 824.819008] binder: 14119:14125 transaction failed 29201/-22, size 24-8 line 3241 [ 824.829779] CPU: 0 PID: 14129 Comm: syz-executor.1 Not tainted 5.0.0+ #11 [ 824.837143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 824.846497] Call Trace: [ 824.849095] dump_stack+0x172/0x1f0 [ 824.852741] should_fail.cold+0xa/0x15 [ 824.856644] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 824.861773] ? ___might_sleep+0x163/0x280 [ 824.865937] __should_failslab+0x121/0x190 [ 824.870204] should_failslab+0x9/0x14 [ 824.874013] kmem_cache_alloc_trace+0x2d1/0x760 [ 824.878688] ? kasan_check_read+0x11/0x20 [ 824.882850] ? do_raw_spin_unlock+0x57/0x270 [ 824.887269] ? _raw_spin_unlock+0x2d/0x50 [ 824.891460] binder_get_thread+0x1db/0x7c0 [ 824.895712] ? __might_sleep+0x95/0x190 05:50:02 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000f2, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 824.899707] binder_ioctl+0x1e5/0x183b [ 824.903608] ? debug_smp_processor_id+0x3c/0x280 [ 824.908385] ? binder_thread_write+0x2820/0x2820 [ 824.913173] ? perf_trace_lock+0xeb/0x510 [ 824.917331] ? __lockdep_free_key_range+0x120/0x120 [ 824.922367] ? __lockdep_free_key_range+0x120/0x120 [ 824.927416] ? ___might_sleep+0x163/0x280 [ 824.931590] ? __might_sleep+0x95/0x190 [ 824.932801] binder: 14131:14132 got transaction with invalid offset (0, min 0 max 24) or object. [ 824.935573] ? lock_downgrade+0x880/0x880 05:50:02 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 824.935595] ? binder_thread_write+0x2820/0x2820 [ 824.935616] do_vfs_ioctl+0xd6e/0x1390 [ 824.935634] ? selinux_file_ioctl+0x46f/0x5e0 [ 824.935649] ? selinux_file_ioctl+0x125/0x5e0 [ 824.935666] ? ioctl_preallocate+0x210/0x210 [ 824.935683] ? selinux_file_mprotect+0x620/0x620 [ 824.944791] binder: 14131:14132 transaction failed 29201/-22, size 24-8 line 3241 [ 824.948766] ? ksys_dup3+0x3e0/0x3e0 [ 824.948786] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 824.948805] ? fput+0x128/0x1a0 05:50:02 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) 05:50:02 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR, @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 824.948826] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 824.948841] ? security_file_ioctl+0x93/0xc0 [ 824.948860] ksys_ioctl+0xab/0xd0 [ 824.986923] __x64_sys_ioctl+0x73/0xb0 [ 824.986947] do_syscall_64+0x103/0x610 [ 824.986973] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 824.986987] RIP: 0033:0x457f29 [ 824.987003] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 824.987015] RSP: 002b:00007f757dfb9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 824.995824] RAX: ffffffffffffffda RBX: 00007f757dfb9c90 RCX: 0000000000457f29 [ 824.995834] RDX: 0000000020000440 RSI: 00000000c0306201 RDI: 0000000000000003 [ 824.995843] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 824.995853] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f757dfba6d4 [ 824.995862] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000005 [ 825.017374] binder: 14121:14129 ioctl c0306201 20000440 returned -12 [ 825.094990] block nbd0: shutting down sockets 05:50:02 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x40, 0x0) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={r2, r0, 0x0, 0x0, 0x0, r3}, 0xfffffde7) [ 825.113635] binder: 14139:14142 unknown command 0 [ 825.124802] binder: 14136:14143 got transaction with invalid offset (0, min 0 max 24) or object. [ 825.135770] binder: 14139:14142 ioctl c0306201 20000440 returned -22 05:50:02 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) [ 825.160091] binder: 14136:14143 transaction failed 29201/-22, size 24-8 line 3241 [ 825.278421] block nbd0: shutting down sockets [ 825.555183] net_ratelimit: 24 callbacks suppressed [ 825.555194] protocol 88fb is buggy, dev hsr_slave_0 [ 825.565285] protocol 88fb is buggy, dev hsr_slave_1 [ 826.675129] protocol 88fb is buggy, dev hsr_slave_0 [ 826.680224] protocol 88fb is buggy, dev hsr_slave_1 [ 826.765118] protocol 88fb is buggy, dev hsr_slave_0 [ 826.770223] protocol 88fb is buggy, dev hsr_slave_1 [ 827.235180] protocol 88fb is buggy, dev hsr_slave_0 [ 827.240294] protocol 88fb is buggy, dev hsr_slave_1 [ 827.315130] protocol 88fb is buggy, dev hsr_slave_0 [ 827.320234] protocol 88fb is buggy, dev hsr_slave_1 05:50:05 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:05 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:05 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x40, 0x0) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:05 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) 05:50:05 executing program 1 (fault-call:4 fault-nth:1): r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:05 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x3ff, 0x0) r3 = syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r4 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r4, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r4, 0x0, 0x4000010) r5 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r4, 0x0, 0x48800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000440)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000000400)={{0x0, 0x1c9c380}, {r6, r7+30000000}}, 0x0) tkill(r5, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) recvfrom$llc(r4, &(0x7f0000000340)=""/97, 0x61, 0x40000000, &(0x7f00000003c0)={0x1a, 0x336, 0xe86d, 0x8e1f, 0x100, 0x8}, 0x10) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r4, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) [ 827.820501] binder: BINDER_SET_CONTEXT_MGR already set [ 827.831958] binder: 14160:14165 unknown command 536871552 [ 827.837871] block nbd0: shutting down sockets [ 827.847559] binder: 14162:14164 ioctl 40046207 0 returned -16 [ 827.854804] binder: 14157:14161 got transaction with invalid offset (0, min 0 max 24) or object. [ 827.871891] binder: 14160:14165 ioctl c0306201 20000440 returned -22 [ 827.888878] binder: 14157:14161 transaction failed 29201/-22, size 24-8 line 3241 [ 827.897262] binder: 14162:14164 unknown command 536871488 [ 827.902823] binder: 14162:14164 ioctl c0306201 20000440 returned -22 05:50:05 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) 05:50:05 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:05 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x40, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:05 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 828.091483] block nbd0: shutting down sockets [ 828.137795] binder: 14177:14181 unknown command 536871552 [ 828.146712] binder: BINDER_SET_CONTEXT_MGR already set [ 828.174183] binder: 14177:14181 ioctl c0306201 20000440 returned -22 [ 828.181415] binder: 14175:14184 ioctl 40046207 0 returned -16 05:50:05 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) [ 828.181564] binder: 14182:14186 got transaction with invalid offset (0, min 0 max 24) or object. [ 828.194491] binder: 14175:14184 unknown command 536871488 [ 828.211241] binder: 14182:14186 transaction failed 29201/-22, size 24-8 line 3241 [ 828.213070] binder: 14175:14184 ioctl c0306201 20000440 returned -22 [ 828.296714] block nbd0: shutting down sockets 05:50:08 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x40, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:08 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:08 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:08 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) write$P9_RREMOVE(r3, &(0x7f0000000340)={0x7, 0x7b, 0x1}, 0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:08 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) [ 830.835116] net_ratelimit: 16 callbacks suppressed [ 830.835126] protocol 88fb is buggy, dev hsr_slave_0 [ 830.845226] protocol 88fb is buggy, dev hsr_slave_1 [ 830.915104] protocol 88fb is buggy, dev hsr_slave_0 [ 830.920219] protocol 88fb is buggy, dev hsr_slave_1 [ 830.925801] binder: 14198:14199 unknown command 536871552 [ 830.926474] binder: BINDER_SET_CONTEXT_MGR already set [ 830.931360] binder: 14198:14199 ioctl c0306201 20000440 returned -22 [ 830.943829] block nbd0: shutting down sockets [ 830.952639] binder: 14204:14205 ioctl 40046207 0 returned -16 05:50:08 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 830.964818] binder: 14200:14207 got transaction with invalid offset (0, min 0 max 24) or object. 05:50:08 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x40, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 831.017903] binder: BINDER_SET_CONTEXT_MGR already set 05:50:08 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) [ 831.039206] binder: 14204:14209 ioctl 40046207 0 returned -16 [ 831.073473] binder: 14200:14207 transaction failed 29201/-22, size 24-8 line 3241 05:50:08 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 831.109209] binder: 14215:14216 unknown command 536871552 [ 831.125563] block nbd0: shutting down sockets [ 831.126536] binder: 14215:14216 ioctl c0306201 20000440 returned -22 05:50:08 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:08 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) close(r0) 05:50:08 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$nl_route(0x10, 0x3, 0x0) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 831.275700] binder: 14227:14228 got transaction with invalid offset (0, min 0 max 24) or object. [ 831.314433] binder: 14229:14230 unknown command 536871552 [ 831.339261] binder: BINDER_SET_CONTEXT_MGR already set [ 831.349664] binder: 14229:14230 ioctl c0306201 20000440 returned -22 [ 831.368837] binder: 14227:14228 transaction failed 29201/-22, size 24-8 line 3241 [ 831.375285] binder: 14232:14233 ioctl 40046207 0 returned -16 05:50:08 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 831.395131] protocol 88fb is buggy, dev hsr_slave_0 [ 831.400300] protocol 88fb is buggy, dev hsr_slave_1 [ 831.404287] binder: 14232:14239 ioctl 4b47 20000440 returned -22 [ 831.428094] binder: BINDER_SET_CONTEXT_MGR already set [ 831.433394] binder: 14232:14233 ioctl 40046207 0 returned -16 05:50:08 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) close(r0) [ 831.475163] protocol 88fb is buggy, dev hsr_slave_0 [ 831.480291] protocol 88fb is buggy, dev hsr_slave_1 [ 831.485460] protocol 88fb is buggy, dev hsr_slave_0 [ 831.490530] protocol 88fb is buggy, dev hsr_slave_1 [ 831.575314] binder: 14244:14246 unknown command 536871552 [ 831.580934] binder: 14244:14246 ioctl c0306201 20000440 returned -22 05:50:11 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(0xffffffffffffffff, 0x4040ae75, 0x0) r2 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r2, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r2, 0x0, 0x4000010) r3 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r2, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r4, r5+30000000}}, 0x0) tkill(r3, 0x1004000000016) fgetxattr(r1, 0x0, 0x0, 0x77) close(r1) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:11 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) close(r0) 05:50:11 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:11 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4b49, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:11 executing program 2: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) [ 834.222534] block nbd0: shutting down sockets [ 834.236566] binder: BINDER_SET_CONTEXT_MGR already set [ 834.246643] binder: 14258:14260 ioctl 40046207 0 returned -16 [ 834.256770] binder: 14257:14263 got transaction with invalid offset (0, min 0 max 24) or object. 05:50:11 executing program 2 (fault-call:7 fault-nth:0): perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 834.273176] binder: 14258:14260 ioctl 4b49 20000440 returned -22 [ 834.283769] binder: 14257:14263 transaction failed 29201/-22, size 24-8 line 3241 [ 834.309985] binder: BINDER_SET_CONTEXT_MGR already set [ 834.310069] binder: 14258:14268 ioctl 4b49 20000440 returned -22 05:50:11 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r0) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r0) close(0xffffffffffffffff) [ 834.328569] binder: 14258:14260 ioctl 40046207 0 returned -16 05:50:11 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) r1 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:11 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 834.378013] FAULT_INJECTION: forcing a failure. [ 834.378013] name failslab, interval 1, probability 0, space 0, times 0 [ 834.440236] CPU: 1 PID: 14273 Comm: syz-executor.2 Not tainted 5.0.0+ #11 [ 834.447217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 834.456576] Call Trace: [ 834.459183] dump_stack+0x172/0x1f0 [ 834.462837] should_fail.cold+0xa/0x15 [ 834.466739] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 834.471875] ? ___might_sleep+0x163/0x280 [ 834.476040] __should_failslab+0x121/0x190 [ 834.480295] should_failslab+0x9/0x14 [ 834.484114] kmem_cache_alloc_trace+0x2d1/0x760 [ 834.488794] ? kasan_check_read+0x11/0x20 [ 834.492961] ? do_raw_spin_unlock+0x57/0x270 [ 834.497386] ? _raw_spin_unlock+0x2d/0x50 [ 834.501556] binder_get_thread+0x1db/0x7c0 [ 834.505798] ? __might_sleep+0x95/0x190 [ 834.509787] binder_ioctl+0x1e5/0x183b [ 834.513676] ? debug_smp_processor_id+0x3c/0x280 [ 834.518453] ? binder_thread_write+0x2820/0x2820 [ 834.523216] ? perf_trace_lock+0xeb/0x510 [ 834.527381] ? __lockdep_free_key_range+0x120/0x120 [ 834.532417] ? __lockdep_free_key_range+0x120/0x120 [ 834.537473] ? ___might_sleep+0x163/0x280 [ 834.541630] ? __might_sleep+0x95/0x190 [ 834.545610] ? lock_downgrade+0x880/0x880 [ 834.549771] ? binder_thread_write+0x2820/0x2820 [ 834.554534] do_vfs_ioctl+0xd6e/0x1390 [ 834.558437] ? selinux_file_ioctl+0x46f/0x5e0 [ 834.562960] ? selinux_file_ioctl+0x125/0x5e0 [ 834.567476] ? ioctl_preallocate+0x210/0x210 [ 834.571902] ? selinux_file_mprotect+0x620/0x620 [ 834.576696] ? ksys_dup3+0x3e0/0x3e0 [ 834.580423] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 834.585983] ? fput+0x128/0x1a0 [ 834.589274] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 834.594812] ? security_file_ioctl+0x93/0xc0 [ 834.599261] ksys_ioctl+0xab/0xd0 [ 834.602722] __x64_sys_ioctl+0x73/0xb0 [ 834.606619] do_syscall_64+0x103/0x610 [ 834.610523] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 834.615714] RIP: 0033:0x457f29 [ 834.618910] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 05:50:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) [ 834.637815] RSP: 002b:00007fbdb7b1ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 834.645531] RAX: ffffffffffffffda RBX: 00007fbdb7b1ac90 RCX: 0000000000457f29 [ 834.652801] RDX: 0000000020000440 RSI: 00000000c0306201 RDI: 0000000000000003 [ 834.660071] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 834.667338] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbdb7b1b6d4 [ 834.674611] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000004 05:50:12 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r0) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r0) close(0xffffffffffffffff) [ 834.746928] binder: 14281:14284 got transaction with invalid offset (0, min 0 max 24) or object. [ 834.757982] binder: 14281:14284 transaction failed 29201/-22, size 24-8 line 3241 [ 834.773771] binder: BINDER_SET_CONTEXT_MGR already set [ 834.783169] binder: 14282:14285 ioctl 40046207 0 returned -16 [ 834.801483] binder: 14282:14285 ioctl 541b 20000440 returned -22 [ 834.839748] binder: BINDER_SET_CONTEXT_MGR already set [ 834.853782] binder: 14282:14288 ioctl 541b 20000440 returned -22 [ 834.864468] binder: 14282:14285 ioctl 40046207 0 returned -16 [ 834.903380] binder: 14270:14273 ioctl c0306201 20000440 returned -12 [ 835.955190] net_ratelimit: 24 callbacks suppressed [ 835.955200] protocol 88fb is buggy, dev hsr_slave_0 [ 835.965321] protocol 88fb is buggy, dev hsr_slave_1 [ 837.075131] protocol 88fb is buggy, dev hsr_slave_0 [ 837.080216] protocol 88fb is buggy, dev hsr_slave_1 [ 837.155146] protocol 88fb is buggy, dev hsr_slave_0 [ 837.160236] protocol 88fb is buggy, dev hsr_slave_1 05:50:14 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x800002b) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:14 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) r1 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:14 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:14 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r0) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r0) close(0xffffffffffffffff) 05:50:14 executing program 2 (fault-call:7 fault-nth:1): perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 837.437839] binder: 14301:14306 unknown command 536871552 [ 837.444858] binder: BINDER_SET_CONTEXT_MGR already set [ 837.456288] binder: 14299:14305 ioctl 40046207 0 returned -16 [ 837.457890] binder: 14302:14309 got transaction with invalid offset (0, min 0 max 24) or object. [ 837.463489] binder: 14301:14306 ioctl c0306201 20000440 returned -22 05:50:14 executing program 4: r0 = syz_open_dev$ndb(0x0, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) [ 837.488392] binder: BINDER_SET_CONTEXT_MGR already set [ 837.496193] binder: 14302:14309 transaction failed 29201/-22, size 24-8 line 3241 [ 837.524127] binder: 14299:14311 ioctl 40046207 0 returned -16 05:50:14 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:14 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) r1 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:15 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) [ 837.635110] protocol 88fb is buggy, dev hsr_slave_0 [ 837.640241] protocol 88fb is buggy, dev hsr_slave_1 05:50:15 executing program 4: r0 = syz_open_dev$ndb(0x0, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) [ 837.715096] protocol 88fb is buggy, dev hsr_slave_0 [ 837.720221] protocol 88fb is buggy, dev hsr_slave_1 [ 837.747084] binder: 14323:14324 unknown command 536871552 [ 837.750375] binder: 14325:14327 got transaction with invalid offset (0, min 0 max 24) or object. [ 837.796005] binder: 14323:14324 ioctl c0306201 20000440 returned -22 [ 837.833632] binder: BINDER_SET_CONTEXT_MGR already set [ 837.839447] binder: 14325:14327 transaction failed 29201/-22, size 24-8 line 3241 [ 837.878234] binder: 14328:14331 ioctl 40046207 0 returned -16 [ 837.922203] binder: BINDER_SET_CONTEXT_MGR already set [ 837.953159] binder: 14328:14331 ioctl 40046207 0 returned -16 05:50:15 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) r7 = msgget(0x0, 0x0) msgrcv(r7, &(0x7f0000000380)={0x0, ""/88}, 0x60, 0x2, 0x2000) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000340), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:15 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, 0xffffffffffffffff) r1 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:15 executing program 4: r0 = syz_open_dev$ndb(0x0, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) 05:50:15 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:15 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) [ 838.522844] binder: 14347:14351 got transaction with invalid offset (0, min 0 max 24) or object. [ 838.526976] binder: BINDER_SET_CONTEXT_MGR already set [ 838.556873] binder: 14347:14351 transaction failed 29201/-22, size 24-8 line 3241 05:50:15 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) close(r0) [ 838.570281] binder: 14348:14354 ioctl 40046207 0 returned -16 05:50:15 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, 0xffffffffffffffff) r1 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 838.609380] binder: BINDER_SET_CONTEXT_MGR already set 05:50:16 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:16 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 838.646466] binder: 14348:14354 ioctl 40046207 0 returned -16 05:50:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) [ 838.769530] binder: 14469:14471 ioctl 10 20000440 returned -22 05:50:16 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) close(r0) [ 838.871513] binder: BINDER_SET_CONTEXT_MGR already set [ 838.902678] binder: 14488:14520 ioctl 40046207 0 returned -16 [ 838.946811] binder: BINDER_SET_CONTEXT_MGR already set [ 838.959217] binder: 14488:14520 ioctl 40046207 0 returned -16 [ 841.235130] net_ratelimit: 16 callbacks suppressed [ 841.235137] protocol 88fb is buggy, dev hsr_slave_0 [ 841.245161] protocol 88fb is buggy, dev hsr_slave_1 [ 841.315197] protocol 88fb is buggy, dev hsr_slave_0 [ 841.320292] protocol 88fb is buggy, dev hsr_slave_1 05:50:19 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() setsockopt$inet_int(r3, 0x0, 0x14, &(0x7f0000000380)=0x8, 0x4) syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000340)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:19 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:19 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:19 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, 0xffffffffffffffff) r1 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:19 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) close(r0) 05:50:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) [ 841.757485] binder: BINDER_SET_CONTEXT_MGR already set 05:50:19 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 841.781461] binder: 14595:14598 ioctl 40046207 0 returned -16 [ 841.792086] binder: 14589:14600 ioctl 4b47 20000440 returned -22 [ 841.795135] protocol 88fb is buggy, dev hsr_slave_0 [ 841.803469] protocol 88fb is buggy, dev hsr_slave_1 05:50:19 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) [ 841.835438] binder: BINDER_SET_CONTEXT_MGR already set 05:50:19 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, &(0x7f0000000940)=""/195) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:19 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r0) r1 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, 0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 841.867541] binder: 14595:14598 ioctl 40046207 0 returned -16 [ 841.875100] protocol 88fb is buggy, dev hsr_slave_0 [ 841.880190] protocol 88fb is buggy, dev hsr_slave_1 [ 841.885447] protocol 88fb is buggy, dev hsr_slave_0 [ 841.890526] protocol 88fb is buggy, dev hsr_slave_1 [ 841.908771] block nbd0: shutting down sockets 05:50:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:19 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4b49, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 842.058250] binder: 14715:14718 got transaction with invalid offset (0, min 0 max 24) or object. [ 842.096325] binder: 14720:14721 ioctl 4b49 20000440 returned -22 [ 842.118390] binder: 14715:14718 transaction failed 29201/-22, size 24-8 line 3241 [ 842.131167] binder: BINDER_SET_CONTEXT_MGR already set [ 842.142721] binder: 14722:14724 ioctl 40046207 0 returned -16 [ 842.166098] binder: BINDER_SET_CONTEXT_MGR already set [ 842.174008] binder: 14722:14724 ioctl 40046207 0 returned -16 05:50:22 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000340)={0x0, 0x200, 0x6, 0x7, 0x8, 0xfffffffffffffffb}, &(0x7f0000000380)=0x14) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000003c0)={0x5, 0x8, 0x8000, 0x200, 0x80000000, 0x5, 0x6, 0xffffffffffffff82, r7}, 0x20) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:22 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) 05:50:22 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:22 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r0) r1 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, 0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:22 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 844.777999] block nbd0: shutting down sockets [ 844.798853] binder: 14834:14836 got transaction with invalid offset (0, min 0 max 24) or object. [ 844.837438] binder: BINDER_SET_CONTEXT_MGR already set 05:50:22 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) [ 844.856660] binder: 14834:14836 transaction failed 29201/-22, size 24-8 line 3241 [ 844.862524] binder: 14835:14838 ioctl 541b 20000440 returned -22 [ 844.865682] binder: 14837:14840 ioctl 40046207 0 returned -16 [ 844.890055] binder: BINDER_SET_CONTEXT_MGR already set 05:50:22 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r0) r1 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, 0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 844.908505] binder: 14837:14844 ioctl 40046207 20000440 returned -16 05:50:22 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 844.986227] binder: BINDER_SET_CONTEXT_MGR already set [ 844.991572] binder: 14837:14840 ioctl 40046207 0 returned -16 [ 844.995690] block nbd0: shutting down sockets 05:50:22 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:22 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) 05:50:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) [ 845.144086] block nbd0: shutting down sockets [ 845.181126] binder: BINDER_SET_CONTEXT_MGR already set [ 845.196173] binder: 14961:14962 ioctl 40046207 0 returned -16 [ 845.227616] binder: BINDER_SET_CONTEXT_MGR already set [ 845.237952] binder: 14961:14962 ioctl 40046207 0 returned -16 [ 846.355224] net_ratelimit: 24 callbacks suppressed [ 846.355234] protocol 88fb is buggy, dev hsr_slave_0 [ 846.365330] protocol 88fb is buggy, dev hsr_slave_1 [ 847.475123] protocol 88fb is buggy, dev hsr_slave_0 [ 847.480231] protocol 88fb is buggy, dev hsr_slave_1 [ 847.555148] protocol 88fb is buggy, dev hsr_slave_0 [ 847.560320] protocol 88fb is buggy, dev hsr_slave_1 05:50:25 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r4 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r4, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r4, 0x0, 0x4000010) r5 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r4, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r6, r7+30000000}}, 0x0) tkill(r5, 0x1004000000016) fcntl$setownex(r4, 0xf, &(0x7f0000000340)={0x1, r5}) fgetxattr(r2, 0x0, 0x0, 0x53c) close(r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r4, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:25 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 05:50:25 executing program 0: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:25 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) 05:50:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:25 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:25 executing program 0: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 847.925816] binder: BINDER_SET_CONTEXT_MGR already set [ 847.930364] block nbd0: shutting down sockets [ 847.944459] binder: 15083:15085 ioctl 40046207 0 returned -16 05:50:25 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(r0) 05:50:25 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 848.007873] binder: BINDER_SET_CONTEXT_MGR already set [ 848.029783] binder: 15083:15085 ioctl 40046207 0 returned -16 [ 848.035145] protocol 88fb is buggy, dev hsr_slave_0 [ 848.040816] protocol 88fb is buggy, dev hsr_slave_1 05:50:25 executing program 0: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 848.115133] protocol 88fb is buggy, dev hsr_slave_0 [ 848.120285] protocol 88fb is buggy, dev hsr_slave_1 05:50:25 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:25 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 848.169235] block nbd0: shutting down sockets [ 848.325264] binder: 15229:15269 ioctl c0306201 0 returned -14 05:50:28 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) ioctl$SIOCAX25NOUID(r3, 0x89e3, &(0x7f0000000340)=0x1) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:28 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r1) close(r0) 05:50:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:28 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:28 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:28 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 05:50:28 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 850.965430] binder: BINDER_SET_CONTEXT_MGR already set [ 850.970787] binder: 15323:15327 ioctl 40046207 0 returned -16 [ 850.996630] binder: 15321:15328 ioctl c0306201 0 returned -14 [ 851.004445] block nbd0: shutting down sockets 05:50:28 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 851.040976] binder: 15323:15327 ioctl 40086602 20000440 returned -22 05:50:28 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r1) close(r0) [ 851.107929] binder: BINDER_SET_CONTEXT_MGR already set 05:50:28 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 851.167451] binder: 15323:15386 ioctl 40046207 0 returned -16 [ 851.180893] binder: 15405:15442 ioctl c0306201 0 returned -14 05:50:28 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:28 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) [ 851.249231] block nbd0: shutting down sockets [ 851.635129] net_ratelimit: 16 callbacks suppressed [ 851.635139] protocol 88fb is buggy, dev hsr_slave_0 [ 851.645217] protocol 88fb is buggy, dev hsr_slave_1 [ 851.715142] protocol 88fb is buggy, dev hsr_slave_0 [ 851.720248] protocol 88fb is buggy, dev hsr_slave_1 [ 852.195153] protocol 88fb is buggy, dev hsr_slave_0 [ 852.200289] protocol 88fb is buggy, dev hsr_slave_1 [ 852.275174] protocol 88fb is buggy, dev hsr_slave_0 [ 852.280297] protocol 88fb is buggy, dev hsr_slave_1 [ 852.285486] protocol 88fb is buggy, dev hsr_slave_0 [ 852.290576] protocol 88fb is buggy, dev hsr_slave_1 05:50:31 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) ioctl$TCXONC(r3, 0x540a, 0x7fff) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40087602, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:31 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:31 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r1) close(r0) 05:50:31 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 05:50:31 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 854.202602] block nbd0: shutting down sockets [ 854.234810] binder: BINDER_SET_CONTEXT_MGR already set 05:50:31 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 05:50:31 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) close(r0) 05:50:31 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 854.255276] binder: 15567:15573 ioctl 40046207 0 returned -16 [ 854.281922] binder: 15567:15654 ioctl 40087602 20000440 returned -22 [ 854.312518] binder: BINDER_SET_CONTEXT_MGR already set 05:50:31 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 854.359162] binder: 15567:15573 ioctl 40046207 0 returned -16 [ 854.384551] block nbd0: shutting down sockets 05:50:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:31 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 854.496903] binder: BINDER_SET_CONTEXT_MGR already set [ 854.534843] binder: 15688:15689 ioctl 40046207 20000440 returned -16 [ 854.575773] binder: 15695:15696 got transaction with invalid offsets ptr [ 854.591633] binder: 15695:15696 transaction failed 29201/-14, size 24-8 line 3193 [ 854.599195] binder: BINDER_SET_CONTEXT_MGR already set [ 854.604717] binder: 15693:15697 ioctl 40046207 0 returned -16 [ 854.611963] binder: BINDER_SET_CONTEXT_MGR already set [ 854.617530] binder: 15693:15697 ioctl 4018620d 20000440 returned -16 [ 854.620627] binder: undelivered TRANSACTION_ERROR: 29201 [ 854.625931] binder: BINDER_SET_CONTEXT_MGR already set [ 854.634992] binder: 15693:15697 ioctl 40046207 0 returned -16 [ 854.641258] binder: BINDER_SET_CONTEXT_MGR already set [ 854.646800] binder: 15693:15728 ioctl 4018620d 20000440 returned -16 [ 856.755151] net_ratelimit: 24 callbacks suppressed [ 856.755158] protocol 88fb is buggy, dev hsr_slave_0 [ 856.765273] protocol 88fb is buggy, dev hsr_slave_1 05:50:34 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x402) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) getsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000340), &(0x7f0000000380)=0x4) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:34 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:34 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) close(r0) 05:50:34 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:34 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 857.254582] block nbd0: shutting down sockets [ 857.261720] binder: BINDER_SET_CONTEXT_MGR already set 05:50:34 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 857.305718] binder: 15808:15810 ioctl 40046207 0 returned -16 [ 857.306140] binder: 15811:15812 got transaction with invalid offsets ptr [ 857.335631] binder: 15811:15812 transaction failed 29201/-14, size 24-8 line 3193 05:50:34 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) close(r0) [ 857.382862] binder: undelivered TRANSACTION_ERROR: 29201 05:50:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x80086601, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:34 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:34 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 857.452273] block nbd0: shutting down sockets 05:50:34 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 857.517929] binder: 15931:15932 got transaction with invalid offsets ptr [ 857.524880] binder: 15931:15932 transaction failed 29201/-14, size 24-8 line 3193 [ 857.556316] binder: BINDER_SET_CONTEXT_MGR already set [ 857.609783] binder: 15933:15934 ioctl 40046207 0 returned -16 [ 857.609798] binder: 15933:15972 ioctl 80086601 20000440 returned -22 [ 857.617394] binder: undelivered TRANSACTION_ERROR: 29201 [ 857.660976] binder: BINDER_SET_CONTEXT_MGR already set [ 857.661122] binder: 15933:15972 ioctl 80086601 20000440 returned -22 [ 857.679534] binder: 15933:15934 ioctl 40046207 0 returned -16 [ 857.875119] protocol 88fb is buggy, dev hsr_slave_0 [ 857.880207] protocol 88fb is buggy, dev hsr_slave_1 [ 857.955173] protocol 88fb is buggy, dev hsr_slave_0 [ 857.960277] protocol 88fb is buggy, dev hsr_slave_1 05:50:35 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0xfffffffffffffffe, 0x0, 0xffffffffffff9b33}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x1) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) ioctl$VIDIOC_DQEVENT(r3, 0x80885659, &(0x7f0000000340)) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:35 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(0xffffffffffffffff) 05:50:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x80087601, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:35 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:35 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:35 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 858.347357] binder: 16056:16058 got transaction with invalid offsets ptr [ 858.354332] binder: 16056:16058 transaction failed 29201/-14, size 24-8 line 3193 [ 858.364365] block nbd0: shutting down sockets [ 858.376280] binder: BINDER_SET_CONTEXT_MGR already set [ 858.381587] binder: 16050:16051 ioctl 40046207 0 returned -16 [ 858.395440] binder: 16053:16054 ioctl 40086602 20000440 returned -22 05:50:35 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(0xffffffffffffffff) 05:50:35 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) [ 858.421993] binder: undelivered TRANSACTION_ERROR: 29201 [ 858.423674] binder: 16050:16069 ioctl 80087601 20000440 returned -22 [ 858.435146] protocol 88fb is buggy, dev hsr_slave_0 [ 858.440222] protocol 88fb is buggy, dev hsr_slave_1 [ 858.448157] binder: BINDER_SET_CONTEXT_MGR already set [ 858.453701] binder: 16050:16069 ioctl 80087601 20000440 returned -22 [ 858.464499] binder: 16050:16051 ioctl 40046207 0 returned -16 05:50:35 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 858.515122] protocol 88fb is buggy, dev hsr_slave_0 [ 858.520288] protocol 88fb is buggy, dev hsr_slave_1 [ 858.568970] block nbd0: shutting down sockets 05:50:35 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40087602, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:36 executing program 4: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) close(0xffffffffffffffff) [ 858.598574] binder: 16159:16171 got transaction with invalid offsets ptr [ 858.635479] binder: 16159:16171 transaction failed 29201/-14, size 24-8 line 3193 05:50:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) [ 858.754441] binder: undelivered TRANSACTION_ERROR: 29201 [ 858.766519] binder: 16176:16177 ioctl 40087602 20000440 returned -22 [ 858.811465] binder: BINDER_SET_CONTEXT_MGR already set [ 858.824286] block nbd0: shutting down sockets [ 858.859541] binder: 16180:16182 ioctl 40046207 0 returned -16 [ 858.887245] binder: BINDER_SET_CONTEXT_MGR already set [ 858.913259] binder: 16180:16231 ioctl 40046207 0 returned -16 05:50:38 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000340), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x179) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:38 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:38 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:38 executing program 4: r0 = socket(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'lo\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xed\x1f', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000180)={@mcast2, @mcast1, @rand_addr="f7fff56900ad955c3b4075f034650e63", 0x0, 0x0, 0x0, 0x0, 0x0, 0x83420002, r1}) 05:50:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:38 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:38 executing program 4: [ 861.527023] binder: BINDER_SET_CONTEXT_MGR already set [ 861.532513] binder: 16298:16299 ioctl 4018620d 20000440 returned -16 [ 861.532516] binder: BINDER_SET_CONTEXT_MGR already set [ 861.532543] binder: 16303:16304 ioctl 40046207 0 returned -16 [ 861.551216] binder: 16294:16302 got transaction with invalid offsets ptr [ 861.575390] binder: 16294:16302 transaction failed 29201/-14, size 24-8 line 3193 [ 861.608439] binder: undelivered TRANSACTION_ERROR: 29201 05:50:38 executing program 4: [ 861.626879] binder: BINDER_SET_CONTEXT_MGR already set 05:50:39 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:39 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:39 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 861.679403] binder: 16303:16304 ioctl 40046207 0 returned -16 05:50:39 executing program 4: [ 861.792169] binder: 16421:16422 got transaction with invalid offset (0, min 0 max 24) or object. [ 861.824796] binder: 16421:16422 transaction failed 29201/-22, size 24-8 line 3241 [ 861.906552] binder: undelivered TRANSACTION_ERROR: 29201 [ 862.035117] net_ratelimit: 16 callbacks suppressed [ 862.035127] protocol 88fb is buggy, dev hsr_slave_0 [ 862.045219] protocol 88fb is buggy, dev hsr_slave_1 [ 862.115138] protocol 88fb is buggy, dev hsr_slave_0 [ 862.120256] protocol 88fb is buggy, dev hsr_slave_1 [ 862.595142] protocol 88fb is buggy, dev hsr_slave_0 [ 862.600234] protocol 88fb is buggy, dev hsr_slave_1 [ 862.675148] protocol 88fb is buggy, dev hsr_slave_0 [ 862.680265] protocol 88fb is buggy, dev hsr_slave_1 [ 862.685440] protocol 88fb is buggy, dev hsr_slave_0 [ 862.690528] protocol 88fb is buggy, dev hsr_slave_1 05:50:41 executing program 4: 05:50:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:41 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:41 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$inet_sctp6_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000340)=@assoc_id=0x0, &(0x7f0000000380)=0x4) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f00000003c0)={r7, 0x47, "a3ec18daf453b7766a43271a6d27643001e09d78386da4e8553930df3f7798cd15173cca400427d4259e8737f9429b1b89c0fe750bfeeda7bd361a49058bfb57b73ad2e6db4cb0"}, &(0x7f0000000440)=0x4f) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:41 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x80086601, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:41 executing program 4: [ 864.566311] binder: BINDER_SET_CONTEXT_MGR already set [ 864.581012] binder: 16539:16540 ioctl 80086601 20000440 returned -22 [ 864.593612] binder: 16535:16536 got transaction with invalid offsets ptr [ 864.602303] binder: 16537:16541 ioctl 40046207 0 returned -16 [ 864.622861] binder: BINDER_SET_CONTEXT_MGR already set 05:50:42 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 864.643363] binder: 16535:16536 transaction failed 29201/-14, size 24-8 line 3193 [ 864.654258] binder: 16537:16541 ioctl 40046207 0 returned -16 05:50:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:42 executing program 4: [ 864.695214] binder: undelivered TRANSACTION_ERROR: 29201 05:50:42 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:42 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x80087601, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 864.817583] binder: BINDER_SET_CONTEXT_MGR already set 05:50:42 executing program 4: [ 864.855190] binder: 16654:16656 ioctl 40046207 0 returned -16 [ 864.879552] binder: 16659:16662 got transaction with invalid offsets ptr [ 864.887858] binder: BINDER_SET_CONTEXT_MGR already set 05:50:42 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 864.911001] binder: 16654:16656 ioctl 40046207 0 returned -16 [ 864.920678] binder: 16659:16662 transaction failed 29201/-14, size 24-8 line 3193 [ 864.934740] binder: 16663:16664 ioctl 80087601 20000440 returned -22 05:50:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:42 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 864.972541] binder: undelivered TRANSACTION_ERROR: 29201 [ 865.094860] binder: 16749:16759 got transaction with invalid offsets ptr [ 865.106176] binder: BINDER_SET_CONTEXT_MGR already set [ 865.121648] binder: 16755:16766 ioctl 40046207 0 returned -16 [ 865.130021] binder: 16749:16759 transaction failed 29201/-14, size 24-8 line 3193 [ 865.150866] binder: 16755 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 865.150879] binder: 16755:16766 ioctl c018620c 20000440 returned -22 [ 865.178919] binder: BINDER_SET_CONTEXT_MGR already set [ 865.184396] binder: 16755 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 865.184409] binder: 16755:16778 ioctl c018620c 20000440 returned -22 [ 865.226830] binder: 16755:16766 ioctl 40046207 0 returned -16 [ 865.228915] binder: undelivered TRANSACTION_ERROR: 29201 [ 867.155137] net_ratelimit: 24 callbacks suppressed [ 867.155144] protocol 88fb is buggy, dev hsr_slave_0 [ 867.165263] protocol 88fb is buggy, dev hsr_slave_1 05:50:45 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:45 executing program 4: 05:50:45 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:45 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR, @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:45 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x0, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0xfffffffffffffeaf) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$VIDIOC_S_CROP(r0, 0x4014563c, &(0x7f0000000340)={0x6, {0x7ff, 0xb0d, 0x8, 0x200}}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x20040300, 0x0, 0xfffffffffffffffe, &(0x7f0000000400), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:45 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='cpuset\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) [ 867.785889] binder: 16786:16787 got transaction with invalid data ptr [ 867.792578] binder: 16786:16787 transaction failed 29201/-14, size 24-8 line 3179 [ 867.795627] binder: BINDER_SET_CONTEXT_MGR already set [ 867.806177] binder: 16789:16790 ioctl 40046207 0 returned -16 05:50:45 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) [ 867.869405] binder: undelivered TRANSACTION_ERROR: 29201 [ 867.883380] binder: BINDER_SET_CONTEXT_MGR already set [ 867.895896] binder: 16789:16790 ioctl 40046207 0 returned -16 05:50:45 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR, @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:45 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:45 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@rights={0x18, 0x1, 0x1, [r0]}], 0x18}, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$unix(r1, &(0x7f00000009c0)=@abs={0x1}, 0x36) [ 868.061999] binder: 16907:16908 got transaction with invalid data ptr [ 868.076058] binder: BINDER_SET_CONTEXT_MGR already set [ 868.103105] binder: 16907:16908 transaction failed 29201/-14, size 24-8 line 3179 [ 868.113877] binder: 16912:16914 ioctl 40046207 0 returned -16 [ 868.135260] binder: undelivered TRANSACTION_ERROR: 29201 [ 868.170136] binder: BINDER_SET_CONTEXT_MGR already set [ 868.198305] binder: 16912:16914 ioctl 40046207 0 returned -16 [ 868.275105] protocol 88fb is buggy, dev hsr_slave_0 [ 868.280224] protocol 88fb is buggy, dev hsr_slave_1 [ 868.355129] protocol 88fb is buggy, dev hsr_slave_0 [ 868.360236] protocol 88fb is buggy, dev hsr_slave_1 [ 868.835142] protocol 88fb is buggy, dev hsr_slave_0 [ 868.840280] protocol 88fb is buggy, dev hsr_slave_1 [ 868.915136] protocol 88fb is buggy, dev hsr_slave_0 [ 868.920217] protocol 88fb is buggy, dev hsr_slave_1 05:50:48 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) connect$x25(r0, &(0x7f00000001c0)={0x9, @remote={[], 0x2}}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x800000000000000, 0x81) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, 0x0) r3 = syz_open_dev$vcsa(0x0, 0x7, 0x400400) accept4$llc(r3, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000240)=0x10, 0x800) sendmsg$alg(r3, 0x0, 0x4000010) r4 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000840)={"80c396a13cbcc9478ed497645ae632165df3a9dea45003fceaaa7eebb3e8f8ee933ccbb77ccdf600a54ed3743a75760a696e5d0341fa36ed47a3c4b8a6be1fb8cea03e435dd71832b18ea992e0c50fcf7ee3a8164f9d70be95c0c991bca24ad27070bf3fe46e9444756f9a2ef37c8724ea473d919aff44a263902368c03208b80e671c3ee66cfd10478b8621f309fb534994babc425b5831b4ed9e8177c15e89f4bb9609ce426722d404b4d6be80c2820630cfc2404ee6d6e7f4c6c7dbfc00e1b082824c9f761b818999f5a27c637f12c00bf357c78c0d1377749f35147869be02efe6bafadf37011343ec2ff939012378fed18167bb489128c522bdb145e7b2e0a46cd5d7678206a3d591ea938da3291cbd94443291b571bd9bbb4b3b390456b76ce2c300e9a86ee25262479483294d52e11b42f5609c9d472fc7daaa0a155e758b5628d0f94f6bb83c60b4d4cd77ec6d8bbf742c5cccbe7dcfd23b646bcd165d4ed3c5070ad49a31e36b43efff7a8d56f7ce1b7edfc3900f6ee8e1f2cad209bfdaadf587613bc8d646882576af211831b38686b6d1c501c052d6a759280dae76aca2fa58bdda59db7cfb3d64746ab85f116b69f5f85835c697ef29174952d4d47bc031a1359c6d32721faee270ab32b57ebdf8440fb3b07491ea731e4691c2ba00aa1e12d140de91e91a564a1c621e5a7aaef9235c154090dcc84c8e7f84f14fa2a5d1df5048d9d67c342a81e728cd7c7008337cadb151031d2151dd1a767de615fbb20445b276a694ddd9edff2a4cca041b2f7bcaa6e1c23e366089587a689728995fdda308d2984e9c2f1dfd7353263baa7ec11eb72c0386b47d4bcab7f8b0042cfc30f6a35b9215342c2196812a09072d78150a07bf44b0cf1f2ce7ee0dca21ae4ae974e069dee2e2235669d53b771ddeefefbd4e836b9afe2fe49567efb96ff7e35dce03768f69e5b76d68f78c921ec3f198c97c701aa40eb7dfae47db291f504fd7893dcda561c5e2a69e6d3c1b110c5b30e6d800fe55dadfe1ea28ba9ad2bca465421ffb3bfbb2dd7c1a99db5775bced7a6b03f4cc2f6b9218a8a557d9f0847c3b8b7fea4445b387cc50018b221e64e520c6262fcd9d44102682c8d84ffebca7a9972f3aebf9bf9db55c2d3688d96cc33e12592aea45caf25157be2c3cb0be150fb3cbba25ae6d2f998b7bf26668a9011b26353198bb0c4e7405af54f7931081e643255b019470470aeef3d4b544485e8de56761f64d60706626ec3896ebca2e61bd79e912a7f764a3563441eee664a4ab85112799a5bc8d2d6bc74bc6cd45aee93f2907c0cc4fd2fd5b82d57b79e4243f2a8c814561a44a223a7e55db65e4cafb6d63ad5486e7fdb7593c9dd2f73acf2f9a1a4c3b8d42b8ad78a72c16c90793bc6caeaf46867b508e02025a6e205872752a43e04d12a30b068ac90f"}) sendmsg$FOU_CMD_GET(r3, 0x0, 0x40800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r4, 0x1004000000016) fgetxattr(r2, 0x0, 0x0, 0x77) close(r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000007c0)={[{0x7, 0x3, 0x0, 0xe2fe, 0x0, 0x0, 0x4, 0xffffffffffffb1b0, 0x10000, 0x0, 0x3, 0x2}, {0x716, 0x7, 0x8, 0x8001, 0x0, 0x800, 0x5, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8000}, {0x1, 0x0, 0x0, 0xea7, 0x5, 0x20, 0x7, 0x1, 0x80000001, 0x81, 0x8245, 0x0, 0x2}]}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000280)={0x6, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}]}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 05:50:48 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:48 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR, @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 05:50:48 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000140)={0x7, 0x8, 0xfa00, {r1, 0x3}}, 0x10) 05:50:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306209, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 05:50:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 871.044765] binder: 17030:17039 got transaction with invalid data ptr [ 871.052576] binder: BINDER_SET_CONTEXT_MGR already set [ 871.063888] binder: 17036:17038 ioctl 40046207 0 returned -16 [ 871.077185] binder: 17030:17039 transaction failed 29201/-14, size 24-8 line 3179 [ 871.077743] ================================================================== 05:50:48 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000", @ANYRES64=0x0], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 871.091429] binder: undelivered TRANSACTION_ERROR: 29201 [ 871.092609] BUG: KASAN: use-after-free in __list_add_valid+0x9a/0xa0 [ 871.092623] Read of size 8 at addr ffff8880871494e0 by task syz-executor.4/17037 [ 871.092630] [ 871.113728] CPU: 0 PID: 17037 Comm: syz-executor.4 Not tainted 5.0.0+ #11 [ 871.120665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 871.130019] Call Trace: [ 871.132617] dump_stack+0x172/0x1f0 [ 871.136277] ? __list_add_valid+0x9a/0xa0 [ 871.140466] print_address_description.cold+0x7c/0x20d [ 871.145755] ? __list_add_valid+0x9a/0xa0 [ 871.145773] ? __list_add_valid+0x9a/0xa0 [ 871.145792] kasan_report.cold+0x1b/0x40 [ 871.145811] ? __list_add_valid+0x9a/0xa0 [ 871.145830] __asan_report_load8_noabort+0x14/0x20 [ 871.145844] __list_add_valid+0x9a/0xa0 [ 871.145865] rdma_listen+0x63b/0x8e0 [ 871.145889] ucma_listen+0x14d/0x1c0 [ 871.145907] ? ucma_notify+0x190/0x190 [ 871.145926] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 871.158277] ? _copy_from_user+0xdd/0x150 [ 871.158315] ucma_write+0x2da/0x3c0 [ 871.158347] ? ucma_notify+0x190/0x190 [ 871.158364] ? ucma_open+0x290/0x290 [ 871.203586] ? __fget+0x340/0x540 [ 871.207073] __vfs_write+0x116/0x8e0 [ 871.207716] binder: 17148:17149 got transaction with invalid offset (0, min 0 max 24) or object. [ 871.210820] ? ucma_open+0x290/0x290 [ 871.210840] ? kernel_read+0x120/0x120 [ 871.210857] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 871.210872] ? __inode_security_revalidate+0xda/0x120 [ 871.210892] ? avc_policy_seqno+0xd/0x70 05:50:48 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="b2e7b000f6c9ac09852a627318000000"], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 871.231682] binder: 17148:17149 transaction failed 29201/-22, size 24-8 line 3241 [ 871.232922] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 871.232942] ? selinux_file_permission+0x92/0x550 [ 871.232963] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 871.232979] ? security_file_permission+0x94/0x380 [ 871.232999] ? rw_verify_area+0x118/0x360 [ 871.243185] binder: undelivered TRANSACTION_ERROR: 29201 [ 871.249840] vfs_write+0x20c/0x580 [ 871.249865] ksys_write+0xea/0x1f0 [ 871.249885] ? __ia32_sys_read+0xb0/0xb0 [ 871.249905] ? do_syscall_64+0x26/0x610 [ 871.249925] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 871.249938] ? do_syscall_64+0x26/0x610 [ 871.249961] __x64_sys_write+0x73/0xb0 [ 871.249980] do_syscall_64+0x103/0x610 [ 871.249999] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 871.286028] binder: 17036:17038 ioctl c0306209 20000440 returned -22 [ 871.287395] RIP: 0033:0x457f29 [ 871.300801] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 871.308633] RSP: 002b:00007f4043b7bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 871.308650] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457f29 [ 871.308659] RDX: 0000000000000010 RSI: 0000000020000140 RDI: 0000000000000004 [ 871.308669] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 871.308679] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4043b7c6d4 [ 871.308688] R13: 00000000004c71d9 R14: 00000000004dcc90 R15: 00000000ffffffff [ 871.308713] [ 871.341575] binder: BINDER_SET_CONTEXT_MGR already set [ 871.346315] Allocated by task 17037: [ 871.346354] save_stack+0x45/0xd0 [ 871.346370] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 871.346384] kasan_kmalloc+0x9/0x10 [ 871.346397] kmem_cache_alloc_trace+0x151/0x760 [ 871.346428] __rdma_create_id+0x5f/0x4e0 [ 871.368112] binder: 17036:17153 ioctl c0306209 20000440 returned -22 [ 871.368701] ucma_create_id+0x1de/0x640 [ 871.368718] ucma_write+0x2da/0x3c0 [ 871.368738] __vfs_write+0x116/0x8e0 [ 871.387237] binder: 17155:17156 got transaction with invalid offset (0, min 0 max 24) or object. [ 871.390545] vfs_write+0x20c/0x580 [ 871.390561] ksys_write+0xea/0x1f0 [ 871.390575] __x64_sys_write+0x73/0xb0 [ 871.390591] do_syscall_64+0x103/0x610 [ 871.390609] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 871.390614] [ 871.390621] Freed by task 17035: [ 871.390638] save_stack+0x45/0xd0 [ 871.390651] __kasan_slab_free+0x102/0x150 [ 871.390667] kasan_slab_free+0xe/0x10 [ 871.390682] kfree+0xcf/0x230 [ 871.404958] binder: 17036:17038 ioctl 40046207 0 returned -16 05:50:48 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r0, 0x0, 0xf, &(0x7f0000000100)='$)@:cgroup^D)+\x00', 0xffffffffffffffff}, 0x30) 05:50:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) 05:50:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306225, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) [ 871.409664] rdma_destroy_id+0x723/0xab0 [ 871.409676] ucma_close+0x115/0x320 [ 871.409692] __fput+0x2df/0x8d0 [ 871.409707] ____fput+0x16/0x20 [ 871.409719] task_work_run+0x14a/0x1c0 [ 871.409735] exit_to_usermode_loop+0x273/0x2c0 [ 871.409751] do_syscall_64+0x52d/0x610 [ 871.413536] binder: 17155:17156 transaction failed 29201/-22, size 24-8 line 3241 [ 871.418032] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 871.418037] [ 871.418050] The buggy address belongs to the object at ffff888087149300 05:50:48 executing program 5: inotify_init1(0x80800) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 871.418050] which belongs to the cache kmalloc-2k of size 2048 [ 871.418063] The buggy address is located 480 bytes inside of [ 871.418063] 2048-byte region [ffff888087149300, ffff888087149b00) [ 871.418068] The buggy address belongs to the page: [ 871.418082] page:ffffea00021c5200 count:1 mapcount:0 mapping:ffff88812c3f0c40 index:0xffff888087148a80 compound_mapcount: 0 [ 871.418109] flags: 0x1fffc0000010200(slab|head) [ 871.418129] raw: 01fffc0000010200 ffffea00016da708 ffffea0002328388 ffff88812c3f0c40 [ 871.418146] raw: ffff888087148a80 ffff888087148200 0000000100000002 0000000000000000 [ 871.418151] page dumped because: kasan: bad access detected [ 871.418155] [ 871.418160] Memory state around the buggy address: [ 871.418172] ffff888087149380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 871.418183] ffff888087149400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 871.418193] >ffff888087149480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 871.418200] ^ [ 871.418211] ffff888087149500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 871.443545] binder: undelivered TRANSACTION_ERROR: 29201 [ 871.448934] ffff888087149580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 871.448941] ================================================================== [ 871.448946] Disabling lock debugging due to kernel taint [ 871.496209] Kernel panic - not syncing: panic_on_warn set ... [ 871.504705] kobject: 'loop2' (0000000048ec3b02): kobject_uevent_env [ 871.505606] CPU: 0 PID: 17037 Comm: syz-executor.4 Tainted: G B 5.0.0+ #11 [ 871.505615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 871.505620] Call Trace: [ 871.505644] dump_stack+0x172/0x1f0 [ 871.512112] kobject: 'loop2' (0000000048ec3b02): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 871.512785] panic+0x2cb/0x65c [ 871.512804] ? __warn_printk+0xf3/0xf3 [ 871.533925] kobject: 'loop0' (00000000f7d7f397): kobject_uevent_env [ 871.534046] ? __list_add_valid+0x9a/0xa0 [ 871.544946] kobject: 'loop0' (00000000f7d7f397): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 871.548302] ? preempt_schedule+0x4b/0x60 [ 871.548321] ? ___preempt_schedule+0x16/0x18 [ 871.548337] ? trace_hardirqs_on+0x5e/0x230 [ 871.548355] ? __list_add_valid+0x9a/0xa0 [ 871.548374] end_report+0x47/0x4f [ 871.592588] kobject: 'loop1' (00000000f9a2147e): kobject_uevent_env [ 871.596922] ? __list_add_valid+0x9a/0xa0 [ 871.596942] kasan_report.cold+0xe/0x40 [ 871.596959] ? __list_add_valid+0x9a/0xa0 [ 871.596977] __asan_report_load8_noabort+0x14/0x20 [ 871.596991] __list_add_valid+0x9a/0xa0 [ 871.597012] rdma_listen+0x63b/0x8e0 [ 871.611068] kobject: 'loop1' (00000000f9a2147e): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 871.616601] ucma_listen+0x14d/0x1c0 [ 871.616619] ? ucma_notify+0x190/0x190 [ 871.616637] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 871.616650] ? _copy_from_user+0xdd/0x150 [ 871.616668] ucma_write+0x2da/0x3c0 [ 871.616687] ? ucma_notify+0x190/0x190 [ 871.629907] binder: 17161:17162 got transaction with invalid offset (0, min 0 max 24) or object. [ 871.631388] ? ucma_open+0x290/0x290 [ 871.631405] ? __fget+0x340/0x540 [ 871.631447] __vfs_write+0x116/0x8e0 [ 871.653363] kobject: 'loop5' (00000000cca82961): kobject_uevent_env [ 871.658127] ? ucma_open+0x290/0x290 [ 871.658146] ? kernel_read+0x120/0x120 [ 871.658162] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 871.658176] ? __inode_security_revalidate+0xda/0x120 [ 871.658192] ? avc_policy_seqno+0xd/0x70 [ 871.658205] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 871.658221] ? selinux_file_permission+0x92/0x550 [ 871.658238] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 871.672180] binder: 17161:17162 transaction failed 29201/-22, size 24-8 line 3241 [ 871.676901] ? security_file_permission+0x94/0x380 [ 871.676922] ? rw_verify_area+0x118/0x360 [ 871.676939] vfs_write+0x20c/0x580 [ 871.676958] ksys_write+0xea/0x1f0 [ 871.676974] ? __ia32_sys_read+0xb0/0xb0 [ 871.676993] ? do_syscall_64+0x26/0x610 [ 871.677014] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 871.688747] kobject: 'loop5' (00000000cca82961): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 871.691712] ? do_syscall_64+0x26/0x610 [ 871.691734] __x64_sys_write+0x73/0xb0 [ 871.691751] do_syscall_64+0x103/0x610 [ 871.691771] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 871.691786] RIP: 0033:0x457f29 [ 871.718989] binder: undelivered TRANSACTION_ERROR: 29201 [ 871.719944] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 871.756740] kobject: 'loop5' (00000000cca82961): kobject_uevent_env [ 871.760766] RSP: 002b:00007f4043b7bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 871.764231] kobject: 'loop5' (00000000cca82961): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 871.770597] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457f29 [ 871.770606] RDX: 0000000000000010 RSI: 0000000020000140 RDI: 0000000000000004 [ 871.770614] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 871.770623] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4043b7c6d4 [ 871.770631] R13: 00000000004c71d9 R14: 00000000004dcc90 R15: 00000000ffffffff [ 871.771401] Kernel Offset: disabled [ 872.047762] Rebooting in 86400 seconds..