2fdec56309e0bd31c0e352cb2c3c3d1b3b7451f75ee6caf83212796c3377ed6e7cf3dfabb0e87e70180610c5e49f7981d8e90850df543f5ed16f24250c23cf6adee9f6a4497cdca485082c6ee487861f42f011719212d747f7e8392975d32e7dde696f6fafc3e7bedd7a6f82d0a2edcb8e572fba909d95ccf1b9f233f8baf1311947305977d71ece23b906415d6df4d51209349f7dcec4269a6520e04b4f6a5cf0fb2935fa24b85031b5cf3fb031b7ad072471455413b3ef4f9dc24c3f17308d803b47cfb1a71dae74dd7714917e7108931a906f94aaf729bc7a6d13a0d0b5a073b43b2469a71bca9004d6ded4548d8f755fb9222374bdd5de5f03fea069c6d25fca3d4c300e37a9966e3f313cfe8dba660a018659ab12cdec20cf13f94bf2c3164dcf9ab4f0ef75c94730b89431deefd5a124985a4e1440dcc6f4d7ebb1e26a0d79f3c48325a7e9d6952b80fec8b908af25d859873c354f8e4af586257a8f5112f710ba662d9384cde02ec0e8134d42253ea9c8d9d1ffafc5ee390a3c2f7c3fdce3326acf33bdd448cf59bb8b143b1c541444527763dd92e07ed79d32295e12180909e5df75c8fb6b56f7331856b7aa5d573d6b716f9303d2c379806768e4d483e474450644df7bced4a6ff209f7b385be7ccbeefba33269ece07d4a9ee702dc7796af6b2ad58c0b34f7942f42fbc5648f148f4da9eb90e6fc4f6279d1850648e8c698436a8acc9ec83875c45d0a2a60dd3eb3a02ca979f81dc02471c496f8bd71e0df8abefdc68775d3cc70fb454ee0d1b42df4043059c7d25fa237a4cd4f7290a551efa3ef527980981bbc77da0b285ac89d17209193784544441c45861e8e77589e23a446ef633e01521c36296cbc663ee6fa03126c596474c6137d681ca3605ea59b0584117b5d6b41da9b6b05428e43312bf0e928e436cf465de5b7f1a054ab98ece5308639b0cedbc25b948a102297b9cf7b7bcbfe4a5806d0747d39613ccc6ec2e582d717d424549225534722bb39f04e29c10d134c1089fba12d095808b4044960d8957dfa51065429ec48337fb18e8c476d3f225d42fc4925f8cad517127431892efeac43f04a75855c6578800d1be98ea97fc66aed0c773755e23e155a39ce120780c7cf9f193c58e5102a5678da1a2a21998e3e571dc98c554c7a2493fab865b0d95a15303cf7708dc4a57e32c7992b713d4879c0722258e4f007dc2f8b9dfa9b2afa6c485813f5213c7f3e8fbe28d4c115b1703f40e6db626ac1995fea26090a6ef0dc600e09315c6566b5a9e44a7c5991edeaaad9fcf8b20bece1ca9b73767f768246eecf32d97632e3fdea441cb04a396ad90931236b40a5a9813e4e1c98a3b8a9f12656880548af9d5bd94a0bd2e08f25fb64c82799e9410555e1d6e37a07058a08d7c94b4f62f24aac5ddb8a774a069d6b743438ea0b0dc8d41e0f85d8c723f491d07481a4909e9048edd98b2ac95c1ad3dbf6b0f3d29493cfd45d802776566d10daef066efaeb90aae139257154617db84cd9a8136bc197c105d3f4ffa63cce75c27660c541c9cb9eb3d1a49406a7d5a977ba1e7c76c6bd6c16763213f8100580ff84cf3c8345dd468fdfb847748338ca80ba2caafddebe600e1a7d269b589b854ca03c2c1a433c75b743ee6652d241508e97b2d670def60c07998839dec31275f66751c6f3ea56b57ed1bc0519e7cbd68afb14c8e804aa3c9c0de8539fbd777c3b25675cc7fd0bd86838512ef50d1d1ec749d3e011fc0ffbf1644f8ff46bec914d4f6382af2bcf58970dd7dc92eb3c595f35aef3310346f6353ac0cb0d73b75c37368fcd641b30609ddd8af1a4c56e4c98a0f90eee01db5cb7b0cf1e01d1303f387e2c144af54fddc02287413499a27d9ac690336842f454bf2a99fe06c26bcece9103945b9f31495f922b623ed89a01720b9c598016d0ee02e56ac382a2fbd5e3ed4f6ae1ff56ba77fff4db93ce8ae28d66bc251"}, 0x100c) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2264.168199] binder: undelivered TRANSACTION_ERROR: 29201 03:44:14 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000140)=0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) ioctl$PPPIOCGIDLE(r3, 0x8010743f, &(0x7f0000000180)) fchdir(r3) r4 = open(&(0x7f0000000100)='./file0\x00', 0x500, 0x116) openat$cgroup_procs(r4, &(0x7f0000000240)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xec\x84SUr\xb6\xb3HHF\x11\xc8\x86\xe4\xc1\xd76\xd1\x9e\xbdz\x16\xa1\x13\x02\xe6\xe3a\xf6\xf9\xf3\xa7\xfc\x10^\x06\x00\xd4\xc5\x86\xe3s\xeb\xce\xfcTA\xeb\xa0y\x14\xe5\xa5\xdbg!\x83\xb8\x87\x87\xf1\xb0\xf3\xe4%\xceJ\xc5\x946\x18A\xb4\r&\xcf2\xc0\xcb\xafQ\xab5\xfd\xd1\x96s\x16O+]\xf5\x1f\x0f\nE\x02\xb2dL\xc8\xba\xa3\xd1\"\xcd\xf2: N\x04\x9e\\L\xaaN\xa13d\x1a\xec\xdd\xfc\x04\xdc`\x8db\x9d\x870\xc8\x01\xdbieCAW\x95\xdf\x17?KQ\x03\xab\x8fc*.\b\x12\nL/=\x0fD\x8f\xf8\xcb\xf9\xd6\xbc\xbfg\"=0\r!-\xba|\x1c\x1b=c\xa0\x87H\xe0\"\xd99\xdb', 0x2, 0x0) syz_open_pts(r4, 0x180001) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x8, 0xff, 0x4, 0x0, 0x0, 0x1, 0x400, 0xf64fd987e5b54154, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1f, 0x2, @perf_bp={&(0x7f0000000080)}, 0x81, 0x800, 0x1000, 0x4, 0x1, 0x4, 0x2}, r2, 0xc, r3, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") signalfd(r5, &(0x7f00000001c0)={0x7}, 0x8) 03:44:14 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000a, r1) listen(r0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000100)=0xc) shutdown(r0, 0x0) r3 = getpgid(0xffffffffffffffff) r4 = socket(0x4, 0x4, 0x0) getsockopt$inet_tcp_buf(r4, 0x6, 0xd, &(0x7f0000000140)=""/89, &(0x7f00000001c0)=0x59) openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x802, 0x0) sched_setscheduler(r3, 0x0, &(0x7f0000000080)=0x3) 03:44:14 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x3000000a0160101, 0x0, 0x0, 0x0, 0x0) mkdir(0x0, 0x0) keyctl$read(0xb, 0x0, &(0x7f0000000000)=""/115, 0x73) keyctl$join(0x1, &(0x7f0000000080)={'syz', 0x2}) r0 = creat(0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r0, 0x0, 0x8010) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fremovexattr(0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_pts(r2, 0x0) sendfile(r3, r1, 0x0, 0x10000) rename(0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f00000004c0)={'filter\x00', 0x7, 0x4, 0x4a0, 0x2a0, 0x2a0, 0x2a0, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f0000000100), {[{{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x1, 0x759, 0x5, 0x0, 0x0, "ff6f8a5b515b1356bab5bbe27aac39998c8c691bb04e40b4b1ec99a193516f17f745b99fb9788e77f10edf8a9f7875aa181cfe16e9efde40a47c835784c44bd2"}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="eaa6da84f215", @mac=@remote, @empty, @remote, 0x8, 0x1}}}, {{@arp={@local, @empty, 0xff000000, 0xffffffff, @mac=@random="1303c375417c", {[0x0, 0xff, 0xff, 0xff, 0xff, 0x101]}, @mac=@local, {[0x17e, 0x0, 0xff, 0x181, 0xff, 0xadc247a09f4bb63c]}, 0xc61, 0x80, 0x59, 0x200, 0x101, 0xffff, 'veth1\x00', 'veth1_to_bond\x00', {0xff}, {0x951f9c99f39fbb3c}, 0x0, 0x1}, 0xf0, 0x118}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x101, 0x55c0}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') syz_open_pts(0xffffffffffffffff, 0x0) 03:44:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) [ 2264.287363] binder: 28863:28867 got transaction with invalid offset (0, min 0 max 0) or object. [ 2264.318397] binder: 28863:28867 transaction failed 29201/-22, size 0-24 line 3379 [ 2264.330950] binder: undelivered TRANSACTION_ERROR: 29201 03:44:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000180)={0x0, 0xfb, 0x15, 0x8, 0x54, "01444043eaef035f5673339fab4e2b97"}, 0x15, 0x15b7a20c2f62b824) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0)=""/138, &(0x7f0000000280)=0x8a) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:14 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0800b5055ed481e87b0071") socket$nl_netfilter(0x10, 0x3, 0xc) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000000)) fchdir(r1) sendmsg$nl_netfilter(r1, &(0x7f0000000140)={0x0, 0x34, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[]}}, 0x0) 03:44:14 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000100)='\x00') ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f00000000c0)={0x7, 0x5}) 03:44:14 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) mmap$perf(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x50, r0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:14 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r4, 0x400454ce, r6) fchownat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', r3, r6, 0x400) socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") shutdown(r7, 0x0) 03:44:14 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000080)={0x0, 0x0}) sched_getparam(r2, &(0x7f00000000c0)) sendmsg$nl_netfilter(r1, &(0x7f0000d65000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000022c0)={0x14, 0x4000000000003, 0x1, 0xffffffffffffffff, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) 03:44:14 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) perf_event_open$cgroup(&(0x7f0000000280)={0x5, 0x70, 0x2, 0x0, 0x7f, 0x2, 0x0, 0x1, 0x12011, 0x4, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7f, 0x8, @perf_config_ext={0x0, 0x100}, 0x4, 0x20, 0x7fff, 0x5, 0x100, 0x9, 0x9}, r2, 0xe, r3, 0xf) r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="00022bbd7000fddbdf2504000000080006001f7cc19cee5a29a66e436b8a8b000000"], 0x28}, 0x1, 0x0, 0x0, 0x40890}, 0x50) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40802040}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0xa8, r5, 0x8, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7f}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffff7}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xb7}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7f}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4000001}, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) [ 2264.647846] binder: 28897:28912 got transaction with invalid offset (0, min 0 max 0) or object. 03:44:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) ioctl$TIOCEXCL(r3, 0x540c) r4 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2264.700593] binder: 28897:28912 transaction failed 29201/-22, size 0-24 line 3379 [ 2264.733566] binder: undelivered TRANSACTION_ERROR: 29201 03:44:14 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000140)=0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmsg$nl_netfilter(r2, &(0x7f0000d65000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYRES64=r0, @ANYRES16, @ANYRESDEC=r3, @ANYBLOB="f7a7f572e01d87c0b7c5a99326bc46300791832e670fecf57b26cccbb205f317e0a342adb73b4e6cea440141826447fce10965ba7b64946d5f9bd5113114dfc104ecb02fbb890e78153874454ac3d6f0855229d0cee9a8805bb104f1d5046c5dbcfed93116beb3198a1cbe5073b05aa9fda96cb18f58a1ac6e4056564287f11fa54426a886c4a2875446ea3050038d47a6b895723256f6f933f35673d6ae6cd49b14ac739fb5832ce2abb8ce2e23895a707691628e7381772c3c3b80c75636fce9bafa790d13d850827456e1eed1d1fca07b4a9c8dd15a57eedb347ba332afd23ee4c25decb6623c13002b65a87c029238", @ANYRES16, @ANYRESOCT=r0], 0xfffffd69}}, 0x800) lsetxattr$trusted_overlay_opaque(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x0) [ 2264.845713] binder: 28926:28928 got transaction with invalid offset (0, min 0 max 0) or object. 03:44:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) socket$nl_xfrm(0x10, 0x3, 0x6) [ 2264.889945] binder: 28926:28928 transaction failed 29201/-22, size 0-24 line 3379 [ 2264.922936] binder: undelivered TRANSACTION_ERROR: 29201 03:44:14 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001680)='/dev/uinput\x00', 0x0, 0x0) flock(r2, 0x8) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000080)=@add_del={0x2, &(0x7f0000000040)='rose0\x00'}) sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=ANY=[@ANYBLOB="140000000301080000000000e7cde4c36950d9ac03e0c3d33d88b3b1a7d54cefd8f73bfc3018554b141ec6986137c50d29ccefc68a0d8455d51342440525d41b62afffc2b0636faf2de09544a0aa448b9ff1d507a65695e7e81ee6297af4d01a729a24f05f4c46af312394a528e0d3abc1562b2dc6bc04e3fffb3707f6b410087ad77deb573a1f54b175767488384b2c5683a753a293b8bfefd7c6d0cc654f4650d20841962eee6cabde21e9dffe7dd69e3612077f1d6ed19926711ffd65162ef97d1da1bd8db93a15d26ab7d4e677317a276425c14173d42516666e6203bea38f4f5c9bc7ab94d8116b7032568acc4bd29dabd55a9b1ebfe846fc23545ad9e128df315c"], 0x14}}, 0x0) r3 = socket(0x11, 0x7d998fe94f1652a4, 0xff) sendmmsg$inet6(r3, &(0x7f0000001600)=[{{&(0x7f00000000c0)={0xa, 0x4e22, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}, 0x1c, &(0x7f00000013c0)=[{&(0x7f0000000100)="61b23eb6db2872fa04e8bb628ab0c9", 0xf}, {&(0x7f0000000140)="1cce1f902f7a0697567b26d87df2bd92f6c137f0cf040a286a2bac4ec804e071793bf2d68c506ff3e00e62ecd949e54df9b2b2339cc0c570772954188a652acbdd7a63249705b502b4e42f73cb2e3be6e374aa45c60390addd53644ae12344157784347aaf125f37ca5588e8f7c535628595f8d731444a6864f1a0c1d50dc59ffbc3eb4a1d5aaebda2c0d05797ece2b8e49bafdb8f417d8b060fdf57ac78834b6c276905c3ad8b7b8155cacc3b64c6b7909f16d3abc51af3878f6e6e", 0xbc}, {&(0x7f0000000200)="aaa414aa9754b8901cc294b1f6686e594243801ee7a575552ea2aa12362a8327629bdf776ef66ec7d44dcc7b320ab7a48587ecf1f63af85274204cafb2e227c69f5e1eb82c46f359d291ec5830cad0c9cdc1a5264084b5c6498f7ceb263e9c245eca52e5a25a1df0397f2f9dfae70f0865e4794a0c1e8e272f7140805b20a22e8533431e98eaf62e5feb6413ac899b0ac054a726c16cf5dc790e2f1dbf0ae62dc2fb3ab28fb7b97aef5c98fabf5e77f733328bd6115d53c1a264bfffe681563706ff072af939ded2a4294c210e6dcc", 0xcf}, {&(0x7f0000001800)="a4ef28d56f06cb046cc3c0c8a1c5a3962eb7b828c85486689fe66bfafa8db5603e69b93aefdd2aaf9ebe7c", 0x2b}, {&(0x7f0000000340)="9aac1c77927b58d95514698656e52c05fbd963a0663792b8ce1f7675b0f2e38f18aa02a4ad84cbf4454f5eeedad910c6c8b795d111757a465453b52282b1018c06", 0x41}, {&(0x7f00000003c0)="576fed4a956eb1d4c0079f24997cdcc26d560dc25b6a2c2561ac25c875b7720c36e541c9383bf89128f8341631b4dc2797ac58b659c92d9628d17759dde95d10deae5b9885c372863f6a82546d3c0f6c9192eedee9c27514dcf03558278f7338553b728c33f534089bb1c8782383322a8194c2e2e41b09e6c3c33fe8706e24616261cd46a1b0c7abd93067a330b9b13ac6baff4e4acd7e65ab749897e3458ec8872d8b72bab034e08fee0388a91841747dbbb87632d9cdeac78f3f0f053a95b819cb9a27a7803887b541759cc72fa5f4a9d6c5c03e47b42b5b64abcb01bfc4adbdc0e64f5b8eefcd0d9dd49c73b45ade34ee0256fa552eb59b535d5c32ef219b95bf00f6c8aa1d825ee777b91ca64a93da1c89e0d124dc2038d9d64ac8ad26741626e72a84ef1b228dd005670cf5d559b1ac3a6f6be34d2fbbac1f96b1112c4b1e06742d0426445fa1df75fce0c9da544ad601cfb9d2722469663121b38bf43bb285ecc070d61aa5dfadb90219ccb5b4bd0b01bc1cafe15a4737d626427668d5859e84fb6114b903cdd2cba5cdeab9317ff089fcb8e13122cb7b5eecd674d74924bde85f3aaee12aee477e58ec8b6b4f357c0a0480eacdf3ea751bc584e3cad02b3735a8d2cad48c483f8773429010a6166c8d3c8c677f1f080c787b9bce599f2e87a869ea8b68c399286a75f6a5aeec832dc6b254c852af96af627732a26b1306fd4389bf9a3b9ab095e113bc7159dad5859c2ba6666899c297291166381ddd0f32f6dff53baa330565dfd2232b4d8daba9dfb549fa65cc14715f1d120f9a83de7da080becad22808cc72e84e47e33ec0984cc880ba49c711a26b7c30a0f831c33821963d6ba6322c088aca9d904e6291c047472b9cfc7c5104762eb98cd8ec9affd43af815400a527b4d07db1f9e0081dd55dec48eabe1d4452ba98e2afa98e0da890fbf2a67718d4ed0cc28e6e069dc139bd222afc3bd1a239fa5e760c4c18ba8093dfab5f369a5b2ee3e49b60e4b64ed191ac4dbb197508727f7e167f27308e3b32eed5312584f6fafa9354c0920592ed6f23768f0133731c04eba856e36190fa0816288a9e29d9a380c907416e9cebf7375638c84032aefa5e64d512a72a670ad43abdeed1edb3833f0410b2dc7b3d4f33526aa670598b130e091e7d90b4e91f83b4438c87369e90dd2d26dedcf71e1d49ad5ed806d7b6628a5d86fe279fdc18f14729e3ca7ae895b88227b34d24e4d19f3ba1a8bde0c03525378c404658878eacc3746bf894c576c83248fe68a98d56e401d4544fcb67212ff18086abc06f50a590509ee4cc14a410b72687e456ee1a942e1324ed1d7bf6f83571d2193eec8d40ca93d55a26bd426b9729d1481cc8d6426ecdc0f3aa07bd931b4b28b93eae9e97a2e7ddf7f6a1c2df4e29b98716391e06b101e76ded3ae5b861d0c962ddd428d10a11892df5bb68aacd926d5a3b22413216b307c9358b85fbcf05a444120046745403719cd42b162e8775ef840df33ad39aa2afef52a54b3cebe9bab5c4e5c3eddc08e6d002d0226278640d45d3815434d0397e75e22cc6140743d80f3ccb46a9435118830035d79e4173149b8fe9aec357bdb38ff3fd79bc1c140584305442d0e2e654d9144ebd5767fc551b00e672e34c69c13d4faab757e92bf12c40838552d0bf06d4dc8285b6047fb462b5553bd8a144ed0ffee2dc772ac6b9a427d8f77e7ae87657bd962890c14a57fb3533610ffa9a5b9a7a6e103e0454a89ae80a1c75d3b2de662b6ee82b45052b20d713fc7ae09d95eb4c495c5bb1fdc33784ceda09f957790032ca37a846cfd7673417915b0c064d6ad03fb5c720d9de7604bbc610ed65f99214646f7a972fea6a82f391f2c21f2cf695569a9444f6ad1002492629a8cbd834e65d9fde81bc7bb048a254f7646b1a2a532ee50e1adf476ee6cd996a5d6ac7985f85ad8f1b48b264fb23f2acd20ba15b320a944c63641a4f029abdd981468f9133773c7dccdee070c18f97a53b9966be54275cc675d58d19f4107a3726c8f0f7cbd087e47ec808e84a6dcd32b1b8b5ee9b3f1ce33cf297544ece468302851f67f894ab5e9ede03ee98f978332013a66717e2cb601d1180a082c3e024746682f06fe126427702bd52183efe1e5a2802a9cd5c9ee9bbdbb0fb9037b99cdb7f72620fe06a138249e21a25af63082d2e44967c29c27d2a28e90643c1585beed160641812ab4ce10211fb4eeb0e34eeae6993a9d1f77ac5bfe92909218b44da900723985825e8be0e8db349204fd72b9029c56fdc1601bf5b2f598471736f08ed990fd5cbc9a2a078297291280fa02d65240d13d5816c84bf9cd46541a846b05398757648392bb242e828324d6e588c3135e2368eb428677784a566857d73ae2269699e8699c52a832b609b48554a60a54ed31481e49f3856c745a391070083da4bc61462cd5e56519e273ded91ae30b60503557240c762a4623442ebca6b1984fccaa5d54a235c722c819705b72c9e3593c29b27491f7e783f0dd5ad91dedd510cef3c53029359703e6640dc106ad1b88f7154dc6784da3bfe09f32d2ddde09375f22ca4ca93b782142e49b4c142f64a7bdad22840afa1999d0a055b50d1f7bd04850281fd4c8ff0e0c04d05ac6bd2708b436ce4a3e7d681361272233a493ea4906c8fa7845cc186c2636125cc8f654658694f8b82fa7c8eee3e3e6738ed0616f748618350189c7f2a2fc807346a55dd5a2ddc10ec8e225f62fa715867071464661c3fd66d45e4e337dd57cb7cd1deb85ccc987384b4a461f2022e34b2b2a5383d9e68c200ffe7eabbc269964de91c25257dc0b8bf30c27090a0b1fbc722f4c057488a81f01d96532523c3da8105f4803340e1f29bb008e98c20a2013cedf58f3d5f93230bc7d77750796ba2d04397833fa82e49463f95f0c48d34875f12ffe1108805f03af662ee1a87036b504df186fa9de4f814e7a54822a6e239d935b9793adbcc087ac7b25eebb5490379bb0a0a66d1d1a17bb91830ec70f7f6a277eb44e28b33d7082621c89b6bb1e52b5777733b1c965224ae75ba9d1634c981ab50d5aa608bead873fc9e7a3d193c9c179b7fba911a590e25d875a83341534c1f0a6cf0e28602099a8ca012bc2ab13f82a74e29d5e855d81ca1044cbc4edb2a75cf67c822885216352ccde4932a3dd4d017d9355173ea2e95bf74bf210411ecfe4ca4aaabc609d47183ba98d2ee105453542ab28dc73eba57952b088ba9314e3f386de9c1c78bc7b643344a2778f75bad83345251e187b2341eaebd040a72b3541dd359541afba79c813418026ac6359fd904f475fa56c79daad5226d72cdd679d2ee41a0632f2b6159d1d9c9ac9956677b4d4bd6030517e93fe16cc152dad2470c06e99334e434c53956972d4d086174307ac637679b6be2622fc29e88dfb30beaed7567c160e5dc2099d8d6caf60c77f5dca08c88cc9a7a0d99988f887a1e83d4aff4cd2317958e16b935e538edbf1e9f85a06dd729e9e01bc2c294df550a6e3737bab97d6ca2a9a36377ade20b5a9fcc17c107be1b5c92b41b0c12fa632aeaf70f1196e4c402cb14e9a48728488c42db96d276cca287f6d0e6a50a3b552768b7ba46e26424849f4accf8504726031cf7852a72355c306c183536785c2bba00d5c0c2cb13f287aa2eda61269a486bcf7943412a1cca3c6a0d21e4da0e31e92a50204d7f07ea646de0cff8e637f3d3cafa063f3392feef344ae5f27bcae9875be6b8aceef90edcff60805ad864232e69da4bbf17dc7b13dab5fdd3cbb4ac1b516550f2dc379291cec08ca6c609d92db492e58b6a6fd6488b145340cb00943bc5e130a86c8503944cd8f94ed1830225188e3b71d66e9ec0bdbf032a2debdb65aa637210e434ef501ba8b72e7479fabc71e16254510b921b28543079ac7763b6bb6566784ce2868f59313e48255f968ab65ab1902bffe2e9db30cd1ce5da646786afdc895878c64d04a6e3a2cfcb6ae7ceb6e1803f484c3135938789372b71abd274bfb7a2d45b816d39fcd860b6310bc1da0b2236a54288471eedfb75488746a87413ef0723e13bb014a5f4c2ea52854d4502be14bdb241f988e94ba21776230c28e3d806cf5ab52268950d7b7326870a90490a8e66bb42eb9e2d84654b27774c3d339fca038407a51ede004e91fa3bf45659c6ed22ff303c93e2ea1993d05300a2e485ee898b37a25cfe1ced64670bb7033d06bb719cecc42e35ba91bc6559312f77dea6baa353fa14563077364d5f961529a9887f90c1c23b6b55a7543d06a76f66da15b1e17e4bc22d1744a273dbac8815e301197d008ce2c9bdd09f7e2a6f565f7ec3339571008476a255d39982f71c504a508262a668c769887224d5d91f0671ab0dabfae5e4990b356b42761167fa45c775be30fe4578361fd2d3d12c02c0fba2070ab80dad20c36523cdc4da124f469aaba9abe80ca6c9b0202811cb4cf79bf5124942418cc6714992d82a831a9143661d530fc6cd67af1d69972d375ccb63042e70fe5571c60f442eadb6e6f08f8e5dac843fee14c6f3a80e708b148c2493d8ced7975d20fc9cc9121d77ab4d16d22828ed78bf82885f69e7c6ebc2f26fa01c0fba4e9c5d54790e2ec4dacf337cde8fbb11de8e19f7f821f51341aec4e707f5e11b016f824ee2316f8081f1998ceac139ec0a7c929f02f827e8de39cced30727804adc9d98631ab40d2c486b8aac835ed5204533003bea49e314933e6792d347f3fe27e4f1fe5ee026cd157ba815ac2b6afb7233a1512b7accef92176de7292b9fc3d8a2f73c05b7f695e8786b46117a1f9f4934e6a4db94f98254b79fec8af1371f6b08ef049997b9b0fe0722e87cb3d5e8a77e5044fb8651473fd07da58f64a78e47cf0ca301fc39aa2ef1167eda9b960f935745fb1848cb5f46f5b146e85719dcff002cabbc69250f5c8699ed2b896711990d61a484ee0984083c420eed8f783929b282795cadd1e4de6533b7a3e82bb0d3a3a7ae8ee59464c270c671c98933f29739ce80836c3ef5f45f52ebdf528d05b4e0375390bd53fd382948e12d94ab523bcd980bbf05c9ee4954cf9e3ebf404f171e80f30c367a63bf5b620797ef080a60e67863425daeb80ef491012a5a41001a4a9ba759d423f6378b7215b7084a81df2e5672c675a209aa5a98cc173bc36fcca7cf93190faed93bddde633245b376af517c51c939cd91b1c57da39293176185f87f878cbbe51642ee6f3c9956728446f10f049ab0aeb25dbe75da1ceb47b6729f526ea02e394c6a5b00d19f4a4617ea66637c4e542518016aea1af1a3f2d75cca6cc7aebeea42c32cff583f4f1d8c296575753eb170b2b6b1517970c3bf74a6002c734ff620a45aab1b64f98af71007ef039cf178c003d3ca68ab4c92cd31d4e4a808006b74ef3db6a99078cccb03d7c3aa03e4b194cdb209966a64bb6c374b63528ea93c73851d704fd05e39632a15ec6611d6f9832656f7284b02490cf0ec0065fb829492c8a55c6510603c0b58f83f39bfbd51dc4210d05a1e2955c8f14b091f85f5440386a6782da0f398859f0d640ae947273cf744c68a61c10865f9a9af8d669aac4d60d0185850eb86923e4677f6dd67b389fa92eb041b670352e4b7e7433a7e67a040cacaa59f05bbaf20596adb582597c422c4d6a2124bbee98f4cd00a3e1047d679d0a057750b28c25ee04bcf055f676fe949e6147c0c1537c40a7aaa71fb8ff8b0833356e0dd17510643b2a32d7089a14f957029f5ff909a8b684deb1ce5bcd8", 0x1000}], 0x6, &(0x7f0000002300)=[@dstopts_2292={{0x10c0, 0x29, 0x4, {0x11, 0x214, [], [@pad1, @generic={0x7, 0x76, "d7a3d419e0dd641138682ef1ee369c0af51884fadcf495e9cdddaf3c7b2152ea5127f2b98aea37cdbc9af4f66b5d46971c69f2d5353ca429ba80e867c1898727f7484462ee41c0392f92c97c114f156b58b287b3d5a803bee314df8bbe334cda75176b5f34e89cbd8e58171fc18afc52a7cd2251c912"}, @calipso={0x7, 0x18, {0x10000, 0x4, 0x9, 0x2, [0x5, 0x8]}}, @generic={0x8, 0x1000, "8532130e5a09af21714b9b6396bddac82b7bc728fdf568d3700000a339d557ff3499e1c822d477ddd8883f4d44ea09238a48565fd35bc1447db2d7b823add37e997db6197e4422a942566ff80d72cb25cec4a69621445baad60cab9542c84046a784f2ccc93a700ad4d971e49f03f5f53dcb989ec93e235d683ffc762fe323366c07ca87ada6e062a0ec4e5b6e8847b9509a9516412da65d1f7cfd06b5207cb19bf127d1598b6db76e301000c7b585a3671189d2c38154dbb0c73dd088c0112ef11983e333777b10df011f02c316431f0cf3671172be1cfe4350bc2a4676a5c35efd89239f2f10a3e8e0f37bf3d06b5ebaffc6441d966457110ab8bb727abfb7867fecc2a1dca28eceba91e0222a11eca3d03b33944f4eb2a717c4c9048955606739e0d112441ca4cab4c68b05fbddbdf8de496e2fbc80c53ea8a1979e2f719b62d0bf4d3d3b0e4a3e0f9ddcd48bb125635164f953fdacc2ea0c201597122e7a46272e81ee46db1fcc9be24da78d872ad5f355fd0ad9814783a57ac95aab2bb8531e1767a428a59346b22511f23bf85afb768174f9a936d812231fa43b4ca099c0944d3943b1b647acb4ec27fcb4b1163c033e13ed3e4745be68b52252ca1bf3709912193735a7cfac279ee1a5a1a0ee930251ec122566b1ade9f63886bdf238b4f6c045c0af393e512ea2e31cff0190fa2bb92318959a6de97ffc5d6dc905a802e4b9462d8557eede380200ffd4680177bfaf7f8c1dedf2a439134368d5ffb9f061b450131f0d81fe828cdb3563bd3efc25c739e93206a7a01c5c93ad56c4f083d8005c3ef306e6219409bb1a495cf749ebb2dd9defc6b80bc4149e97f83d3658775fbf03021e1d0d8570b7d272db5af60d4f2c77571a4b1fcd3e1c22ff8dbbc3b7bc77d182b759d0c3f2beb363ceb500aa7eeac3666d23451e6b48bfc5ba92d7b19000b91b52782e811c2d1707716e5d662a6f7d9f5c8c53574a2ef03cfa599b2fcf084d5e481c1f2f4c542547c059bf0838db575b92100ea99dcec4c8d80cf55d8aff92f287069dfb4465c1cd7743d34a0c0172660c59ba4e35570499b09c8122fd12af854d099efa80c412f36c6db98bb77cc7816108b61c098ac010035a1afba3e3f7072eccf3c33cd659abf50cac5873260f2f1e51d2bbacd352da271c3b85486668f9d5ee8794984f6319b47fef491c1df3a34b17f1d94f7c36da01e37736ae53b9407e94739ca536c8a8e5e00794aaf40e51b5c635d14e744128d24293d7df617093fbe400e658431700bd86990c26eb345248f502715a90ee24ff3086bff7bb26d2b1ac33e2fa40d470eb1ee33cabe3fe65de3d844f96b4404682b7958ce819b558bf292836a5f1bc7766d04cf02cdae1cea6ccc199f9a6ff51ff1477d670dd04fdeed9c333ba900abd23d38377d283a8c9cb9929bda080b1616738d7218350b328aeb90da676310cb5b0eda0c035ea51f7cb0b71541cd28e2ee6dd06cba5eeb26f500d2f54fdae2c60ff965d6ce7b5085db9dbb6eafcc2944ce3aa026d9d33d5496d6f80749fc9d2536a2148f5a961fc0367bf6e84f1061869c1b763a88f4aa34a912950f3d94e509fdc78a226b63b71a73222ce86e00d0cc861d542bbe4be131cd2b448c1ad83d7ff66cf675a11c893763b9c015c79059adcf0405e996864de3a3869890c2c75da4b1c481c399d94abec8bbd714781913811a6439643fbaee61c83ebc2f40668261ba079c5e5b95f70cfa4dff66653c7f1493229880867fe5d9928768fb458ac09cd07ffbef5c13343722134f72f7c7955c54ffb8513788b9efb41f91b45eab78823cfc59f029001ef10b5021057d5666d070e4b1c70c883499913ea3abea842194f87a6e63fa7fc4a457f5eb7cd23c277046df5f4e76b7aa7906456d6fb50bd900b90b7f40f6f109ae2a227bdb5cba46283efec44450859e6490c06baee4804f985d67a431a2557cb045347455a7e9a5f54f9f773450aad429f7326e60a5d39b801d40e2eb5e1f4ed316ea56ff595005efe1ba255b0c179c26965c23199abdd1f4e5cdf8a7ab75c072a512943d8886350db2e947eca8d56d52981fe59167d4a3a1df2aed741370aff9be3b8bd11684791f85e3451a5462af36cb4a4c54eaa6ac8afd0cc35aef49c50a68f2be7ea4546d109fe8dbfb5b1e706f51e5417f16f50ea41e3333730f676f17c38c649b1f92afd0adb6551871b4559af39dd38b54992ddd4d75b3c494aaa52ef65d5843364a7931963ff7d561cabfa391e4392725d2d809ad8f06dc76a144372298d13767b011ef74468d8785f2338489bb0ce34e6d859127090ad792f5950b1547e5ad7c1d732e062dd46e809d8c61c12839c4308abfb5fea57635bfb120bfc7a2a10e2cdf1869cabd67bcce9b73e5ba0ee190ebe6853c9206397fe11bd7d2a29d34723a0c446e006bf881ac45ba69953a21d1d27d9032c54d0bb3405fefd074b4f8539238a129bf33469bcff4b27d24f2b7a6b954046f8c7c68f626edaa02e09b6003e544447b8ef2e669e12d3d6890f1937145f1f92ee521ac75c4a5cd491b2909b9882a8629184797633dfdd937468fbba501a20469e84a14a0ae78c15fd8e2f448b7d3bdc10fd5f64a448a8447a66f58adde06e759a1822f43e8a601d1b6d15720fecb3f2d0955d03e653090f846c44d3fe2e0324eebce36a687a4f33ee4bac08a49a54df685e8d0076fd79f2649b8f3c0219da26ba86481cede5541d467bc950bf0680af6855df3ecfd6a2a26f525125609f5efd1653a0e6eadc8499e1825ea4e5b221eb43b664a89f57f8078a30e4c28f2799491c5b49daae71905ffae199fc9cb7872dfc23c816c5e2489d712d325ae273dc8be6aa22ea4bb1ec7c9677bf210f6bf33f629a1c7750db314406f13a50ac1c7392a3987aa81efa1afd28b352f2c078affbc083d1e454b31f8655900ca619e3bdc6543f5cbaae3edf79772d260d2398ab18a4d3d5469134dbf8caa2547deef645eaacdd330e5840994ed3a64ddfcf23b2777328d8d7a62690553c6f8406e25fd6f4d603cd8efa5c4486484bb6f6cd292c0e00530e6a85aed3ff6ccc836152367728b6c49ad74b204f69583a20c3a1aaacf48ab9039f3999df8d3b890e3baeed861a8758c2a6a9e31915ccfd66c7a162be56417e2c19450d15cd359151928bbd0c335cd363ded8f9a8a95c088abb83675a79abfaa132e48638ad717d7edd0547b2e71853862311d7ee44189b3e1428d4f97837bd25efd402ef481d8591cddf77bebd5fc5311b890e595b6ed9385ef0706254996321946d79a1b451cad06f19997bdc50903e05ea52b026d1a41545c9a3f558ba88a818baf966b2c9a2a791a264dfa3e06b6237b56cd50a0280a293d1323dfedada43d2202b16225eecdd623fefb5a1ca8eef342203fa2208cc0b1d898ac267794f7a016dd7f0b9ee43060610ed6fcb92a19d195212c4d18d9b100fdf8d12882616293e1ff364cacf4dc4fda40f20470dacae42299ab6fbfb51fc1d2761df56b0e55ba8f9b2f39e8211d065f6a487ac1225e8959395400418e19af52cdf9c7592ead3d9dc51ec0c45eb458dd45e8e1500f4178f1839a37e293ace3ee385f71a3cf89256f9b47a5d9769c19eb486d210ccd7a310cb589cd0cb7b29778001630273c46dd1738116e38b529cc88689ba7fafe33dcf06fed89c96eac66d27a1c778ff18a703e833f0225403fff8b9a62fdc03dc73f3c9a676fc2a88c4b6fc96a4413dfde2b313e6b1dcfb3dd14faf45c5e196558362cd3b293ed5b0de9ddaefeb76249b7343e7428950b214722400475116a6d50a29404d5067e61450299ebc06149e67e72f4e2d0a8e73e219fe052578be655a24827eb84237701d2d93215787946fe5845568baf0f36a8058de7dfd55b55a7e7355053e383be939079e8e22b387ff218f6e436794add09b43ec2ba408533a2cc11ffa2bba444666afe638815218ce03935128f7c6df0837767c2b6aa07f73ff9e3b3a13ca465bfe31620172dc148ef9f0e91de025d1621c0eb4348d35bfd5d7a346ca1b2b72ec160d1f30e0036679511622553eac4a1a14c8cbb5da88e0cc863cb8dbd77809be921827cdb31f669928cb47f5b9ef9381bb56a42ebb5304066f196cc26c411fb6349bc1bf11995e44b7eaf1db6ff07a09a620f83756cb3b0762a15d9698685bf4c85a3cc7f6a00b9f4eeec422a6ff190a8da6f38e7d5fe680019e9d9b24370d0f1675eb3143235399a92c45ae94dba0244d806c82d7f851225f19a75863ddf8bf769ee2693f64ce05d580e12df6f7277fef3f188bfeed46289d3be28007382249e1ab227a3e2d2f6a636ae1125ff58a920a6353f658c85fc57d46bdebdff3c23005549ddd0bc15164cea798ed2db24c582c632707881eef39778e847f5ee53db3fc123b94d102c7aaa9b17f97b628715e31a3e27ebef6035a91e02e5bf9bdd585e853ac50acf4c5d85edc366c56340f727f31cdada0c3ec3e3d39979f9289ba0fab32d6a591bdc7c874408deed84fcd7252fd214b7a9149428287f0f0b40b8665cf134799ffcecb54ae66899187babd5ff4c113e2f7d2a3e81241b86b99a329a2ce44a38932bf9de463b4b1834c00334ae0652430f624baa81c0bfa81d7d3b15102eb5a5b6d4d1cec95a301e9e1b3900d329a9f29ba550ba310fec02e7e5ede3cd019ded491138bad10cc890f8b96ac0462e0b147f3fd93898fe5e89a559765a7bf9e84ab7eed38444ad2af78dcd25e4289e4d19b33c01ccfd724add626699c855fcaf249ba101e11c9e6d1eb130bb5d9f6e93ee09c253cf36bc8abaa52fb6ed70e18db63d0d7c406eee2092622d9c60cfb657e16f12b68c4769a164a369d900da3e1323f8ab452e52e275678c564ebd61e606763da51939f6cba0aa8194b3be380722d024ee00b9a58a4dc2f9cff259b2d9bc82122df9a51906642600990794f771b8ec7015d6cccb45937715a2c25e4f873735edd36c60cfdcf771dc56cb668e5a22536c9556972920ee7697151dc5871fa23b127a9547f8df33a99523ca859676f6295c9c6f45992d521662d98686ce2c4a85c3478938d4cad68ae4798a5c37a4d11f46b46963cb6d5937d76f5bbb3272b205ba3cf0f985ef12a1256d491d4e16b4d110001c6f14fb952a3ce4ee98cc57855f0370039bb4cab66d9243654978419647c0dcb90a05e4ddb0aa0dd8d793b610e342c309c424daccee819e40acb61994389d8428f376c0f8844fc83f5bc71cbe8bb5e79eec973b3a6b55d0217e8e859f43966a1fb3c50ec52c1d18ba96c8763f0ebf8523a9c7b8600d6ed71840eeed9ec7516e7b7f92ec6d399951803f88144c92f8aed9baa054bf9cafa143cd017ce18051ca5ff3a4c8bbd4f6d92df086506ed9fc71297ebf982fe9c74f8b7ac6bb994227ff2fd02e61784c1540f9b9d1a7b5259686cae079b4a40ba0a563a37b1864ddb1bd15df641fe31b4ae7ae386299e7e081925eeb348b0566b512746bd9f82878ea9c0bca53b60da0cc6e6e1c46e809408670ba5d7ef0fe7d001ac8abaa6a34ce704c3ae4988d6bbf270d13ab77735615779a1551f8646e830a205844d17c00c8c216575e714fc24aaba772793af3334764af411675b19e5aeae990955866314a2cc7c8ab8af459eb9c113dc0ed1263a905fa3956705fc96a5bc3f63b78563c7c1c2bd59297e84ac22afb37e7f736df0dda07fac2e9345100a362526a7d9b38453e3dcd3cad15cc4be2ee6eb5a307f32f356af446bf55733d79ba8765f7b93083c7fd2adf090d5"}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @ra={0x5, 0x2, 0x46e3}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}]}}}, @rthdr={{0x28, 0x29, 0x39, {0x0, 0x2, 0x2, 0x8, 0x0, [@remote]}}}, @hopopts_2292={{0x48, 0x29, 0x36, {0x3b, 0x5, [], [@hao={0xc9, 0x10, @local}, @pad1, @generic={0x5, 0x15, "fdc26b7e018eba6f287690ac9f0c1fa882be34aaf2"}]}}}], 0x1130}}, {{&(0x7f0000001440)={0xa, 0x4e62, 0xffffd843, @rand_addr="599cb6b023005201c32901d0111c2be6", 0x3d}, 0x1c, &(0x7f00000015c0)=[{&(0x7f0000001480)="5bf56e9003bfcc8ec074dbeb724de5b3a0350026611d374e3ce50c5ac4852a7eca7d630082edcc816ca3a2caf3cc291b52bd8e92f828a4327e6e9cbe54839144f28cc325bb4b8516866d1b582f00c7c57019d63934b34cd5616110b9899306ab411ee8d571087ebe618752cb721ac4580f514fbfac1f098f932bce2297898d1ce9b10fc93a9d11a93d0797cf5e2621b959664614a2faf7273c2f4c2e12", 0x9d}, {&(0x7f0000001540)="bc3197113223c938a6968169fc86653b5e578a558c1b31d3359d55a0fbeeb5183b2ab9f192eeeed544c6fc9a60892c41bee7e3edad23b35c538a9f1cefaf114a71", 0x41}], 0x2, 0xfffffffffffffffe}}], 0x2, 0x4) [ 2265.011136] binder: 28939:28940 got transaction with invalid offset (0, min 0 max 0) or object. [ 2265.030794] binder: 28939:28940 transaction failed 29201/-22, size 0-24 line 3379 03:44:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x22080, 0x0) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000180)) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0x6406edfe965d5598, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000240)=0x14) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2265.074754] binder: undelivered TRANSACTION_ERROR: 29201 03:44:15 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = dup(r1) ioctl$KDSKBLED(r2, 0x4b65, 0xb8) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r3, &(0x7f0000d65000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000022c0)={0x14, 0x4000000000003, 0x1, 0xffffffffffffffff, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) 03:44:15 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r2, &(0x7f0000000400)='cgroup.procs\x00', 0x2, 0x0) ioctl$RTC_VL_CLR(r1, 0x7014) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_mreqn(r4, 0x0, 0x4, &(0x7f0000000140)={@empty, @dev}, &(0x7f0000000180)=0xc) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fchdir(r5) r6 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/attr/current\x00', 0x2, 0x0) ioctl(r6, 0x1000008913, &(0x7f00000001c0)="0800b5055e0bb1678456cfe0ce0385f7c16af3891bc36493fba02b905065aab9993a525a47699923adf71d318d48564093f11ca8b156ba05dffd56689dadae5435809714bfc39d06652ab28e69ee1dae2a34d5ca70b8f0a19fb400e7637e45ffd666ba94122c9cf10dd35629d6e045715badcfeb3482074e9a35e0ce68381e3c32744c6a3742236b7fe353021ad2c2524f4d977aab73b22b93d11a1d3a6c7f6b274c9e6b91b09eb50cc4b1009f488b50e808c97558b7850010ecbe48bde056c49747461e6e6db5c4a3559d4300000600") pwritev(r3, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c5049eae15e2ee1534eaa129f39e00fe8", 0x11}], 0x1, 0x0) r7 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r7) ioctl$VT_GETMODE(r7, 0x5601, &(0x7f0000000300)) [ 2265.206199] binder: 28952:28953 got transaction with invalid offset (0, min 0 max 0) or object. [ 2265.221356] binder: 28952:28953 transaction failed 29201/-22, size 0-24 line 3379 [ 2265.244139] binder: undelivered TRANSACTION_ERROR: 29201 [ 2265.256128] binder: 28952:28958 got transaction with invalid offset (0, min 0 max 0) or object. [ 2265.277277] binder: 28952:28958 transaction failed 29201/-22, size 0-24 line 3379 [ 2265.298058] binder: undelivered TRANSACTION_ERROR: 29201 03:44:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x22080, 0x0) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000180)) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0x6406edfe965d5598, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000240)=0x14) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:18 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000d65000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000022c0)=ANY=[@ANYBLOB="1400000003017cf900000000001f000003000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000810}, 0x0) 03:44:18 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x252263) getsockopt$packet_buf(r1, 0x107, 0x2, &(0x7f0000000080)=""/173, &(0x7f0000000140)=0xad) listen(r0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 03:44:18 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) sysinfo(&(0x7f00000000c0)=""/192) socket$inet(0x2, 0x0, 0x0) epoll_create(0x7f) 03:44:18 executing program 2: perf_event_open$cgroup(&(0x7f00000003c0)={0x0, 0x70, 0x3, 0xb1, 0x2f, 0x4, 0x0, 0x2, 0x200, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x6649, 0x2, @perf_bp={&(0x7f0000000380), 0xc}, 0x8000, 0x80, 0xffff8000, 0x0, 0x5, 0x7f, 0x33}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) r2 = perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x24d52, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000340), 0x2}, 0x0, 0x0, 0x1, 0x5, 0xffffffffffffffff}, 0x0, 0xf, r1, 0x0) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000240)=0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) clone(0x8000000, &(0x7f0000000080)="581d66996f5df5408cd2fe6da249fa8555673c2dff29c14783fd3294299a8908bd25750070c199be6d981a78bbcb89536554252cbab612d119eb825b8c563d2793904b5968a98ee000556d0f7db16fec7490bb37336591e31c44d65bec49f5a72e3cbbcf23e4b3c6a7d952f61e0c6dd8a859cc5bad572fd53fa612f4c60d5a669744555975e7382e0f26121a352ab361ecf474e54d8f90c9b3446935c0df88a4ca5bd847c78a102daee179c08d858eb89a03a668bfea7b1363097179cc5b588e3df4ed968c50323eb1e07ee338250d0b928dc79a7140442dbbd575547799c517765c5d44e9ade867", &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)="3a23e932a556a1fee0b51a8750d287e4acb2bff1520fbd4d041ac7f2e83409b4f2dccb104ecebcfe1776c0637b") ioctl$void(r2, 0x5450) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSTATFS(r4, &(0x7f00000002c0)={0x43, 0x9, 0x2, {0x8, 0x8, 0x9, 0x1ff, 0x2, 0xd4e, 0x81, 0x9, 0x8}}, 0x43) 03:44:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r4, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400004e}, 0xc, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="0c010000f948c542d2d751358051e077dcd375539552039e3365bd4bacc77f0149edcd9f02518896e71889ef8ce38fbb3b89ff1b97ad128099b398a9e5b1ad171b482ef8a84bd78bca454009dd59bddf9c86616050df5e9c9db435a3d4c6d61e9a8ca8f50cb51110faea66ed69a35b54444c0efffef4d0b27b7d184081977eabe2b11ad4d75a1ee99a53", @ANYRES16=r5], 0x2}, 0x1, 0x0, 0x0, 0x80}, 0x20008010) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8804}, 0xc, &(0x7f0000000180)={&(0x7f0000000300)={0x2d4, r5, 0x10, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0xe0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb811}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x85}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x95b}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x4, @rand_addr="30fa0f92e3c3784394d31ba0b80d1fac", 0xbe6}}, {0x14, 0x2, @in={0x2, 0x4e23, @local}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x8, @mcast1, 0xfff}}, {0x14, 0x2, @in={0x2, 0x4e21, @local}}}}]}, @TIPC_NLA_MEDIA={0x64, 0x5, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffe1}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x80000001}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}]}, @TIPC_NLA_BEARER={0x78, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x40}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x8, @loopback, 0x7}}, {0x14, 0x2, @in={0x2, 0x4e20, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x834}]}, @TIPC_NLA_LINK={0x48, 0x4, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6b2a}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_LINK={0x6c, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_SOCK={0x2c, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xc0}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8}]}]}, 0x2d4}, 0x1, 0x0, 0x0, 0x402c084}, 0xd0) 03:44:18 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f00000000c0)) sendmsg$nl_netfilter(r1, &(0x7f0000d65000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="1400000003893d2a01ffff000000000000000008000000"], 0x14}}, 0x0) 03:44:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) r4 = accept4$packet(0xffffffffffffffff, &(0x7f0000000700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000280)=0x14, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0xd8, 0x0, &(0x7f0000000440)=[@transaction={0x40406300, {0x3b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000180)={@fda={0x66646185, 0x4, 0x1, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/7, 0x7, 0x1, 0x3a}, @fda={0x66646185, 0x6, 0x2, 0x18}}, &(0x7f0000000200)={0x0, 0x20, 0x48}}}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x1, &(0x7f0000000300)=""/112, 0x70, 0x0, 0x12}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done, @free_buffer, @clear_death={0x400c630f, 0x3}, @acquire_done={0x40106309, 0x2}, @dead_binder_done], 0xc0, 0x0, &(0x7f0000000540)="bf391120ec23b152ff41c59251dd6c89867597bcd51e7ac2dad6ee309e67a0a2e20499b1c95074b78bc5498070bbdab5205aeebc28feb2ab975ecbeda7aa50fe35dde7a4176af7888a39e0a6642a30364f7cf0018e0039e0710ce51fee65e1f1bf43bf2125d04fde0ad96e0f2dba51537faa0dcd1515b9486548ab842e38f21b804868c2c354f0fe7aa22e7c53fa3f37e93b94642e199b93db30ba5006c07d912302b132748a67f24fe7e47d3cf010da4573e2d68d8575cb7ecc214023e8bb3b"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) r6 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r6) ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000000680)={0x1, &(0x7f0000000640)=[{0x2, 0x6, 0x6, 0x400}]}) [ 2268.793494] binder: 29132:29138 got transaction with invalid offset (0, min 0 max 0) or object. [ 2268.822105] binder: 29132:29138 transaction failed 29201/-22, size 0-24 line 3379 03:44:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000b0b000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f00000fd000/0x2000)=nil) signalfd4(r1, &(0x7f0000000200)={0x4}, 0x8, 0x800) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getsockname$unix(0xffffffffffffffff, &(0x7f0000000180), &(0x7f0000000000)=0x6e) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000021000000000000000000000000000080f4f3dca0a51ea01800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r5 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r5) ioctl$SNDRV_TIMER_IOCTL_GINFO(r5, 0xc0f85403, &(0x7f0000000300)={{0x1, 0x0, 0x47, 0x0, 0x6}, 0x412, 0x1, 'id0\x00', 'timer1\x00', 0x0, 0x4, 0x5, 0x9, 0x3}) 03:44:18 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe828d371") accept4(r0, 0x0, 0x0, 0x80000) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000080)=""/98, 0x62, 0x80001000, 0x0, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x7f, 0x6, 0x2, 0xa3, 0x0, 0x2, 0x49ad29485bb15188, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x3, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x10001, 0x4, @perf_config_ext={0x1, 0x800}, 0x6469c, 0x3, 0x0, 0x0, 0x3, 0x401}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000000c0)=0xfffffffe, 0x4) bind$inet(r3, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x27) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000080)=0xda9, 0x4) sendto$inet(r3, &(0x7f00000012c0)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba", 0x652b, 0xc, 0x0, 0x27) ioctl$TIOCGISO7816(r2, 0x80285442, &(0x7f0000000100)) shutdown(r0, 0x0) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000240)='fou\x00') sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r4, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e20}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x5}, @FOU_ATTR_PEER_V6={0x14, 0x9, @loopback}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x10) creat(&(0x7f0000000380)='./file0\x00', 0x14a) [ 2268.850454] binder: undelivered TRANSACTION_ERROR: 29201 03:44:18 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0xb8, 0x4000000000003, 0x1, 0xffffffffffffffff, 0x0, 0x0, {0x3, 0x0, 0x4}, [@typed={0x34, 0x3a, @binary="b970082f787b7a1c6a6de2abc9b65c12b5561f322efd7d49140e76d114e3c78dab564d1db719240d91ff9a0edd87"}, @generic="94e01069434e3391f8167f1249e378b023f202bed7dc59e554b1a7ff2208a8e7d4a408301d764f9999814c77291ee680fe57514ebb664f78e2f2dfcd1a0694291a2a4658193f0dc6ce53d5f464363db22331a341daa7f3a58097acd5f8c2474805e92038a03621a3ac36c97a36"]}, 0xb8}}, 0x0) [ 2268.931247] binder: 29151:29156 got transaction to invalid handle [ 2268.971051] binder: 29151:29156 transaction failed 29201/-22, size 104-24 line 3138 03:44:18 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2c000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext}, r1, 0x0, 0xffffffffffffffff, 0x0) r2 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="9e", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r2, 0x0) keyctl$get_security(0x11, r2, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000100)='id_resolver\x00', &(0x7f0000000140)=@builtin='builtin_trusted\x00') r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e14}) [ 2268.990890] binder: 29151:29167 got transaction with invalid offset (0, min 0 max 0) or object. [ 2268.990919] binder: 29151:29167 transaction failed 29201/-22, size 0-24 line 3379 03:44:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x200000, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000180)=r5, 0x4) r6 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r6) ioctl$LOOP_GET_STATUS64(r6, 0x4c05, &(0x7f0000000300)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000001800"/60, @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000ea5400000055936ec229af63d92d215bd396664a000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 2269.098882] netlink: 112 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2269.154037] binder: undelivered TRANSACTION_ERROR: 29201 03:44:19 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$addseals(0xffffffffffffffff, 0x409, 0x1) sendmsg$nl_netfilter(r1, &(0x7f0000d65000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000022c0)={0x14, 0x4000000000003, 0x1, 0xffffffffffffffff, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) 03:44:19 executing program 2: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x4000, 0x0) write$P9_RVERSION(r0, &(0x7f00000000c0)={0x15, 0x65, 0xffff, 0x100, 0x8, '9P2000.u'}, 0x15) perf_event_open(&(0x7f000001d000)={0x1, 0xfffffdd9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) [ 2269.256268] binder: 29181:29184 got transaction with invalid offset (0, min 0 max 0) or object. [ 2269.282720] binder: 29181:29184 transaction failed 29201/-22, size 0-24 line 3379 [ 2269.312534] binder: undelivered TRANSACTION_ERROR: 29201 03:44:19 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f00000011c0)={r1, &(0x7f00000000c0)="6fb921bf49214966d97694ff09a7906b070345ca233a306aae6a578b715e0b5f87f17ee4d38dc6c3ab56b50db73432bffd90f714dcf21c92b18576c36e192e26fbfa5811749bdfbab8cfd749d99fa841e8e5b1c36ba735771ad3b48c83419fa31b0d65cabdf67a9d187f679d6fd91a9814b054b195bd22e7495b929ae4dd28df5efe7ef5fc50ab2c934348c276eb6c8a06b2090f8d8a035aab6650617df9d7aae1b3426fbaa0af57b7acb4a2aa6c714b74a6ff2ba9695c8aa69a07a99cb217f94a5ff3c2186ed9bbd25dcf89e50016dae44886c9ac504883c422821db5ee00f54b43338c57781632bc88bd00ba1aac9ff971552f239a748315ee550ea4076894849226a8d2f0605d4c4bd952102c6fd242c46f1e08a97241cb9b40d7145bcd40d1351bf16d1e272a1844085521f0203bacb34c54b5b802cb770c7862910a98d60da74a2731c91165940d39946a517f3d5475d1e0c8b9073d5741bd8ba49131106ba5d80323bcb92c7e90cd0cf54aac2fa17cc5c79bc2c9f26d6f1a3afddcf1f7006f5e5e6b67d870d58aed0522018beb65c9a09b71de03d8814a64c80cab98ed1dda07d606854a69dcacadacebc0042fe70dcb0d5ed3f02dbbe59e70b4bb899e1da840627b1ea0067631dc376c0a77e3de804cb18f010f6bcc66be94a5d0324112d761b982a1aecf6fdfd08ef7abc90b6c4e804462767c48103aaf0aae7d6ecf3e76c79b29b07412c9de1c5ff5a862092a00b2beb5ae6278826ab5b23514233a309cf8a5f5e4963f884f8733f65b16d58e0544f1d8537247c5fb2af5e617dad08f623c7554f5de4ccdd07515694f15ed8787ceae701828af28b565a59ee61beff776351b011120e1b4ec41c73234fc3914b170fc3d54276796d61c3e6b01a934212061995462867549237cd16f309bef88f7833a5087fa8af64c4e5c1f502786e5bedb15375098bca858933e68b5ec80d3ce9d727d3bfc643c913830ee8a641f3d4dd78904d97109ad22820d4ace539e4e7159d6209e06ea6208ccc01494ead6e15c7649023b2ea3af15283580115a38f31be6ee4486fb5a36c0404e87ce56abbeaebe3ae411ce34f4c5dc59761fc8e2763da27104853a1badd088b9110da1ac681ec3ca2d8e6a34d651f49ab24cef0782b665a5f53e685a620b6d3c22f7516119c1919c69ef852ed083fce40f92b7d341e4915f0fc879f43b22df191cd2e39980ad30a09ed07575fa020776d10db85db467943dc57452eb7cf4c35623ff75cd6e2fa3dd1b657e3fac9e2c3d2f8b3d56e76d751651562efe82c2850edc0706a997d21fb50461ec8f972fe0b8ad9f8d7cfcb79ea3cf3e8df0fe65e338cf9ac55826abd2c12f37677bf5099d2d7a9bb9059b0314734bcdcbde78c75c80ea3bc5530eacd0c43df90fdc744f0eeec29f7f509f82f7e7270513afed14dd34e118fe7712fbf1ec748eefd806e36d2b0e8bfe3eb889bc1d0ed53f89199336911400bde58bb7a01e8fa58cb04c8908f4c489f07f2db5d053cc3cfa379a95e6996be48d01dee470e847a40dd83a339964e8ec02bdb09905f413e63896697f8daa617e62f54a0980bb0f84db43d35781d5c27fdb0e9a326be54f0048f7e0b0b53d8bf448e8f9ad0c8a225bb4db3a0428b9b239d503d2b2207c318dad443bd6931255095cccb923e2c90c30a2fbcff8d7ef5df2f48d3065808fcd2d111544fdd57f9ec88f85f232d2a0b5ef2042dc3f2d156cccd3da0a97a81016569efe511148092e23cfda26fc9c68d5d2431501f499ccb0862a4d4b91e7214c38830628c2ab2e3fe926650e7b982f38c0c1bb07815246e9cd99d246b06e6f2870f32b693f145bb672ab3b8b8f12c0f67fdeedac9ca1805f689e0b57e58dc0bd968feeb9194a1c88ae5fd2dca4ffd28efadfa94cc3ca66aac51c801cc5d3b46e43fe44987a8121333f97c06c6ed4ea06e11b2d5b45d903c92a61d833ed7a8541499f89145b1193e2632b442c5dfc9974b9351e49d44a67897afcca9e5f5202c88bb616e7a8414bb1039aeec4644f8a6bb6bb7dc737baa3a40cdc9eb04a83f2928624de1dae12f4c1408b743a61051f6042a20b184b73a78c572644ec876f971507da9c37a0955015e1994209ad75c37595964b9c7d4e77946b7ab7489b12eebe04d0c5d7860275d3b72fc1206b47eb8339c71a36087b59cdcd66221dad1e676ec5b1bf21eab922e0af26c07e18729da790ece835076d8ef67078463f9f035e8ec25d57b4091d8bbc25bcacb827aacab9cc72043ec7080cbb08ffff55d38b27d7a2a9cdbe2af8ab7fa93d2f7b0eb247435e1b052805a690ad327d504a298be2c0456a35c092d7ee038710ec90d40b0a2acefaeb131c50d51cd3e359f9fcb0c9d56ff0d0b32f6eb64c167bdbae0f489aa7d663f049800c2a37b3c14b87ca586271a44d24fd54e21c21070227a7300692766dc9f7359f83d4739c4f26a7a6475520a83a82bbcd89fe9cd53f20f1f91192f3c9e315a15f59478aeae46cf52a29a65022d9d221308fa480f13833da2a641f1e61ffa0bdae766068c8456026a0fb1418944e0b170b8719215d525854ef4ed4568e088eff4f0026eeb4893057262988f4468e3df97d109bb2c54b9e42db07d931d2d75f4b4ed5ce12e673073e9f49f6033dd29ac6eaf547f6e26d0e7aed03c3e7995db04f1070e279187c83dfe97edab8368985443c615c02586d08df5dea81619f3316d261123656a29267d21d94c8a0b9bcb4055e39d9847ca6bffdf8ce3fc3b5193d937e96197b699798a082c3b6dda61bfc6bcaa14069cf742eb95bb55e438dd1a96ad658ab4683e0351421b647dc15f7de53463266389fe17b84a440bc0f55c7845706341278989fde8044fcda1daadfcabde2aa0a4b24d8a9d144b5955d0c9fa00adcd334b05d8fe87e5d1cf7a5433f1d4ecfa237a1f33d7fc22cc05b57bba066578ab2147048a23ee0c48763db312b3f2e95a0150888f693ddcce99e1d8b912bba48f4a5072c7c933a55cac6dd0297aee64ec4a98541a89373858bcc30ca5709a34243c3155c048abb9955718999597f9b083251929fd8fa9c5187256aa41fbf8db1cb57cc7b9eada7e3bc7844bff6e71fefedce5b124f4a8f7ce84e9513bdfb7b0d6af5e1837bfc938920a6e16c83d7678c2915c3b89812a752ca0614f8ab4302115a4e72e61fbf57453d75a4aec3923b41c55c32566f7009202be015d6010afba41b4f391cf8db78356d162bff257ab4c6bc8029f4744eedc8dea3b0819b294bca0ce2be0c70607429a62739aa309df5ecf9f53bb384361984f092656e3b75bdd2a416d4f01ae5260981e004923e5b34e0894ee9b0689338f2577b2cbf46cc9f88dc2affedf5ebbe067239c1f65eb35b4aed7497406057bd9e74e928dca2555d5cae2c71caa2cf346e9aa3607fd56e142b5b652067b5597a096dabff922759cf9c2f21051bcf3020c5d97b6bf9e2193c9e4d7d1d1719e188afbced4b1b1e4236f5bdffb5ce1a8dead873eb8b68ad84e5705561d74f91f5e9974d07403f1dd2e8d76ea22e3f3c77fc262d833d9e7eef80636e5da6e0efff1c41c79f15d7c495f44e781cfec5be428e9ee8cc9ad28b0668347d9fcbe0dcf5d4477430cb453db9f94adf38eac08d14d0b07fbb49cb7d06f3ec0b76b1333a2abc2988e9b40b539b734d983f781ce89958cfcbcca75c4d8ebcef38dcb5b56c9e8966c69036cb16956268f201e7898ee8d834cc74260c8a04af4a93274fd896c630739cd0456197688f2f7e9ed12628deb5d9951a2c68faf125ff934f20af4a65fbf4c9f25f00e52cf9c740ccadc3a6951e026d49dc2bd155ee70b237a9fbafacfc0964f707fd249d62314455aa9aaa5337537699efe2c90490fa9e42415e628d1375a5a3b5e37151c629346abedcda4d8f3f08d6a19abeb9db1b2801420739d8c9834b98285d5e0ba14cbb3ad9458d97e2d8ba0b5e0bbfe484e11dd42f4d104dbe76ed7edf58cd0614d3295f2346dc6f7ef4ed559d4f1da4462260a3f182d235679bb794b4f50f7f184e3b7d5dd1f2926ffa9f2c97779d8fdd39a9cb96e88cf2b984b0e1a3a8674833d83e72f8ad90e4d3f67df2905c46ca5b1fe91bf65bd87bb1b6d77df6c135d5cfbc2c5134bf390bf0d69ad57a76fe8c548825ba51565c4262a56cfa8867deb7c3c91668403a94716f7dd4cd849d5c1a0d82162a7c1656de88757d990823f770ddca9ab2249ee76db36f4326ed65b080e74fa6db950af267f2ac3c9f76923826603f26100de42d96fcae1905228b52857c228e55d273355557fcea0868c9f38e550a3c2e1d1137599ea3ffb7910a769ba9eecad952f22716479ec605267c4df5d942e1d2a349dbfa26316179e68dddb377693500afb53cc607cbfc2e94ba21057cb4c58ee22dface5b941ef53332e590e386ace25e4cd00ed43799b4045c0d92dd5655a890542a1a91a2504bb32eafcf7cb1780a52d4a3642c48264837cd153f153b58d3dc8470a82c3072214973c829c2da32de846fe9f53478c04fe1ce1272d9edc89ed639efb4112e711357d6f69aa7fca5cb1dacd91dd8350e0b999b32bf820084fdb30bff2e1355eaa3a59327a7ba70f2ea8abb6517e14f3f888784cd3fb065ed7801bde9a74188c6690770835e26f48f46bf5749298bc5a0780608b84b4cbdef3c1878095457c445c7333a1ee1fe0842e629ccbe3463039a06b4b6a7d8ccee447473fc465e69bd37b6e8f081deef7884233005d7ef6fcbd5175d57dea4dcabd4f3dc8a02cb050fa29dc85374fd20a4b507951c06c352a72c4652913e86dc9fc18528ece3b2e78f43f8c0c3419173fa2a84f5a1a2e9917f2030a38134c3a3a6119b502e4421591a9dc39854715b6275df4956aeb9d744e4c4261659f3e178fe588faf760159efd4a458c77f5df0ab83b85e87632ca838c21014bcbe1e2973e66e9d78ae91ac1355279e67df658edf6c1c7b598b86b0e5ead2e065db68f764e7c227aac3c655ee7c25baff851122c8d5203ece5e004c4dad834fd0e62847273c5ccf8054c8b8a6609325156322c5ce62e76b526e5792c9d55e4eea2babfcac99ba6685113a72a3a629886c65368f2773c9d97f6664390ba65cae482117e11e158892085e9bd39d88d1f8a2afdd5bc66b00a66712e05ac7f0180b66bce1ca085dd2d319cc76a566515fbe50c82ce874a67813784f022a51ad956a750eb81bd355cccdced09bc91bf2f806be8135ac2dd8a7c0508df54bed5548327eba59ee102703c177507d146b62d9f759fbe9d76724e0b6dc7f85d6918989a8b5d4113a46012b49b3b17dbd4b890dc3436b8e9bdbebf0c1711b13bdf53a9e5f6c7d1e7aca3740f8ffc934b3e0570c1c542e042bd196c5479694b9fbcdafcb068811f8eb109173f678be12117abfc1da25c780d043cd07797b5972a0eeb46b2dc04823a5c553609b77519d6ae7b37904e112d3666d9f834422ea291bc2e32fb00d3aa5e6f515ebca97690ea5c2d10f641fcc7f3dd6ad5c48e9518727993e01d8005afb2a19b6a7181f7166381e0db74c46859ddfd24a43fc9fd801d9a801581374f8a1f9d6b81bec0fbfae6ce888647e5af6eca8935878fdd2a5bf0b95f009555e9d25115701cc844b5358fa5a90f21185f3b77a93c62f98de7d14cfbc98a82c899782c67628a909a2bf326c66d481496cf6668434708521ea569b0e3c6bbab145772e3142ec8741f0b63d6cd792fe36b3ded880efa98196a6b9a07997a57e2375470f7c29292674bd98eea8cf72079385e601a36fc8effa59a5674b", &(0x7f00000010c0)=""/212, 0x8}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:19 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet(0x2, 0x803, 0x40) ioctl(r1, 0x3, &(0x7f0000000000)="73b4380615df92d3d1aa766601d5ce710848c80e30957a59a1fe1bfbd110ce6493f2bc0aee51") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 03:44:19 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x31}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x8, 0x401, 0x8, 0x90, 0x2c, r1, 0x6532, [], 0x0, r0, 0x0, 0x2}, 0x3c) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xa000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, 0x0, 0x20, 0x70bd2d, 0x25dfdbff, {{}, 0x0, 0x410c, 0x0, {0xc, 0x14, 'syz0\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x80000}, 0x801) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x9, 0xffffffff80000000}) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400004e}, 0xc, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="0c010000f948c542d2d751358051e077dcd375539552039e3365bd4bacc77f0149edcd9f02518896e71889ef8ce38fbb3b89ff1b97ad128099b398a9e5b1ad171b482ef8a84bd759bddf9c86616050df5e9c9db435a3d4c6d61e9a8ca8f50cb51110faea66ed69a35b5400000efffef4d0b27b7d184081977eabe2b11ad4d75a1ee99a53", @ANYRES16=r2], 0x2}, 0x1, 0x0, 0x0, 0x80}, 0x20008010) sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40188020}, 0xc, &(0x7f0000000280)={&(0x7f0000000100)={0x160, r2, 0x20, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x52a}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xac3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_LINK={0x44, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x60, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x3, @dev={0xfe, 0x80, [], 0x29}, 0xffffff80}}}}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'bond_slave_0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'hsr0\x00'}}]}, @TIPC_NLA_NET={0x1c, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3ff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5f}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3ff}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3f}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x87}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x80}, 0x10000845) [ 2269.525656] binder: 29201:29208 got transaction with invalid offset (0, min 0 max 0) or object. [ 2269.548559] binder: 29201:29208 transaction failed 29201/-22, size 0-24 line 3379 [ 2269.569785] binder: undelivered TRANSACTION_ERROR: 29201 03:44:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='./file0\x00') ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000100"/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:19 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r2 = dup2(r0, r0) ioctl$RTC_WIE_ON(r2, 0x700f) 03:44:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000140)=0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x32, 0x1, 0x48, 0x42, 0x0, 0x0, 0x80070, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5, 0x1, @perf_bp={&(0x7f0000000080), 0x4}, 0x1002, 0x8, 0x4, 0x2, 0x0, 0x4d, 0x200}, r1, 0xd, r2, 0xa) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:19 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:19 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000800)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r3 = socket$inet6(0xa, 0x3, 0x2) r4 = socket(0xa, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000001a80)={{{@in6=@ipv4={[], [], @broadcast}, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@remote}}, &(0x7f0000001b80)=0xe8) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000280)={'lo\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xed\x1f', r5}) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000080)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, @dev={0xfe, 0x80, [], 0xc}, @empty, 0xf5d, 0x0, 0x0, 0x200, 0xc84, 0x0, r6}) fcntl$F_GET_RW_HINT(r4, 0x40b, &(0x7f0000000440)) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000002c0)={@rand_addr="77d0f304a0520c95f3561ac7c1e661b5", 0x7e, r6}) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000480)={@mcast2, @mcast1, @loopback, 0x0, 0x10001, 0x0, 0x0, 0xffffffffffffb8fa, 0x83420004, r6}) r7 = open(0x0, 0x4008040, 0x0) r8 = syz_genetlink_get_family_id$nbd(0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x42595117194974d9}, 0xc, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4600000051a0973138da93651c72e2ec3712d0c019c3c844fe823ba3a70a3922c5c687cf7cdb26b92305f8c7dc71575784352326c5a84418091cffbabfe2c24b2b2f24e5c02818a2a0cd97d5e1bad51dcf123012ab64fe7b6a24", @ANYRES16=r8, @ANYRESDEC=0x0], 0x3}, 0x1, 0x0, 0x0, 0x40091}, 0x40d8012) sendmsg$NBD_CMD_STATUS(r7, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000000}, 0x6, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, r8, 0x400, 0x70bd26, 0x25dfdbfb}, 0x14}}, 0x40801) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2c2c000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="84eddc30005c4ec60300a7260689493f7ed811130727b774ef389305dfc5b7a772b27a778d94f3e2be30d922f305ddffdad71a842f3a68b00ac76cea44dab2dd61c1796d37ac122307d1a36042109b748aeaff28b03dd37adc6da09b763119fc0fc20700000065a040dab30ca1444577808f464a9c9531fc6493a30413f6e100"/147, @ANYRES16=r8, @ANYBLOB="000200000000fddbdf25020000000c00080008000000000000000c00040001800000000000000c00030008000000000000000c00030008000000000000000c0003001f00000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x55}, 0x800) r9 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000001b00)='/selinux/enforce\x00', 0x204082, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001b40)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001c80)={&(0x7f0000000000), 0xc, &(0x7f0000001c40)={&(0x7f0000001bc0)={0x70, r8, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4}, @NBD_ATTR_SOCKETS={0x2c, 0x7, [{0x8}, {0x8, 0x1, r9}, {0x8, 0x1, r10}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7fff}, @NBD_ATTR_CLIENT_FLAGS={0xc}]}, 0x70}, 0x1, 0x0, 0x0, 0x243efde8e3e62f55}, 0x80) pipe2(&(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}, 0xc00) r12 = openat$full(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/full\x00', 0x20a03, 0x0) r13 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r13) clock_gettime(0x0, &(0x7f00000096c0)) r14 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000009740)='/selinux/mls\x00', 0x0, 0x0) r15 = socket(0x4, 0x0, 0x80) r16 = syz_open_dev$mice(&(0x7f0000009780)='/dev/input/mice\x00', 0x0, 0x80800) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f00000098c0)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x40001}, 0xc, &(0x7f0000009880)={&(0x7f00000097c0)={0xac, r8, 0x8, 0x70bd26, 0x25dfdbfc, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7f}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7}, @NBD_ATTR_SOCKETS={0x44, 0x7, [{0x8, 0x1, r11}, {0x8, 0x1, r12}, {0x8, 0x1, r13}, {0x8}, {0x8, 0x1, r14}, {0x8, 0x1, r15}, {0x8, 0x1, r16}, {0x8, 0x1, r0}]}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}]}, 0xac}, 0x1, 0x0, 0x0, 0x800}, 0x4040810) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0870240c0aa44727798400"/26) accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) r17 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r17) ioctl$VT_OPENQRY(r17, 0x5600, &(0x7f0000000040)) [ 2269.932180] binder_alloc: 29152: binder_alloc_buf size -6908902668019436392 failed, no address space [ 2269.941600] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2269.950955] binder: 29152:29157 transaction failed 29201/-28, size -6908902668019436416-24 line 3284 [ 2269.966853] binder: undelivered TRANSACTION_ERROR: 29201 03:44:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) r5 = accept$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @local}, &(0x7f0000000240)=0x10) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r9, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r10 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r10) r11 = openat$cgroup_subtree(r10, &(0x7f0000000280)='cgroup.subtree_control\x00', 0x2, 0x0) sendmsg$unix(r2, &(0x7f0000000480)={&(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000000)=[{&(0x7f0000000300)="292afda5d13ff3ac2909127357d15ce509cc8233f7f92729fe92ca2e638de6e8896d6f324683489de35ecbb56e8b93513ddbfaa36ab63af6640da3d69cc14842ab0e21433c095d596fe5958ed63b337170921ab3d11fcf021e712371a63c27d256220ae1992ae4ed0ba7a8389ffbf70963ea01db5d651d5b8c6a68deb7f228a5d92705984729924f24f7cf034a60d9c2d6bce17d1a2e24e4120ee16f384be5870b9d7172dd370331263b6ad0fc59b2e8f5f224dbb3672896ef4a5f52799073eb81f54a2762e4fd5dd47fc8794fc193415112", 0xd2}], 0x1, &(0x7f0000000400)=[@rights={{0x2c, 0x1, 0x1, [r0, r5, r6, r0, r7, r2, r8]}}, @rights={{0x18, 0x1, 0x1, [r9, r11]}}], 0x48, 0x40000}, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2270.032181] binder: 29241:29243 got transaction with invalid offset (65536, min 0 max 0) or object. 03:44:19 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$EVIOCGMTSLOTS(r2, 0x8040450a, &(0x7f00000000c0)=""/135) accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$PPPIOCSMRU1(r3, 0x40047452, &(0x7f0000000080)=0x81d4) [ 2270.044616] binder: 29231:29234 got transaction with invalid data ptr [ 2270.044653] binder: 29231:29234 transaction failed 29201/-14, size 99-24 line 3316 03:44:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0}) 03:44:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) [ 2270.045002] binder: undelivered TRANSACTION_ERROR: 29201 [ 2270.109325] binder: 29241:29251 BC_ACQUIRE_DONE node 13151 has no pending acquire request 03:44:20 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0800b5055e06cfe87b0071bfd6f3aa8b0398e6ba9d969891743416fd79815401bd204af751fbb750662c28320e3626a48863ad97c3f4bc8a59") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) [ 2270.109337] binder: 29241:29251 got reply transaction with no transaction stack [ 2270.109344] binder: 29241:29251 transaction failed 29201/-71, size 80-24 line 3046 [ 2270.164656] binder: 29255:29257 got transaction with invalid offset (0, min 0 max 0) or object. 03:44:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='./file0\x00') ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000100"/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) 03:44:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:20 executing program 0: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3b) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x6}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0xfffffffffffffffc, 0x7ff}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) [ 2270.164684] binder: 29255:29257 transaction failed 29201/-22, size 0-24 line 3379 [ 2270.165084] binder: undelivered TRANSACTION_ERROR: 29201 [ 2270.334689] binder: 29241:29243 transaction failed 29201/-22, size 0-24 line 3379 [ 2270.353802] binder: undelivered TRANSACTION_ERROR: 29201 03:44:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3b) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) get_robust_list(r0, &(0x7f0000000200)=&(0x7f00000001c0)={&(0x7f0000000100)={&(0x7f00000000c0)}, 0x0, &(0x7f0000000180)={&(0x7f0000000140)}}, &(0x7f0000000240)=0x18) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) rt_sigqueueinfo(r2, 0xc, &(0x7f0000000280)={0x21, 0x0, 0x5}) 03:44:20 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x801000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x8, 0x400700) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r6, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r7 = openat$cgroup_type(r6, &(0x7f0000000180)='cgroup.type\x00', 0x2, 0x0) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r9 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r10, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r11, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ppoll(&(0x7f00000001c0)=[{r4, 0x200}, {r5, 0x2}, {r7, 0x402}, {r8, 0x8000}, {r9, 0x10000}, {r3, 0x114}, {r10, 0x1}, {r11, 0x2a0}], 0x8, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000240)={0x9}, 0x8) splice(r2, &(0x7f0000000080), r3, &(0x7f0000000100), 0xfffffffffffffffa, 0x4) accept4(r0, 0x0, 0x0, 0x0) r12 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r12, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_FIOGETOWN(r12, 0x8903, &(0x7f0000000140)) shutdown(r0, 0x0) 03:44:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2270.411164] binder: 29287:29290 got transaction with invalid offset (0, min 0 max 0) or object. 03:44:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='./file0\x00') ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000100"/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2270.429430] binder: 29283:29288 got transaction with invalid data ptr [ 2270.429459] binder: 29283:29288 transaction failed 29201/-14, size 99-24 line 3316 03:44:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='./file0\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2270.429939] binder: undelivered TRANSACTION_ERROR: 29201 [ 2270.467403] binder: 29291:29294 got transaction with invalid offset (65536, min 0 max 0) or object. [ 2270.467428] binder: 29291:29294 transaction failed 29201/-22, size 0-24 line 3379 [ 2270.469788] binder: 29291:29294 BC_ACQUIRE_DONE node 13163 has no pending acquire request [ 2270.469796] binder: 29291:29294 got reply transaction with no transaction stack [ 2270.469804] binder: 29291:29294 transaction failed 29201/-71, size 80-24 line 3046 [ 2270.470017] binder: undelivered TRANSACTION_ERROR: 29201 03:44:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000000c0)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000007000000040000007004000070020000400100004001000088030000880300008803000004000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000c61b41d6dee2f501a68a6b30a800"/77], @ANYBLOB="00000003ac1414bb000000ff0000000054b714b433cc0000000000000000000000000000000000008001ff00ff000000000000000000000000000000000000000000000000000000000000000000000000ffffff00fe00000000000000000000002000070006002e000700057465716c300000000000000000000000626f6e645f736c6176655f300000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000500000000000000000000000f0004001000000000000000000000000000000000000000000000000000050006d616e676c65000000000000000000000000000000000000000000000000ffffffffffff00000000000000000000aaaaaaaaaa120000000000000000000000000000ac1414aa04000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f00030010000000000000000000000000000000000000000000000000000400052415445455354000000000000000000000000000000000000000000000073797a310000000000000000000000007f37000000000000020000000000000000000000ac14141bff00000000000000aaaaaaaaaa1c00000000000000000000000000000000000080007fc0ff0000000000000000000000aaaaaaaaaaaa000000000000000000000000000000000000ff00007eff000000000000000000000000060001000800090000000169706464703000000000000000000000626f6e6430000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000f0001801000000000000000000000000000000000000000000000000000028004e465155455545000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000e8000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x4c0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x4, 0x0, 0x4ac04e11}) 03:44:20 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) [ 2270.471632] binder: 29287:29299 ioctl 5411 20000000 returned -22 [ 2270.535451] binder: 29306:29308 got transaction with invalid offset (65536, min 0 max 0) or object. [ 2270.535477] binder: 29306:29308 transaction failed 29201/-22, size 0-24 line 3379 [ 2270.535673] binder: 29306:29308 BC_ACQUIRE_DONE node 13167 has no pending acquire request [ 2270.535680] binder: 29306:29308 got reply transaction with no transaction stack [ 2270.535687] binder: 29306:29308 transaction failed 29201/-71, size 80-24 line 3046 03:44:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2270.535891] binder: undelivered TRANSACTION_ERROR: 29201 [ 2270.559881] binder: 29300:29305 got transaction with invalid data ptr [ 2270.559928] binder: 29300:29305 transaction failed 29201/-14, size 99-24 line 3316 [ 2270.561101] binder: undelivered TRANSACTION_ERROR: 29201 [ 2270.638003] binder: 29313:29318 BC_ACQUIRE_DONE node 13172 has no pending acquire request [ 2270.638013] binder: 29313:29318 got reply transaction with no transaction stack [ 2270.638021] binder: 29313:29318 transaction failed 29201/-71, size 80-24 line 3046 [ 2270.675906] binder: 29314:29316 got transaction with invalid data ptr [ 2270.675934] binder: 29314:29316 transaction failed 29201/-14, size 99-24 line 3316 [ 2270.676327] binder: undelivered TRANSACTION_ERROR: 29201 03:44:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000340)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/121, 0x0, 0x1, 0x29}, @fda={0x66646185, 0x6, 0x2, 0xf}, @flat=@handle={0x73682a85, 0x1, 0x1}}, &(0x7f0000000300)}}, @dead_binder_done, @increfs_done={0x40106308, 0x3}], 0x5a5, 0x0, 0x0}) 03:44:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x3, 0x70, 0x14, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x4, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0xb, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:20 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r1, 0x0, 0x0, 0x800) shutdown(r0, 0x0) [ 2270.809747] binder: 29324:29326 got transaction with invalid data ptr [ 2270.809774] binder: 29324:29326 transaction failed 29201/-14, size 99-24 line 3316 [ 2270.810123] binder: undelivered TRANSACTION_ERROR: 29201 [ 2270.904672] binder: 29287:29290 transaction failed 29201/-22, size 0-24 line 3379 [ 2270.914756] binder: undelivered TRANSACTION_ERROR: 29201 03:44:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2270.956854] binder: 29340:29345 BC_ACQUIRE_DONE node 13177 has no pending acquire request [ 2270.973534] binder: 29348:29349 got reply transaction with no transaction stack 03:44:20 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ftruncate(r3, 0x9) fchdir(r2) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_inet_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f00000002c0)={'vcan0\x00', {0x2, 0x4e22, @loopback}}) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) timer_create(0x2, &(0x7f0000000080)={0x0, 0x20, 0x2, @tid=0xffffffffffffffff}, &(0x7f00000000c0)=0x0) timer_getoverrun(r5) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x8001, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r6, 0x40806685, &(0x7f0000000240)={0x1, 0x4ca8a0b48eb4b316, 0x1000, 0x19, &(0x7f0000000140)="eea7b95ad0c109da703a20a3acc8c2673a2d8b848095a295db", 0x54, 0x0, &(0x7f0000000180)="4d04410727acadbe5a3c5b929ffd4f0cbf3fa919b07638aa1ac517830e0a0e3d51ec043445bb4fabc8bc644ee901d79270edd76f6cd1f80af2edb251040155912f6d8892cad9157ef18510c520d1a69f6880a2d1"}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") shutdown(r8, 0x0) 03:44:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2270.987708] binder: 29338:29347 got transaction with invalid data ptr [ 2270.987735] binder: 29338:29347 transaction failed 29201/-14, size 99-24 line 3316 03:44:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2270.988523] binder: 29340:29345 got reply transaction with no transaction stack [ 2270.988531] binder: 29340:29345 transaction failed 29201/-71, size 80-24 line 3046 03:44:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2270.988534] binder: undelivered TRANSACTION_ERROR: 29201 [ 2271.097017] binder: 29362:29366 BC_ACQUIRE_DONE node 13184 has no pending acquire request [ 2271.097026] binder: 29362:29366 got reply transaction with no transaction stack [ 2271.097034] binder: 29362:29366 transaction failed 29201/-71, size 80-24 line 3046 [ 2271.108426] binder: 29358:29361 got transaction with invalid data ptr [ 2271.108455] binder: 29358:29361 transaction failed 29201/-14, size 99-24 line 3316 [ 2271.108839] binder: undelivered TRANSACTION_ERROR: 29201 [ 2271.183994] binder: 29371:29374 BC_ACQUIRE_DONE node 13187 has no pending acquire request [ 2271.184004] binder: 29371:29374 got reply transaction with no transaction stack [ 2271.184013] binder: 29371:29374 transaction failed 29201/-71, size 80-24 line 3046 [ 2271.217506] binder: 29372:29373 got transaction with invalid data ptr [ 2271.217533] binder: 29372:29373 transaction failed 29201/-14, size 99-24 line 3316 [ 2271.217859] binder: undelivered TRANSACTION_ERROR: 29201 03:44:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) r4 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f0000000180)='tunl0\x00') openat$cgroup_procs(r4, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r5 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000280)={0xffffffffffffffff}, 0xc) pwritev(r5, &(0x7f0000000640)=[{&(0x7f0000000400)='\v', 0x1}, {&(0x7f0000000440)="603a87718ed74453940196f9745b9ed211483389aa8c79a74e41d71e2f85c916c8bbaebeffac291035c6aa37fd42ebb6b526876ee75758c3cda8f126b97cbeaffddd6326da357103bc6b3044babd0683e5994dbd7b045b395356dde76c60774c6a447132667ec5fd6e2f56dd56507a1095aa4699f40f9606fe591e4203e7e998947d36ab6853ca80f2aaee6d268c5940d5ef697098379682c978187a79626d1ebe927292c3001e14589c842c1b8381f1eb3f23f4f2765353051973e42a6bf2e40736a14886f2dea7788ac036a3ea805851a3a7f2067af163a9fcf678c2ef21b697afc801a62b482a0d76cae4b7b43b41", 0xf0}, {&(0x7f0000000540)="d43732bcbf586bb480e4c1640889dad4818deaf6beb5fe0236aa151e8cc68565e4450c0788dee1de5ee4c8ea5d343593549b7b092f1dc0e95b862b8bc8004f0bb8949e26ee3799735bf34180e0b31172d4260980ccc7a4c9f7fad12d7643f2e55afe3ea2552b404c4f4f08c0ca08925600cab4e74436d7f14b127d5951eeb92fed8132661c54cf1a093eca805c1412bc65e6ba0d6865b980e822c5d781415b3d451164b829fc2fb21701a45a9faa79b8a9c860a8a4674f36392be7ffb2b26a33e8", 0xc1}], 0x3, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r4, 0x29, 0x41, &(0x7f0000000300)=ANY=[@ANYBLOB="6d536e676c65000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d23b31cd07bccb332b06e3efd891c62df6297ff61fb45a34d496e8cb585c07dd2a36c1de8f73817a7347d27462613a0e35c69d74de4503b0a4c2739a7f6278f85cb0c7c108"], 0x68) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_inet_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000000)={'ifb0\x00', {0x2, 0x4e24, @multicast2}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="00006a3b0ea7d49b"], 0x0, 0x0, 0x0}) 03:44:21 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x15800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2100000}, 0xc, &(0x7f0000000100)={0x0}}, 0x20020) r2 = eventfd(0x3) sendfile(r2, r0, &(0x7f0000000180), 0xffffffffffffffc0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:21 executing program 2: syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x4, 0x1fd}) [ 2271.272412] binder: 29379:29380 BC_ACQUIRE_DONE node 13191 has no pending acquire request [ 2271.272421] binder: 29379:29380 got reply transaction with no transaction stack [ 2271.272429] binder: 29379:29380 transaction failed 29201/-71, size 80-24 line 3046 [ 2271.436721] binder: 29348:29349 transaction failed 29201/-71, size 0-0 line 3046 [ 2271.445610] binder: 29348:29349 ioctl c0306201 20000000 returned -14 [ 2271.454662] binder: undelivered TRANSACTION_ERROR: 29201 03:44:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2271.485014] binder: 29390:29392 BC_ACQUIRE_DONE node 13193 has no pending acquire request [ 2271.495108] binder: 29390:29392 got reply transaction with no transaction stack [ 2271.516932] binder: 29393:29395 got transaction with invalid data ptr 03:44:21 executing program 2: r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$sock_inet6_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000080)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x10, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x2}, 0x1010a}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) [ 2271.516960] binder: 29393:29395 transaction failed 29201/-14, size 99-24 line 3316 [ 2271.517363] binder: undelivered TRANSACTION_ERROR: 29201 [ 2271.594469] binder: 29390:29392 transaction failed 29201/-71, size 80-24 line 3046 [ 2271.606125] binder_alloc: 29399: binder_alloc_buf size -7217960623199879144 failed, no address space [ 2271.606135] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2271.606156] binder: 29399:29414 transaction failed 29201/-28, size 0-24 line 3284 [ 2271.626252] binder: undelivered TRANSACTION_ERROR: 29201 [ 2271.626634] binder: 29405:29409 got transaction with invalid data ptr [ 2271.626661] binder: 29405:29409 transaction failed 29201/-14, size 99-24 line 3316 [ 2271.626949] binder: undelivered TRANSACTION_ERROR: 29201 03:44:21 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) sendto$inet6(r2, &(0x7f0000000080)="0e904efa52b3a897456e8f04bb5371bd2768134a9adebb09443b04be266a1302d8a6cd4de48291eebe3a292bfffdd98505581e19dc2870c4647a23115785185b2b84061669538954acecf5b2d42fb8595846a6683e50c4f5bc9d0b8dfc79765d9334235d6f12975a236352c6b9af5fb3fe6d495c6957fe54d0628543063d3af09cd86003065af999ac7da2bc8ffe2a54c32148447073f8d428b812a463eada6ab5561511918d9f071e67340316af52fac623a8cbb4284fa2141bd6f452e7af8061cb1536b45a04781b48e6ef9f5f91d8ef10eb874d99ef71d2933c38c3f40e45da7a12b490ee6dc105d5bf39f8fb85c2e0210ce5a2d38524ed6993c6e9", 0xfd, 0x20000080, &(0x7f0000000000)={0xa, 0x4e22, 0x2, @local, 0x3}, 0x1c) 03:44:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3b) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) perf_event_open(&(0x7f00000000c0)={0x4, 0x70, 0x4, 0x1, 0x1, 0x20, 0x0, 0x2, 0x2000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x6, 0x7, @perf_bp={&(0x7f0000000080)}, 0x8300, 0xffff, 0x2, 0x8, 0x1, 0x5, 0xfff9}, r0, 0xd, r1, 0xb4f7600c9286e6c2) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x8000000000000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x41, 0x0) syz_open_pts(r2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:21 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x6f, &(0x7f0000000140)=0x840, 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f0000000500)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000240)={0x264, r2, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x4c, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x800}]}, @TIPC_NLA_NET={0x30, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xf55}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfa}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_NET={0x50, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfffffffffffffffb}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x40}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x22b}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1ff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x800}]}, @TIPC_NLA_LINK={0x84, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NET={0x14, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x917}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xea}]}, @TIPC_NLA_MEDIA={0xa8, 0x5, [@TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc42}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7d4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xba9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xeff8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x567}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb4}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc0}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5a86d764}]}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7ff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x377273d3}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x80}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x10001}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}]}]}, 0x264}, 0x1, 0x0, 0x0, 0x20000001}, 0x951d7a85b87641c1) ioctl$TIOCGDEV(r1, 0x80045432, &(0x7f00000000c0)) socket$inet(0x2, 0x0, 0x0) 03:44:21 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x180a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x6}}, r1, 0x0, 0xffffffffffffffff, 0x8) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2271.910422] binder: 29436:29438 got transaction with invalid offset (0, min 0 max 0) or object. 03:44:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2271.925239] binder: 29440:29441 BC_ACQUIRE_DONE node 13203 has no pending acquire request [ 2271.925249] binder: 29440:29441 got reply transaction with no transaction stack 03:44:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2271.925257] binder: 29440:29441 transaction failed 29201/-71, size 80-24 line 3046 [ 2271.964479] binder: 29432:29443 got transaction with invalid data ptr 03:44:21 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000080)=@ax25={{0x3, @netrom}, [@default, @netrom, @netrom, @default, @default, @netrom]}, &(0x7f0000000000)=0x80, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 03:44:21 executing program 2: perf_event_open(&(0x7f0000000100)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) [ 2271.964510] binder: 29432:29443 transaction failed 29201/-14, size 99-24 line 3316 [ 2271.964801] binder: undelivered TRANSACTION_ERROR: 29201 03:44:22 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2272.000394] binder: 29449:29453 BC_ACQUIRE_DONE node 13207 has no pending acquire request [ 2272.000404] binder: 29449:29453 got reply transaction with no transaction stack 03:44:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2272.000412] binder: 29449:29453 transaction failed 29201/-71, size 80-24 line 3046 [ 2272.067100] binder: 29456:29458 got transaction with invalid data ptr [ 2272.067127] binder: 29456:29458 transaction failed 29201/-14, size 99-24 line 3316 [ 2272.067386] binder: undelivered TRANSACTION_ERROR: 29201 [ 2272.117596] binder: 29465:29467 BC_ACQUIRE_DONE node 13211 has no pending acquire request [ 2272.117609] binder: 29465:29467 got reply transaction with no transaction stack [ 2272.117618] binder: 29465:29467 transaction failed 29201/-71, size 80-24 line 3046 03:44:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$binderN(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x800) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x7, 0x81) ioctl$RTC_WKALM_RD(r4, 0x80287010, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)={0x3d3}}}], 0x0, 0x0, 0x0}) 03:44:22 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x41c00) shutdown(r0, 0x0) prctl$PR_GET_SECUREBITS(0x1b) 03:44:22 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/udplite\x00') r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) perf_event_open$cgroup(&(0x7f00000000c0)={0xdcffaa42429877ea, 0x70, 0x1, 0x7, 0x1, 0x3, 0x0, 0x4, 0x10000, 0x4, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x6, 0x3, @perf_bp={&(0x7f0000000080), 0x1}, 0x0, 0x3ff, 0xda, 0x3, 0x9, 0x9, 0x2b6}, r0, 0x7, r1, 0x7) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fstat(r2, &(0x7f0000000240)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r3, 0x400454ce, r5) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r7 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r6, 0x400454ce, r8) getgroups(0x6, &(0x7f0000000140)=[r5, 0xee00, 0x0, 0xee01, r8, 0xee01]) r9 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0), &(0x7f00000002c0)=0xc) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r11, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fstat(r11, &(0x7f0000000300)) r12 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r12, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) 03:44:22 executing program 0: r0 = open(&(0x7f0000000180)='./file0\x00', 0x40, 0x20) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x8}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x6, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000100)) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f00000000c0)) fcntl$notify(r0, 0x402, 0x0) socket$inet(0x2, 0x0, 0x0) [ 2272.207637] binder: 29477:29480 BC_ACQUIRE_DONE node 13214 has no pending acquire request [ 2272.207646] binder: 29477:29480 got reply transaction with no transaction stack [ 2272.207653] binder: 29477:29480 transaction failed 29201/-71, size 80-24 line 3046 [ 2272.396476] binder: 29436:29438 transaction failed 29201/-22, size 0-24 line 3379 [ 2272.407180] binder: undelivered TRANSACTION_ERROR: 29201 03:44:22 executing program 4: write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x7f, 0x2}, 0x7) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TIOCSSERIAL(0xffffffffffffffff, 0x541f, &(0x7f00000011c0)={0x9, 0x1f, 0x800, 0x1, 0x8000, 0x0, 0x81, 0x0, 0x80, 0xca, 0x4, 0x0, 0x28, 0x3a, &(0x7f00000001c0)=""/4096, 0x8, 0x9, 0x4}) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair(0x0, 0x80004, 0x3, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000001240)={{{@in6=@mcast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@local}}, &(0x7f0000001340)=0xe8) connect$packet(r2, &(0x7f0000001380)={0x11, 0xd, r4, 0x1, 0xe1, 0x6, @random="51313c9523b5"}, 0x14) shutdown(r0, 0x0) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x80000, 0x0) ioctl$EVIOCGLED(r5, 0x80404519, &(0x7f00000000c0)=""/132) 03:44:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2272.440446] binder: 29500:29508 BC_ACQUIRE_DONE node 13217 has no pending acquire request 03:44:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='\x00\xf1\xff\x03\x00\x00\x00\x00\x00\x05\x00', 0x0, 0x1002) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) memfd_create(&(0x7f0000000340)='/dev/binder#\x00', 0x1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") epoll_create1(0x9254046b3bcf1910) r5 = dup(r4) syz_open_dev$binderN(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$EBT_SO_GET_ENTRIES(r6, 0x0, 0x81, &(0x7f0000000200)={'nat\x00', 0x0, 0x3, 0x77, [], 0x4, &(0x7f0000000000)=[{}, {}, {}, {}], &(0x7f0000000180)=""/119}, &(0x7f0000000280)=0x78) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000080)={0x77359400}, 0x10) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) [ 2272.494232] binder: 29500:29508 got reply transaction with no transaction stack [ 2272.520845] binder: 29500:29508 transaction failed 29201/-71, size 80-24 line 3046 03:44:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) [ 2272.566846] binder: 29519:29527 got transaction with invalid data ptr [ 2272.566876] binder: 29519:29527 transaction failed 29201/-14, size 99-24 line 3316 03:44:22 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$unix(0x1, 0xa6c80e8ef033a3e7, 0x0) shutdown(r3, 0x1) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000000)={0x2e0, 0x400, 0x3, 0x8, 0xffff4ddf}, 0x14) [ 2272.567053] binder: undelivered TRANSACTION_ERROR: 29201 03:44:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2272.659874] binder: 29537:29542 transaction failed 29189/-22, size 99-24 line 3138 [ 2272.660167] binder: undelivered TRANSACTION_ERROR: 29189 [ 2272.684975] binder: 29543:29545 BC_FREE_BUFFER u0000000020ffc000 no match 03:44:22 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='\x00\x00\x00\x00\x00\x00\x00\xef\xff\xa1\xd4\xf9\n', 0x0, 0x800) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x200000, 0x40) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r4) ioctl$VT_ACTIVATE(r4, 0x5606, 0xffffffffffffffee) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x7f, 0x26, &(0x7f0000000180)="2c0ead056de02e91c9e699359a6cae5d5df0c485fed44fb6268f050d452fec463e0c100c5f071632e75a17f3c24d865df7e926313e87ef5b78770946eb512ef1bde32e234fe43577c7750d7cb07f1510685cbba8750ed0ce415d5ef22726fae8bd76e5637a63a32d71338cf3b65e6a78582a0e43cbcc546d316f6c9df704f1", &(0x7f0000000000)=""/38, 0x7, 0x0, 0xe4, 0x37, &(0x7f0000000300)="5ae6bb14be15414db85ff1b824a72922db07a9ad105e966c9f0d86d11826325c66b1aef6dcd78f8d5c718966af0e7bdf859fb75691b5efa06e86e25759fc9dcb2f809be7a131f7bcea439efa3e5fe3e8867e264642d6999bc8bac44050b5b551712ef63f1ef50fb2d67152bd001eceb7b635c330fbe94ab6ac67f519478a88fc2ab3f97e4114356f5473c0a36b8d1ee68c7ffb92e2df3b1eb483ad860f7bd37a588dbc461d42c13a1eb5ed72d2f947b9e665f91322f664994d15a9cdf8b8871b1287d060f49aeb19eaf9ef45412d837f40eb117e1a1c58777087336838574d3360eb1668", &(0x7f0000000200)="472c2737c09d5785865db4ce4a6e5e0c614cda6a59c215fe9120ca26bba4a0b7baced940705c7282bcd3eadcab57a7f3ace57ae5af553a"}, 0x40) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1163484000f0000000004f7c578488746400008125ffff0000000000000000000000000000000000000000000000000000000018000000000000000000000000000000e12f8242", @ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="0000000000000000000000000000d29b4d70ac4081d7d38c65f8ad2b941fc7950e2d669139c4ec0c42ce94cb49855dddbf2956de1ebcf1963d726814c5ffbab6dc4fd2c074d3679aae"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fcntl$F_GET_RW_HINT(r5, 0x40b, &(0x7f0000000100)) 03:44:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = dup(r0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f00000001c0)={0x55, 0x36, 0x7, {0xff01, 0x7}, {0x6, 0xf3a1}, @period={0x59, 0x800, 0x6, 0x8, 0x9, {0xfffa, 0x4, 0x20, 0x9}, 0x4, &(0x7f0000000180)=[0x7, 0x8, 0x1, 0x624c]}}) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000280)={0x7, 0x40}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$EVIOCGPROP(r3, 0x80404509, &(0x7f0000000080)=""/207) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000200)={&(0x7f0000ff0000/0xe000)=nil, 0xe000}, &(0x7f0000000240)=0x10) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) [ 2272.684981] binder: 29543:29545 unknown command 0 [ 2272.684989] binder: 29543:29545 ioctl c0306201 200002c0 returned -22 [ 2272.735432] binder: 29552:29553 transaction failed 29189/-22, size 99-24 line 3138 [ 2272.735561] binder: undelivered TRANSACTION_ERROR: 29189 [ 2272.849190] binder: 29563:29565 BC_ACQUIRE_DONE node 13226 has no pending acquire request [ 2272.867208] binder: 29563:29565 got reply transaction with no transaction stack [ 2272.875016] binder: 29563:29565 transaction failed 29201/-71, size 80-24 line 3046 03:44:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xc, 0x0, &(0x7f0000000100)=[@free_buffer={0x40086303, r4}], 0xffffffffffffff3a, 0x0, 0x0}) setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x2) 03:44:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) close(0xffffffffffffffff) 03:44:22 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0xfffffe32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x80900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x0, 0x42, &(0x7f00000001c0)={'ipvs\x00'}, &(0x7f0000000200)=0x1e) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/member\x00', 0x2, 0x0) lsetxattr$security_evm(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='security.evm\x00', &(0x7f0000000180)=@sha1={0x1, "13bbb25e0724ae61f3afb40d601fb71ce68c4e5a"}, 0x15, 0x4) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") flock(r1, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2273.141864] binder: 29578:29580 BC_ACQUIRE_DONE u0000000000000000 no match [ 2273.149165] binder: 29578:29580 got reply transaction with no transaction stack [ 2273.160512] binder: 29578:29580 transaction failed 29201/-71, size 80-24 line 3046 [ 2273.169669] binder: 29576:29581 transaction failed 29189/-22, size 99-24 line 3138 03:44:23 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) r4 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/access\x00', 0x2, 0x0) readv(r4, &(0x7f00000004c0)=[{&(0x7f0000000180)=""/161, 0xa1}, {&(0x7f0000000240)=""/38, 0x26}, {&(0x7f0000000280)=""/47, 0x2f}, {&(0x7f0000000300)=""/55, 0x37}, {&(0x7f0000000340)=""/241, 0xf1}, {&(0x7f0000000440)=""/117, 0x75}], 0x6) [ 2273.170022] binder: undelivered TRANSACTION_ERROR: 29189 [ 2273.173811] binder: 29574:29583 BC_FREE_BUFFER u0000000000000000 no match [ 2273.173831] binder: 29574:29583 ioctl c0306201 200002c0 returned -14 [ 2273.225871] binder_alloc: 29586: binder_alloc_buf, no vma [ 2273.225890] binder: 29586:29590 transaction failed 29189/-3, size 99-24 line 3284 [ 2273.226288] binder: undelivered TRANSACTION_ERROR: 29189 [ 2273.271382] binder: 29591:29593 got transaction with invalid offset (0, min 0 max 0) or object. [ 2273.271426] binder: 29591:29593 transaction failed 29201/-22, size 0-24 line 3379 [ 2273.272191] binder: undelivered TRANSACTION_ERROR: 29201 03:44:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2080c0}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x0, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040802}, 0x80) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f00000001c0)=0x7b69a700, 0x4) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fchmod(r4, 0x1) 03:44:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:23 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x50, 0x0, &(0x7f0000000100)=[@enter_looper, @dead_binder_done, @release={0x40046306, 0x3}, @increfs_done={0x40106308, 0x2}, @acquire_done, @clear_death={0x400c630f, 0x2}], 0x9d, 0x0, &(0x7f0000000180)="893d2be3a8ba16db78c8c3562bbe32bffcc4dd139789903cbbcbffa3629382a97a5226d108837dfd465f46aa742afafda638a8220a4f125e82884261091fa8cc4e421bd89aae2c9eba189c86c8116bfe4617fd00a78760c56af06dd121fbcbb17b1cce52d3eaf923a0bca3b9c1d66690be2ac206b707f7e92dc1f00dff97db8b0e6e80f2e9643b69c673c07969d057b7a52ea64733feb1ebd187944006"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="45ba00010000b500000086ce783049fc1fca0d56297783b703a512d2ad9766d9a6322077019a7626e0ac7537de83665332dc5cd143e93622d297541355000000000000c467edd60984313b4a66ef40d7612b150cd3059ea240363d632b516c2ef77fd0f2dad6f9d5d34fafd34a06967e80f4e269af3eb5b1daae808a0b4a0f0143797f6a58463e8cc6e98d6434"], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x0) fchdir(r2) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}, &(0x7f0000000280)=0x10) 03:44:23 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:23 executing program 0: r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1200, 0x0, 0x3, 0x8, 0x4, 0x1}, 0x0, 0xffffffffffffffff, r0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) r2 = socket$inet(0x2, 0x0, 0x0) sendto$inet(r2, &(0x7f00000000c0)="84367380", 0x4, 0x8000, &(0x7f0000000140)={0x2, 0x4e23, @multicast2}, 0x10) 03:44:23 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) setreuid(r3, r5) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) r6 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) ioctl$TUNGETFILTER(r6, 0x801054db, &(0x7f0000000080)=""/245) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fcntl$setpipe(r7, 0x407, 0x7) ioctl$SIOCGSTAMP(r6, 0x8906, &(0x7f0000000000)) shutdown(r0, 0x0) 03:44:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2273.567079] binder: 29611:29615 BC_ACQUIRE_DONE u0000000000000000 no match [ 2273.593221] binder_alloc: 29610: binder_alloc_buf, no vma 03:44:23 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000001800"/60, @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0041d41d46c700100000000000000000e4de0cf1a0c8d73761c600000005d2426a5b6a"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:23 executing program 5: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2273.593242] binder: 29610:29620 transaction failed 29189/-3, size 99-24 line 3284 [ 2273.593568] binder: undelivered TRANSACTION_ERROR: 29189 03:44:23 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x8, &(0x7f0000000240)="0800b514457bdf2ab648dde7322571efdda8452a1b11b0b3551aba79944e4a9519c33e2c97e1a1fa6c80f74914fad43bbd77a9922560071e1956062902e537563a8e13b3552c88f5ed708fe3ad168e2ed462174f35a181bba73a030000000677379bd300023181a991e36471e5b78a86c9906501dff58212878f5c47b24770a16800af7d1434a659b8e1dbf3d6e19e5d88ce4643450b2d72986fc5aab33e8565321c541b0097e13aae215380387b0708182542a41f797e34468a4178404dd5918ba2087d323f451e29b1568964016df4dc3ff6c6fb54814201f70198ce4c953e6f23a87f7ea3b93c4824e7d6f9010bd17f97ea4d1f04aacf3195699532171b2d3852938f694fdb8b7cfc6b38ee34770fb78f86715ec5a546ca88e5a65a4c89d0a8004c679ae65bdf89eaab2837099e8073a41ab5a809a673ced2826d4a70f2d56b08f1f8c391") r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") listen(r2, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r5) ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000080)=0x0) fcntl$lock(r2, 0x6e, &(0x7f00000000c0)={0x1, 0x664429dfa3e41123, 0x81, 0x5, r6}) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000000)) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r8, 0x0, 0x0, 0x80000) shutdown(r0, 0x0) [ 2273.604466] binder: 29613:29619 BC_DEAD_BINDER_DONE 0000000000000000 not found 03:44:23 executing program 2: r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$selinux_context(r0, &(0x7f0000000080)='system_u:object_r:usbtty_device_t:s0\x00', 0x25) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000140)) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:23 executing program 1: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/policy\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xe0, r1, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2c, 0x10}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xae}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x49}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x4}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x5}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x5}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1b}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x15}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1f}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xd, 0xc1e843e151ca3b18}}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x1}, 0x28000000) r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = accept4$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, &(0x7f0000000000)=0xfffffffffffffe81, 0xc00) ioctl$sock_ifreq(r3, 0x891e, &(0x7f0000000140)={'veth0_to_team\x00', @ifru_map={0x3, 0xfff, 0x4, 0x6, 0x8, 0x8}}) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) 03:44:23 executing program 5: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2273.604478] binder: 29613:29619 Release 1 refcount change on invalid ref 3 ret -22 03:44:23 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") recvmsg(r3, &(0x7f0000000900)={&(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000100)=""/252, 0xfc}, {&(0x7f0000000200)=""/32, 0x20}, {&(0x7f0000000240)=""/222, 0xde}, {&(0x7f0000000340)=""/142, 0x8e}, {&(0x7f0000000400)=""/239, 0xef}, {&(0x7f0000000500)=""/116, 0x74}, {&(0x7f0000000580)=""/218, 0xda}, {&(0x7f0000000680)=""/49, 0x31}, {&(0x7f00000006c0)=""/192, 0xc0}], 0x9, &(0x7f0000000840)=""/187, 0xbb}, 0x4) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000000)={'veth0_to_team\x00', {0x2, 0x4e20, @multicast2}}) shutdown(r0, 0x0) [ 2273.604486] binder: 29613:29619 BC_INCREFS_DONE u0000000000000002 no match [ 2273.604493] binder: 29613:29619 BC_ACQUIRE_DONE u0000000000000000 no match 03:44:23 executing program 5: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2273.604502] binder: 29613:29619 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 2273.604826] binder_alloc: 29613: binder_alloc_buf size 50946970801453664 failed, no address space [ 2273.604832] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2273.604848] binder: 29613:29619 transaction failed 29201/-28, size 0-24 line 3284 [ 2273.624270] binder: undelivered TRANSACTION_ERROR: 29201 [ 2273.638137] binder: 29613:29624 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 2273.638149] binder: 29613:29624 Release 1 refcount change on invalid ref 3 ret -22 [ 2273.638158] binder: 29613:29624 BC_INCREFS_DONE u0000000000000002 no match [ 2273.638165] binder: 29613:29624 BC_ACQUIRE_DONE u0000000000000000 no match [ 2273.638173] binder: 29613:29624 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 2273.638366] binder_alloc: 29613: binder_alloc_buf size 50946970801453664 failed, no address space [ 2273.638386] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2273.638404] binder: 29613:29619 transaction failed 29201/-28, size 0-24 line 3284 [ 2273.640187] binder: undelivered TRANSACTION_ERROR: 29201 [ 2273.644670] binder_alloc: 29622: binder_alloc_buf, no vma [ 2273.644688] binder: 29622:29626 transaction failed 29189/-3, size 99-24 line 3284 03:44:24 executing program 1: mkdir(&(0x7f0000000500)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) chdir(&(0x7f00000001c0)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) preadv(r0, &(0x7f0000000200)=[{&(0x7f0000000140)=""/12, 0xfdad}], 0x1, 0xfebfffff) open$dir(0x0, 0x0, 0x0) open(&(0x7f0000000200)='./bus\x00', 0x14103e, 0x0) [ 2273.644923] binder: undelivered TRANSACTION_ERROR: 29189 [ 2273.756884] binder: 29636:29643 got transaction with invalid offset (1153140608568934656, min 0 max 0) or object. [ 2273.756912] binder: 29636:29643 transaction failed 29201/-22, size 0-24 line 3379 [ 2273.757116] binder: undelivered TRANSACTION_ERROR: 29201 [ 2274.097570] binder: 29611:29615 got reply transaction with no transaction stack [ 2274.105230] binder: 29611:29615 transaction failed 29201/-71, size 80-24 line 3046 03:44:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f0000000140)) ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f00000000c0)="f3c70a2a972837b242ab8974b5203c083d726d903f92ad0033d4271c29d97e2e50385c23212d67f759228c5b9f763e8e53d029e026f955f49250736fbf5123d75cd3ccd7f266a5474fac55385ab126c062b983d2880510eeda94085eb9747e544ee9ad23b3ff2fcc298ca16830919cd5f671276849087a972eb5293f") socket$inet(0x2, 0x0, 0x0) 03:44:24 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000080)={0x0, @aes128}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:24 executing program 1: 03:44:24 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:24 executing program 1: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() pselect6(0x1f, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) syz_open_procfs(0x0, &(0x7f0000000080)='children\x00') ptrace$cont(0x9, r0, 0x0, 0x0) [ 2274.239783] binder: 29683:29687 BC_ACQUIRE_DONE u0000000000000000 no match [ 2274.264022] binder: 29683:29687 got reply transaction with no transaction stack [ 2274.281834] binder: 29683:29687 transaction failed 29201/-71, size 80-24 line 3046 03:44:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:24 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2274.371137] binder: 29703:29705 BC_ACQUIRE_DONE node 13248 has no pending acquire request [ 2274.389654] binder: 29703:29705 got reply transaction with no transaction stack [ 2274.439172] binder: 29703:29705 transaction failed 29201/-71, size 80-24 line 3046 03:44:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TCGETS(r2, 0x5401, &(0x7f0000000100)) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) write$cgroup_subtree(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB='+io!+io +memory!-pids +cpu '], 0x1b) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.controllers\x00', 0x0, 0x0) ioctl$UI_SET_PHYS(r4, 0x4008556c, &(0x7f0000000180)='syz0\x00') r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FIBMAP(r5, 0x1, &(0x7f0000000140)=0xb) 03:44:24 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)='cpuset.mems\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="2cc1"], 0x2) 03:44:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:24 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000080)="ce266c1ba98d8ebeb5c97722678f661fd67b0fd9145a0faa1e6f0353c559b0efe8ffeb481182e3e01d683781f373981a76731cec149ed8c7593bf37473d1862e6a82fa99a93de5ee32253bd0561f21a96840ca345aa1ce64ba9c9cfec769738b570b9dbd5b2141a47ed857ae5b0e3606ba657e30dd6366d26524ff6c75dfca625dffac2707fb1671", 0x88) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f00000000c0)={0x0, 0x37, 0x7, 0x10, 0xa, 0x5, 0x6, 0xba}) socket$inet(0x2, 0x0, 0x0) 03:44:24 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2274.750408] binder_alloc: 29724: binder_alloc_buf, no vma [ 2274.770467] binder: 29724:29729 transaction failed 29189/-3, size 99-24 line 3284 [ 2274.793414] binder: undelivered TRANSACTION_ERROR: 29189 03:44:24 executing program 1: r0 = socket(0x40000000002, 0x3, 0x80000000002) r1 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='bridge_slave_0\x00', 0xf) sendto$unix(r1, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000004c0)) 03:44:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 03:44:24 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2274.855153] binder_alloc: 29743: binder_alloc_buf, no vma [ 2274.887362] binder: 29743:29745 transaction failed 29189/-3, size 99-24 line 3284 03:44:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) 03:44:24 executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") listen(r0, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) connect(r2, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) close(0xffffffffffffffff) [ 2274.920090] binder: undelivered TRANSACTION_ERROR: 29189 03:44:24 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:24 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2275.009544] binder_alloc: 29764: binder_alloc_buf, no vma [ 2275.042802] binder: 29764:29767 transaction failed 29189/-3, size 99-24 line 3284 [ 2275.083324] binder: undelivered TRANSACTION_ERROR: 29189 03:44:25 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:25 executing program 1: socketpair$unix(0x1, 0x100000000001, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_STATFS(r3, &(0x7f0000000180)={0x60}, 0x60) splice(r0, 0x0, r3, 0x0, 0x8ec0, 0x0) read$FUSE(r2, &(0x7f0000003340), 0x60) write$FUSE_DIRENTPLUS(r3, &(0x7f0000001740)=ANY=[@ANYBLOB='0'], 0x1) close(r1) 03:44:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2275.348054] binder: 29784:29786 transaction failed 29189/-22, size 99-24 line 3138 [ 2275.367013] binder: undelivered TRANSACTION_ERROR: 29189 [ 2275.411715] binder: 29792:29793 BC_ACQUIRE_DONE u0000000000000000 no match [ 2275.432703] binder: 29792:29793 got reply transaction with no transaction stack 03:44:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) r1 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="9e", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) socket(0xa, 0x80001, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000001240)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001280)={0x0, 0x0, 0x0}, &(0x7f00000012c0)=0xffffffffffffffb0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r7, 0x0) r8 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r8, r7, r5) r9 = add_key$keyring(&(0x7f00000011c0)='keyring\x00', &(0x7f0000001200)={'syz', 0x3}, 0x0, 0x0, r8) keyctl$instantiate_iov(0x14, r1, &(0x7f0000001180)=[{&(0x7f0000000080)="1ea28ffe770dd1f84bba5c7dbad1f7e10962e09333c939e4bb0739dd542c29d977dd87bdea5a9b84839e48c68ed13583f745a86e7fa9875385196973", 0x3c}, {&(0x7f00000000c0)="97e1ef1e00db218ffe3ce860f73c4f71b2eebf3eb4ae7f8be145af6edc52aaa4ecda23012e8fa91c3dad2ae11148738c098a27337a08d8a7f10f0af38aa62430c48aa5aad763332f6352f4637ac3d0270f90954d1b517deeb2c2edbf4c7d28d2c85eae3463ddcfcaca36dbb3be45df8c994cc388ac4de109a79f448209a51a55034e48f37c4b", 0x86}, {&(0x7f0000000180)="1d633c36768ae90ff05a4a77477af8889029e1c33795f69dabbd4ab0242067b485b50ed9e7100920e07c342367d97add19dd38e2e325060de86713308e0f4e9c46099d60209511f2a6bbafceb3abbd9be4092248d4f0adf68d62033068bfa9738bdc1f24d354ebf87ee74ffdf96d74e25d0ee671ba28158fe3c391bea7b204c0e78e2d8d0353c928cc277105467db0fd0715892abeeedc6219e7fc4607d6c45f9e9145421c420f95bb4e491cb98b0f0c8c88837c2d9fde07231bfcae469def764573949fa9aa9b912c4693177bfd2bdb3d0d3484fe3ebc36943c898a4160b3a4935b4409528bf2cefd06dc4d35fa3ec79746735ed0679dde64e51d3aea9f767d3168297dd8d21be8a5ac7f94051e2b274a3ce98c80a3273653e19c6577a80649c2c3cb6d3522d6ac88c4461ca86ae644399e8bdd10a4eb6d7fa2a3c43af243e5b9d68adaa9ce24caca2f9300fb81736f4b3d721168fbc277cd239e0622657c8574427d44f845c055ac48aed29971ce25561e76280b02a9a5909b95d7494bd54d8a88ffb1584f9f55a2f60d613ef8008479bde03ea5888fe8cb5c26e8131875fbb7649243fbb5d0e5c5f97a300f41bb7f66d86f9a6e451c8773430b3377541092abd44f124d6323d64dcb8a7b57cdf0758faee605fd2f417d804b476f390bfb67c49e0471d46ff0abf5d2f1370acc42f854023796b4f778ccf1fe346bf65138ecf27857bcd15c712806975f25139190868825f2d0a20896a68d4f84e2c834817d1caeb7ac5da7b3b8cca0fcede2655ac937820f499608ea355abc2823eb72341d20ed5cd1bc9c3d3831084ff0a6449ae22a3ce02ff4ffd17212beabdfb0300b90d38873e99c520ab3d2179be6811bee0cae5606b4d9eee26c13f7f8d2f2002554db65f75d3914228a22c5bffdb0c429ef2bc36be3d65e5d88bdb5269b708c94478e161d01d4b67b35a47a2bd993d1b35a05daac6634a9ac5e48c82ae3f0b9b4465b85fd42ef5a3e9a6ec24105a1eb376da091460a3a63f20699df8a312d5b8dd803bd3ce958c7580da4f1518eecea08037d4dc8c25fb1d20992f219f80ece2be189994554d9c38c341b3a1bedf7055ec47576f5855cb06494430246a5c20307d6f91cc49c7a3e99c3ed2167ffdff310bf8b5033b5eb19dd48f5552b3d4e950aee247b8c61d588d6e83b370a5d1d2a3acc63944c2c395a7ba11d4e4239901dc1cc4b54bab80110e7771e9152b1fddc5755ccbd14f38dc4895d956e7d138e8865b1cf79c43bd6b09b6b315913a13cd9445ff2674208012482a22dc589f9f0f4a9e3c5b59d14b1fa2927b750b5221de3fce084012886fc972e485942814e3f0f56289c821ea4acf5fe59a7f69bc454bede0b65d2ae08459900ce3604998b517739c1f6a0439f59d9b895fda740c8292ee00795e4fce172e7af236acada65a662e6c0671091c478309697030c232839c94d92b9f834b39af54aff77276e924207970999c48842e87f86b260cd7e9e73b3789784df21c2ccbcbb1a0f3590a10ada5bd45e90c10725dbc5d31ae68d350a918e5ef15c1240594d55c7e66fa200af56162d45bb511d89ab8281397c7455cb20a34af23d245cc098b774c7a2741be57f5a7403846a719b417c55fe915c5f78e8519c33dfc25a43c1e6f628597dff1471f6654d4e38ffa43f5cb3aa7cb5303e8ad7d41fa5e59213836c3be6632f66522873d068f8eac4d9074a0060f52803692d1b047ea237f8938e6212509fc98dc47912ba705d2fe71c67232293f5014a4f7a666584618419feb761754a2342b155be756f1db3e5d098ed1d539e95a46d365abceb9a1377c56d258fde602eef13e2ee10a918b63b240dd890b9c1b92c107e7975389be0cec2a5db862092eaffacf9018c7c55c0c9798924ca5f0b61c37d8c12ded821265321b8f7e458c634de9b04357217f836b1ec04e5817002025d9a050d1a8ba33a40adceee3fc68480223759d3f69c66b6da9f9a5a5ca5962fa2530ef53fe5c43639558b798971ab29cfabf583d77618c04198e21aa9212d32b69b294f3d5afa997b715920e17902edb6454d00572228d95de7a2fafb8acd38142d43aa7d408d7dec78896265df6fde08b68ccedeeb7e42dd0da92ffa936c6441066709d90521b265310b9f0951e71deff13ef95d2b1a2276361427df18c600455f94529efa704539e168c736769620e3e37d8d82596eb9b823bb6c7e36d5fbf243d2c0f9757bc6be80bd0ea7c7bd5b447e87b83a6cd9de7f289c5e7083c7d2b229dbda08226052a23b613948342ae5c669df72d345e8b3eacb524f8ee764ea5d186551c72b102dea4be24fe5f99871959fa29d16b3502c7c282d54a1a093031e95ead16b7b7c8779a65b55746bda26d0ac2e6aca9d76863e5e30504da457395fd93c84e2c8d32b019ae538e19091d03265f1407c82154bb6051cdba21bf676438166f04a49604d351e7f5a6fc22d4154faad9d1e81c5f8ef87b905b86371cc3d809fdd6a12cb419d21cf8f2522ece96456775d6e265459b10a716853b4cd9c4d2d7c15cd7cd100b489b98063c57cf6679887082207f25b0a12e9b2c7976bbe244c11999201fba5b24cb21d7ecfd69f89b6bde57a6ad2abaedbe7e1303abcbfa693f9ed1dbfcd5df87de0fdd4bba70a8308e7514925d545223a287e8de7c9ce53fdc39c5d6d595f7857f0e12eef1554fe3f0775fbdfe24b51f8247209a6b2c581131817d5b2931fee2204b375338a93b01896774dc03c460103ca25b580cd9da45cbf0c42ebc3c9a8f75615a814d836d5630fae9bdaff8418068067a9e492ee6b37730ccc20bd55f884f45ca1279b18ad9c545d8db0003aecd078dcff05f2cf9562f0ec83e3b8ff4d7a014277648d41773304775483d30cd9803b78b05354a3858ea5b5b768bfd0cb0a2a53e155a183e29a2ed338f5562fe75784b50b30fe9024aa420549b084ded393754e9237757375b01aef841044d9b35b7bacb0ea3318a5f0c096ea9b1c38ddba7bf1321758acb1e48c571838e243930ca4bf169abced6a185a864bba6b0f278b015ff42308acb1d08a46f5cc27128334c36f1804ea0898d0ff00eb77a6a1cb0f06cb39c702f74308cc5384ae9013488b8074373d063dbc8bf29f99ae12de81633c135adf66930783cf92512b9eae95fa46e5fc0dfe354f3ab5d7daab08e9d0fa5565614155278e0dd58abf1d4c397e25d995fc352abaae986dc0d9093879e04826ec48d92cc27bc3ccba89f969f75e7ecb4fe7cf9eec1ab4b7e63f27aed4a7bfb81d094223860976ce2238ccb376d5e8e6cc6fd8cce405488a781c98428b4d67b1f4783872528ad14760870ea974668c992eb20403b3f4158e85025052e2fa82eaa1ce9dd4986e1d4d2ebc3ef5ce424f22cea500b4a5da2dfa59d3e93897cd4d8c078592912485f2217d8e3d157622103ec9f660e22df9c26a1c48f172d95f3551423eefa373bf55b57a6bbe23547db2f03606f686a88a3cf5ea13510c889029885430df478a45a4dc3cc56ef33519aae1cafa23aeb990ca202d00ab8b170685dc74d41262fc7456b0b0b7bdf65ae1f46d5f0c1406d73ba725aa3c533c3b5c82d94fc887c8dad2450fbb8015503a7cab6ddc6d1577d01f3bd00fa54dc212eeb4937463bf06734f2a6253c13fabc6da272661019b318ebe7c829a43f522acfaca4588f30bf17a815aa617281cd22f5cc643b1fa6a0808b57bbdcb44400ef7ee68cf11923f457be6f88ce309d55d2b6236fb9bf42240592613d205977c0ec0d96da204244783963f0801324f2a181fee520298388323b5cec8f76b2e131ce80a975fd0016bd358dd13b2ee2d8dca2535dae1012d710748647feca01688f6000ff8a4234d5ea3378c17930e22f6959f9535e99fefedccb1a2a02a27f6307d1ac01b0ad6ee03d0608a1a1116f927bd0e4bcaf4f579be1bfacd74579b285d5ec169e7c0a6260e0b49df07fba959cd6785c6dcf7118ccec48566c5e4a96993f4d29db9bec7bcd3a87e54eecd223b44fc570d3599908261f555ae05013dffca287bc1308d87a357c3bf9c930742b7902fa0d2d45f42bd1ec59f13ef1a7f216196b37783b38b8a272c84cc823547c4ae376c75bab7b6e1302b602f9edfcc0ab7aa04eb1b5404de18a94ad0f4360bd14bf2e4a9c03912dcf02c88dfca801ecb92b66686a0467ad0abd6ae8716287f7ad7878375a4c511d5051ec86e6c99b53f7f6fc5a8207cb09f01097566b1ada9df0c56394f31c64a2301047d65877167f85a8d63ed213d6e32811152a3c41eb8650ba69f2bfee50036d130c922f4375a076c011c449d0c32e41c32da5083efc25a4bb2db745a1ec69dacb69586d4f10efb6556f8ae4f3127f0d35809294201a9175dc90e7d7e83b9eb6a8c3949751bcdcdc65c02dde9aa6da3e45e6aac5fb6b9faf6240a702e8f999ba92efe66c13e4396f4cc8c22ab2428c986f997e523aa9b95729b125ee55f20a101f74cbf9c92db9587c02620092e1a76e7a47b8a92f2a10cb67e852c117d56a00fa768c7538f7901f4f7edaeee482d1dcd6aade285e2a93b9dc2122cca5141e4d9b48b2944e16dbf88ce75eb44b558501a8005c1fb4fa28b9cabd2fca3bb70d2df5b308938b74525eecd30a6f235ea91a798448666bac192117a7bb5efb976f25537e01a9b304ccc82f4b1378acfe66b092a0eddd5e364e8d19136f7259f39a4eb6596593d23064a504bc1d3187d6b2541e443ad1ae314049105eb2d97ee2115bc85fbaa536af7da95788929875472bcbbca17545a8b15f58bd5a7ccd2df232cbedf2bdf03fbde1659b78ef130d4b5a7a7f30e06616b9710fd79926819bcb0f78d0b5f5cc9cc142e894439cc1dad1bf3497f4c3b8dbecd1f91dfcd5bb99ab07c6b3d53808ccff16b34323fb5b99920ad63ce43fbce95470a3094c9c10e31064ce26d7e9cfd05040bd1513996e056dc68115d800d5e8ca61bf6f4442fa2fb96887c7ab0a4a0c85a5a35a096ee50a899897c2a2b24bf44899117d276f0e00412dbbd2f780e078485534877011cfc6a8a22c804bef6431aab2453056955fc9ba4eb8ad1987a768b22e357973a5673d53e3bae60cb4807e60212a18a9bf39a62a16d29be49ca1e82db6e92f4f20d6b0620a2260e28c0c80ccf038135a3880f878a43ed84ed0c8bb59281f6a71945d905c33f5f982faecfc65529c9352ce80ff772625d3d7ae3f87066fd66f528e29a41ad84509734a25e73e372f898c1b750d798858083c9c1575b8b947b93bcb705273d95dbd6e9b23645cae7903ea26d455235cadc62350539112c3bd6bdb675e636fa8c467a52a147989a76a7e4b01ef500f7dd605e1c1c9f39212edb1d154d5ebc717e2df805429742d410d9bbcda86ba648a930e4f17eb439457d89048165390d21e0466b12fdf1b0bf23155aa4cb6d3d4e63d6542d03d8b0da33f2c9f0ae0a55ecbe6c8f9294ca1916bf8f2a93dd12e4a81e96dee904004c0cf1dfd2308d2985f448066d45b084df14ece80daae2c6e2f876d90629c4f115d951f7326c2e57f5f3946efb61c3f0ef9d64132c9f3fe412a9aea4f6f16dd2d510a6758b0845667b1cb347a0ea94c60c75f7035223bfd1bb566a0a4b42880c554d78ea81c1480cc294545098d7244c6d50166923608f962853fc7406b5ecad155c239f1e30d342fbf9dcbdea699770d1222ab56825d032962d8898a5d71c6d5cc724bae0b0cecb11f4415dac9aaadb6d59b20da878cee80f39ddbb8079911288ad0942187186418c54ab7774dfbf14fb437611", 0x1000}], 0x3, r9) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:25 executing program 1: [ 2275.441533] binder: 29794:29795 transaction failed 29189/-22, size 99-24 line 3138 [ 2275.442247] binder: undelivered TRANSACTION_ERROR: 29189 [ 2275.494871] binder: 29798:29800 transaction failed 29189/-22, size 99-24 line 3138 [ 2275.495155] binder: undelivered TRANSACTION_ERROR: 29189 [ 2275.576896] binder: 29792:29793 transaction failed 29201/-71, size 80-24 line 3046 03:44:25 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$tun(r2, &(0x7f0000000080)={@val={0x0, 0x7daf5b378fa12684}, @void, @llc={@snap={0x0, 0xaa, "c9", "f3f112", 0x8, "73295f39f66a82e1969741b68527f6a0f05eca051f1da851bae46e6ed1804621b95ad42d9172734d3f5d3e286dce5a920171adf989368c4cbb6aa4134bc14fa0c6b0e13c6b65ac98a6e69fcc150cb48e24aa57e1a3e4c6ecd935ebf16a1cc8c672836bda34ad8cbd3f108c75a5244a37a967e71aeac82327ed00b0ece8"}}}, 0x89) shutdown(r0, 0x0) 03:44:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:25 executing program 1: 03:44:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:25 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0xb4d0c71a4bde9a03) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:25 executing program 1: 03:44:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2275.932982] binder: 29818:29821 BC_ACQUIRE_DONE u0000000000000000 no match 03:44:25 executing program 1: 03:44:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2275.947511] binder: 29817:29823 got transaction with invalid data ptr [ 2275.947538] binder: 29817:29823 transaction failed 29201/-14, size 99-24 line 3316 03:44:25 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r2, 0xc0406619, &(0x7f0000000080)={{0x2, 0x0, @descriptor="ab423ca0be888e89"}}) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)={@multicast1, @remote}, 0xc) accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 03:44:25 executing program 1: [ 2275.947712] binder: undelivered TRANSACTION_ERROR: 29201 [ 2276.022531] binder: 29828:29829 got transaction with invalid data ptr 03:44:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2276.022562] binder: 29828:29829 transaction failed 29201/-14, size 99-24 line 3316 03:44:26 executing program 1: [ 2276.022745] binder: undelivered TRANSACTION_ERROR: 29201 [ 2276.098615] binder: 29836:29837 got transaction with invalid data ptr 03:44:26 executing program 1: [ 2276.098642] binder: 29836:29837 transaction failed 29201/-14, size 99-24 line 3316 [ 2276.098799] binder: undelivered TRANSACTION_ERROR: 29201 [ 2276.201353] binder: 29847:29850 got transaction with invalid data ptr [ 2276.201379] binder: 29847:29850 transaction failed 29201/-14, size 99-24 line 3316 03:44:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) rt_sigaction(0xc, &(0x7f00000000c0)={&(0x7f0000000000)="c4c1245ce2c4622d99ce640f2ad32e67d8e86746dfc8672e40d902660f3ace1a08f3a6c4022da79605000000c4c28d92bc1d85016e32", {0x3}, 0x0, &(0x7f0000000080)="c44255cfca6764652ed10336f040114301c4e22d8e30440fbaf714450f761bc441b5fede66c3420f2973f3c4027d0e91663e0000"}, 0x0, 0x8, &(0x7f0000000100)) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x100) epoll_pwait(r2, &(0x7f0000000180)=[{}], 0x1, 0x7fff, &(0x7f00000001c0)={0xca}, 0x8) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 03:44:26 executing program 1: 03:44:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9000000000000}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000100)={0x0, 0x0, 0xfff9, 0x59}) [ 2276.201748] binder: undelivered TRANSACTION_ERROR: 29201 [ 2276.315481] binder: 29818:29821 got reply transaction with no transaction stack [ 2276.341996] binder: 29818:29821 transaction failed 29201/-71, size 80-24 line 3046 03:44:26 executing program 1: 03:44:26 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = dup2(r0, 0xffffffffffffffff) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f00000001c0)=r2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x200, 0x11) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r4 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r4, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) accept4$inet6(r4, &(0x7f0000000080), &(0x7f00000000c0)=0x1c, 0x80000) r5 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r5) ioctl$TIOCMIWAIT(r5, 0x545c, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x80, 0x100) r7 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(r7, 0x40047440, &(0x7f0000000280)=0x86dc) openat$cgroup_procs(r7, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TUNSETFILTEREBPF(r6, 0x800454e1, &(0x7f0000000180)=r7) [ 2276.404157] binder: 29860:29868 BC_ACQUIRE_DONE u0000000000000000 no match [ 2276.414016] binder: 29861:29865 got transaction with invalid data ptr 03:44:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:26 executing program 1: [ 2276.414044] binder: 29861:29865 transaction failed 29201/-14, size 99-24 line 3316 [ 2276.414211] binder: undelivered TRANSACTION_ERROR: 29201 03:44:26 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000480)=""/245) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(r2, 0xf1a, &(0x7f00000002c0)="08cba5055e0bcf015c0071ff67f3e938f5280722be2315a404f71e0e227e8f104497013f172bd2cdefd553e040db68ae0a554dff69771d86caaa49994e93de7d26d0ecce6070dd5616e618c3f237e24c1b9bc8224ece437e0260b2cc06307a4e75a0ccf8cf60cad60869e9f1b6dedd32161fcfb0b0e2f01786f738ade66a9a2f0d4995fb2575d02b41c39089970701250a49bd71b1d66e1526345aa2311947c77ecff500004745") r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x10001, &(0x7f0000000080)="ffffff7f0bcfe87b0071") accept4(r3, 0x0, 0x0, 0x0) shutdown(r1, 0x0) 03:44:26 executing program 1: [ 2276.498419] binder: 29860:29868 got reply transaction with no transaction stack 03:44:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2276.524746] binder: 29876:29880 got transaction with invalid data ptr [ 2276.524775] binder: 29876:29880 transaction failed 29201/-14, size 99-24 line 3316 [ 2276.524948] binder: undelivered TRANSACTION_ERROR: 29201 [ 2276.609163] binder: 29860:29868 transaction failed 29201/-71, size 80-24 line 3046 03:44:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000080)={0x6, {{0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x1d}, 0x3f}}}, 0x88) accept(r0, &(0x7f0000000140)=@ipx, &(0x7f0000000000)=0x80) 03:44:26 executing program 1: 03:44:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:26 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000001780)=ANY=[@ANYBLOB="c5093d", @ANYRESHEX=r1, @ANYBLOB="2c7d6f6f746d6f64656030303030b03030303030303030303030303034303030302c757365725f69643d1f78fd66211d9abd3f5dec244bc5ac2705ad12d52309cc53289c86c5b17f82844f410b321fd7fda585faaf9039e3754009f59154aa4681c1a0b769fc8027be3056064e05f2a73f33a7433fa2cc849ad41a1970ea183ea1dfab47f1f2083f114bfe8e9571b820502039485ebb61f50d14c0c645ddcbc4f03f59cb4b1aeaec68feee739b88eee25ad1d9abf81a", @ANYRESDEC=0x0, @ANYBLOB="2c67726f75a360778497eacf86e3af705f69643d", @ANYRESDEC=0x0, @ANYBLOB='\f']) preadv(r1, &(0x7f0000000740)=[{&(0x7f0000000600)=""/164, 0xa4}], 0x1, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000280)='./file0/file0\x00', 0x0, 0x0, 0x8e56b071b577b247, 0x0) read$FUSE(r1, 0x0, 0x0) read$FUSE(r1, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000300)={0x50, 0x0, 0x1}, 0x50) truncate(&(0x7f0000000000)='./file0/file0\x00', 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000014c0)={0x0, 0x0, 0x0}, &(0x7f0000001480)=0xc) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x3b) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r5, 0x0, 0x0) r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x20, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x4}, 0x149e6, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r6, 0xc0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x0, 0x4}, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x7, 0x1, 0x2ff}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=0x100000001}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)='\x00', r7}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r3, r0, 0x0, 0x8, &(0x7f00000000c0)='group_id', r7}, 0x30) r9 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x20, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x4}, 0x149e6, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r9, 0xc0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x200000, 0x2}, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x7, 0x1, 0x2ff}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=0x100000001}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)='\x00', r10}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r5, r8, 0x0, 0x1, &(0x7f0000000180)='\x00', r10}, 0x30) getgroups(0x2, &(0x7f0000000140)=[0x0, r4]) write$FUSE_ENTRY(r1, &(0x7f0000000540)={0x90, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, {0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x85eb, 0x0, 0x0, r11}}}, 0x90) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r12, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$RTC_AIE_ON(r12, 0x7001) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) [ 2276.620936] binder: 29889:29891 got transaction with invalid data ptr [ 2276.620961] binder: 29889:29891 transaction failed 29201/-14, size 99-24 line 3316 [ 2276.621120] binder: undelivered TRANSACTION_ERROR: 29201 03:44:26 executing program 1: [ 2276.712635] binder: 29896:29901 got transaction with invalid data ptr [ 2276.720304] binder: 29900:29902 BC_ACQUIRE_DONE node 13278 has no pending acquire request [ 2276.720313] binder: 29900:29902 got reply transaction with no transaction stack [ 2276.720321] binder: 29900:29902 transaction failed 29201/-71, size 80-24 line 3046 [ 2276.789923] binder: 29896:29901 transaction failed 29201/-14, size 99-24 line 3316 [ 2276.801145] binder: undelivered TRANSACTION_ERROR: 29201 03:44:26 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/unix\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1163484000000000000001000000000000888c7f97c405d380480000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYRES64=r4], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x88810, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000, 0x0, 0x7, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0xb) close(r0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r5, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) sync() 03:44:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:26 executing program 1: 03:44:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000540)={{{@in6=@ipv4={[], [], @initdev}, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@initdev}}, &(0x7f0000000640)=0xe8) ioctl$sock_inet6_SIOCDIFADDR(r2, 0x8936, &(0x7f0000000680)={@dev={0xfe, 0x80, [], 0x25}, 0x68, r4}) 03:44:26 executing program 1: 03:44:26 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, r0, 0x0, 0x1b, &(0x7f00000000c0)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00'}, 0x30) pwrite64(r2, &(0x7f0000000140)="5313da3cb54f63410dffb0d743abfbecc4281d75", 0x14, 0x0) socket$inet(0x2, 0x0, 0x0) 03:44:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:26 executing program 1: [ 2276.959773] binder: 29914:29919 got transaction with invalid data ptr [ 2276.979904] binder: 29913:29922 BC_ACQUIRE_DONE node 13282 has no pending acquire request [ 2276.979914] binder: 29913:29922 got reply transaction with no transaction stack 03:44:26 executing program 1: 03:44:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2276.979922] binder: 29913:29922 transaction failed 29201/-71, size 80-24 line 3046 03:44:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) 03:44:26 executing program 1: 03:44:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) inotify_init1(0x100400) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) [ 2277.012847] binder_alloc: 29924: binder_alloc_buf size 137439111168 failed, no address space [ 2277.012853] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 03:44:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2277.012871] binder: 29924:29928 transaction failed 29201/-28, size 0-26624 line 3284 [ 2277.043421] binder: 29929:29932 BC_ACQUIRE_DONE node 13286 has no pending acquire request [ 2277.043432] binder: 29929:29932 got reply transaction with no transaction stack [ 2277.043440] binder: 29929:29932 transaction failed 29201/-71, size 80-24 line 3046 [ 2277.077358] binder: undelivered TRANSACTION_ERROR: 29201 [ 2277.142409] binder: 29937:29943 BC_ACQUIRE_DONE node 13288 has no pending acquire request [ 2277.142421] binder: 29937:29943 got reply transaction with no transaction stack [ 2277.142430] binder: 29937:29943 transaction failed 29201/-71, size 80-24 line 3046 [ 2277.229497] binder: 29952:29955 BC_ACQUIRE_DONE node 13290 has no pending acquire request [ 2277.229508] binder: 29952:29955 got reply transaction with no transaction stack 03:44:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0xb0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000080)=0xfff) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$PPPIOCSNPMODE(r1, 0x4008744b, &(0x7f00000000c0)={0x2f}) 03:44:27 executing program 1: [ 2277.229516] binder: 29952:29955 transaction failed 29201/-71, size 80-24 line 3046 [ 2277.316687] binder: 29914:29919 transaction failed 29201/-14, size 99-24 line 3316 [ 2277.326683] binder: undelivered TRANSACTION_ERROR: 29201 [ 2277.383905] binder: 29963:29965 got transaction with invalid data ptr [ 2277.390983] binder: 29963:29965 transaction failed 29201/-14, size 99-24 line 3316 [ 2277.400863] binder: undelivered TRANSACTION_ERROR: 29201 03:44:27 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SVE_GET_VL(0x33, 0x6655) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) sendfile(r0, 0xffffffffffffffff, &(0x7f00000000c0), 0x0) ioctl$TIOCGICOUNT(0xffffffffffffffff, 0x545d, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:27 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r2, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 03:44:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:27 executing program 1: 03:44:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0xfffffebf, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, @perf_config_ext, 0xd070ddad13926073, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0xa0802, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:27 executing program 1: 03:44:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2277.584118] binder: 29975:29978 got transaction with invalid data ptr [ 2277.592327] binder: 29973:29979 BC_ACQUIRE_DONE node 13296 has no pending acquire request 03:44:27 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_CAPBSET_DROP(0x18, 0x4) openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x20400, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r4, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r5, 0x8, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1f2}, @IPVS_CMD_ATTR_DEST={0x18, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@rand_addr="12e48c0e6d0728589139d8edb3175598"}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10001}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4081}, 0x440) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(r3, 0x100000890b, &(0x7f0000000240)="0800b505007100001e0000cc28474cf48e4c71827f01c0880b43834f6ddaed5532f237de010000009f59b778b4daba8a0f2e795c5cb98a2a59fc82980b68c095aee838210a4433ca8301ebb1a0e52529706772b52c6df6ed5d69ece9ebe28fa00ea8dee634518d3fb6789e2d7facb35f8715430e2b91a65b5de3c1ed4b11d6b445a95ac88440da94c7a7652bca58ee0a464519e9f4be200d49596880d33f144226fd7e8a38b305bf8c1a9f2472cacc81c01b08dd6c8318f487c61d40b2230d7ebc989bfdf1f4cd6ba4a55bc078a72745721504279bdc7374e890fe19fd935766f16fdf3b236d124f625d3d5c24b32c7769203a194fe6052194cce11db73ebc4f6e20accc824fbb996fc9d1") splice(r2, &(0x7f0000000000), r1, &(0x7f0000000080), 0x3f, 0x7) 03:44:27 executing program 1: 03:44:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2277.592338] binder: 29973:29979 got reply transaction with no transaction stack 03:44:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) keyctl$describe(0x6, 0x0, &(0x7f0000000080)=""/137, 0x89) [ 2277.592346] binder: 29973:29979 transaction failed 29201/-71, size 80-24 line 3046 [ 2277.667858] binder: 29988:29989 BC_ACQUIRE_DONE node 13298 has no pending acquire request [ 2277.667867] binder: 29988:29989 got reply transaction with no transaction stack [ 2277.667875] binder: 29988:29989 transaction failed 29201/-71, size 80-24 line 3046 [ 2277.745766] binder: 29999:30002 BC_ACQUIRE_DONE node 13300 has no pending acquire request [ 2277.745777] binder: 29999:30002 got reply transaction with no transaction stack 03:44:27 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$inet_buf(r0, 0x0, 0x2e, &(0x7f00000000c0)=""/121, &(0x7f0000000140)=0x79) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:27 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = open(&(0x7f0000000000)='./file0\x00', 0x400000, 0x40) syz_read_part_table(0x7, 0x1, &(0x7f0000000380)=[{&(0x7f0000000280)="fcc6aaf924421acd6bd5ad300dd3bf592db4dc89185c65b0a4d3a3d60d99fd4a37c5a5217e3501cc5e2d20135945d99f4079afd3baf4febfc4fcdd39d4c9bf7cc9b0406b0af669dcbc4f3ed56cf5ee92b00898ae9026259890fe35030332508926b443a9af31334ca8c70414e1f12afada6c4ca85c6ecd5e0beaabbe4c1634655b5d94eb8c5d889cefaa6e5a0db83fb7e77b8c36c572d650fd3941a501748ff899bce341b4446d76f42c412b82a03cc4e10a01d364abaf5f3945d3ff6ec9c03e9fed6146b042e21def31087b83310cf61c21d7c7377142cf0b7a27f41de1122c0bf51b571e1ea669ff914e98530e5b", 0xef, 0x7f}]) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000080)=0x10000, 0x4) lsetxattr$security_selinux(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:ld_so_cache_t:s0\x00', 0x23, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, &(0x7f0000000180)={0x100, 0x3, 0x0, [{0xbec, 0x4a, 0x4, 0x81, 0x0, 0x20, 0x6}, {0x1, 0x2, 0x4, 0x6, 0x7, 0x40, 0x6}, {0x9, 0x81, 0x400, 0x81, 0x5, 0x8, 0x8f}]}) 03:44:27 executing program 1: 03:44:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0xa000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:27 executing program 1: [ 2277.745785] binder: 29999:30002 transaction failed 29201/-71, size 80-24 line 3046 [ 2277.849438] binder: 29975:29978 transaction failed 29201/-14, size 99-24 line 3316 [ 2277.863838] binder: undelivered TRANSACTION_ERROR: 29201 03:44:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:27 executing program 1: [ 2277.923030] binder: 30024:30027 got transaction with invalid data ptr [ 2277.924730] binder: 30019:30022 BC_ACQUIRE_DONE node 13304 has no pending acquire request 03:44:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:27 executing program 1: [ 2277.924739] binder: 30019:30022 got reply transaction with no transaction stack [ 2277.924747] binder: 30019:30022 transaction failed 29201/-71, size 80-24 line 3046 03:44:27 executing program 1: [ 2278.004772] binder: 30036:30039 BC_ACQUIRE_DONE node 13306 has no pending acquire request [ 2278.004782] binder: 30036:30039 got reply transaction with no transaction stack [ 2278.004791] binder: 30036:30039 transaction failed 29201/-71, size 80-24 line 3046 [ 2278.077494] binder: 30045:30048 BC_ACQUIRE_DONE node 13308 has no pending acquire request [ 2278.077505] binder: 30045:30048 got reply transaction with no transaction stack [ 2278.077517] binder: 30045:30048 transaction failed 29201/-71, size 80-24 line 3046 [ 2278.221061] binder: 30024:30027 transaction failed 29201/-14, size 99-24 line 3316 [ 2278.250788] binder: undelivered TRANSACTION_ERROR: 29201 03:44:28 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x125042, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000340)={r1, &(0x7f0000000200)="be1f4a3d7944d5e26d8efd6d24ce1d644bc2f0e67ff5369d08af5ca8cdb3981721efeb76bf3da9de8a97e1a64707fb0e04564b2e291de37f2de80ea7e0bf96fd43fa2ea9cd59172ce37a2f306c3b56696094709afe2d92f84e97752e8f15e777819ee29d7f8e0c97b0339de83576045d95960e10cc4b75e2282c3c46a3dbae74aa0db1ef26ee58867349359dd61d5a34b9", &(0x7f00000002c0)=""/122}, 0x20) socket$inet(0x2, 0x0, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000180)={0x15, 0xbc, &(0x7f00000000c0)="9813f450b46206620e6f1141bea1fc3f049c418581936a05ddcd1c5b49318a1638f7ead54dad0f73fe5669fc703ee9d2fca3330c45ab9756a63e0c938a2f839bf5dfa4144c24b6b2d225ed41b0346e4003c9714d5a69bdb25930c5b2bedeb8540e8b5187f9dfccfd7da51106606df91dc462295fc73df59aa346a78bb343db50bc883e71ff02bd670d178b34f30fd514620b29af36a2abf9b51202806bbd71c7af6128914018fbe8c053461bef3487f3360b8360d9f5d6bbb5172de8"}) 03:44:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:28 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@remote, @in6=@dev}}, {{@in=@broadcast}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000000)=0xe8) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 03:44:28 executing program 1: 03:44:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x9a4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:28 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) socket$inet6(0xa, 0x5, 0xf9) setfsuid(r2) r3 = socket$inet6(0xa, 0x2, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x1, [0x0, 0x7]}, 0x2}, 0x1c) 03:44:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:28 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000480)=ANY=[@ANYBLOB="72617700000000000000000000000000000000000000000000000000000000000900000003000000c00200000000000000000000d8000000d800000000000000280200002802000028020000280200002802000003000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00'/48], @ANYBLOB="ac1414bbe000000200fffeffff0000007665746830000000000000000000000068737230000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000080000000000000000000000000000000000000000000000000000006400010800000000000000000000000000009800d80000000000000000000000000000000000000000000000000040004c4f470000000000000000000000000000000000000000000000000000000010a62682f4096d5a7c575b047f18100863e1458d78d2dff7828107641342fcac1414bbe0000002ffffffffffffffff69705f767469300000000000000000006970365f767469300000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000160000000000000000000000000000000000e80050010000000000000000000000000000000000000000000000002800727066696c746572000000000000000000000000000000000000000000000f000000000000002800727066696c74657200000000000000000000000000000000000000000000010000000000000068004354000000000000000000000000000000000000000073b20000000000021c00070008000000000000006e657462696f732d6e7300000000000073797a3100000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff0000000078ad280642a7ac669be6b282c68262cc7d3469eac1555d9ad42d705dec87d4f7dac9bfb8a8be11bc9378c2e904cabedac800e1b5cf53131faa3806621dec78122b95b553c72f621b69238b753ff98119a402b799c8a4b7f6d5cc879c6bb54a59b8508112b4ff827691a4f460badb2ed2bfc58931eba1e4f2e57e8ea7c57139c1b343799472854599f17966920a8eb381ed2c16a2c99decc2b46cae466a6a23ea7b5679e229ce27adff4b011f5811c68b2b1a8bd4d0fc8eeee8ef7a"], 0x320) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r2, 0xc0096616, &(0x7f0000000080)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) [ 2278.449877] binder: 30063:30070 got transaction with invalid data ptr [ 2278.459333] binder: 30062:30072 BC_ACQUIRE_DONE node 13312 has no pending acquire request 03:44:28 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt(r0, 0x400, 0xff, &(0x7f00000000c0)=""/4096, &(0x7f00000010c0)=0x1000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x9}, 0x10, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000080)='./file0\x00', 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) readlink(&(0x7f0000001100)='./file0\x00', &(0x7f0000001140)=""/175, 0xaf) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2278.459343] binder: 30062:30072 got reply transaction with no transaction stack [ 2278.459351] binder: 30062:30072 transaction failed 29201/-71, size 80-24 line 3046 03:44:28 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) socket$inet6(0xa, 0x5, 0xf9) setfsuid(r2) r3 = socket$inet6(0xa, 0x2, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x1, [0x0, 0x7]}, 0x2}, 0x1c) [ 2278.574023] binder: 30083:30089 BC_ACQUIRE_DONE node 13314 has no pending acquire request [ 2278.574033] binder: 30083:30089 got reply transaction with no transaction stack [ 2278.574041] binder: 30083:30089 transaction failed 29201/-71, size 80-24 line 3046 [ 2278.663312] binder: 30101:30104 BC_ACQUIRE_DONE node 13316 has no pending acquire request [ 2278.663322] binder: 30101:30104 got reply transaction with no transaction stack [ 2278.663330] binder: 30101:30104 transaction failed 29201/-71, size 80-24 line 3046 03:44:28 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) write$P9_RLCREATE(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0xf, 0x2, {{0x2, 0x3}, 0x7}}, 0x18) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r1 = socket$inet6(0xa, 0x4, 0x1) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000100)={0x400, {{0xa, 0x4e24, 0x3, @dev={0xfe, 0x80, [], 0x24}, 0xfb}}}, 0x88) 03:44:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:28 executing program 2: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x6, 0x0, 0x0, 0x5446f1fc4a7a2b28, 0x9, 0x200}, 0x20) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:28 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = accept4(r0, 0x0, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x800, 0x0) ioctl$TIOCSTI(r3, 0x5412, 0xfffffffffffffff7) shutdown(r0, 0x0) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000080), &(0x7f00000000c0)=0x4) close(r2) 03:44:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2278.752162] binder: 30063:30070 transaction failed 29201/-14, size 99-24 line 3316 [ 2278.780746] binder: undelivered TRANSACTION_ERROR: 29201 03:44:28 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000300)=@filter={'filter\x00', 0xe, 0x1, 0x64, [0x0, 0x200000c0, 0x200000f0, 0x2000023c], 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000050000000000000000000000ffffffff0100000019000000"]}, 0xdc) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1e) wait4(0x0, 0x0, 0x0, 0x0) 03:44:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:28 executing program 1: r0 = getpid() prctl$PR_SET_PTRACER(0x59616d61, r0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000240)="0900000000003639408fa3a3ba27660199783b0a82f79b32a7c8225086600a38e07d4db88a66596759e95307b680ab73e03c53555c97e8e37d01da4d44a994354a9fa3f355214eeabd24fd620b2022d5ad63b369aaffe9ce0eca95d71f2d3e60613a027fb50cbcbd92d44076d3b97247e066165ccf1032f51d36ab231f6c20d87e9167edf69776dca67d90a1b6b694d778272af1a13bf14f61b3757ccd18fb9c7b21d53478e382dcf296a23a060bfe9ac9d9cd196187d0b64c834783111c7758bf2fbc8e76401e0015625a62c197735b91d92591d04108e4a92ad8cd3d", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) [ 2278.828156] binder: 30121:30125 BC_ACQUIRE_DONE node 13318 has no pending acquire request [ 2278.842189] binder: 30123:30126 got transaction with invalid data ptr [ 2278.854077] binder: 30123:30126 transaction failed 29201/-14, size 99-24 line 3316 [ 2278.862415] binder: 30121:30125 got reply transaction with no transaction stack 03:44:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2278.862425] binder: 30121:30125 transaction failed 29201/-71, size 80-24 line 3046 [ 2278.930183] binder: undelivered TRANSACTION_ERROR: 29201 03:44:28 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r2 = openat(r1, &(0x7f0000000000)='./file0\x00', 0x840040, 0x20) listen(r2, 0x1) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)="5eb612bc48d92c6e5106bf68142074ad5244122fa9e34e7007ff088feaf1b5c71f66fed6ffcc0141eff76aa16931dc03ed305455cb8498ec872a9c610acf14df2c7443f68e6169b846da7c3de2adf544dd1fb0993cb9c50d3e60b70a6713129ef1649b2698eb47a714ba70853d30ec0646a5d4fb1c232f9da4d40ce377a016c1ca40e931bc755de3a7ac34b5840fea87578ab32076c8c98ccdf05a982cad7b7dbd4f2f5800f0a97b14b9645c9f6640a382f45bc641f3cb0b6adfa5c93281b9cb959b454d6c", 0xc5) 03:44:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x2}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2279.033579] binder: 30153:30159 got transaction with invalid data ptr [ 2279.069941] binder: 30153:30159 transaction failed 29201/-14, size 99-24 line 3316 [ 2279.092590] binder: undelivered TRANSACTION_ERROR: 29201 03:44:29 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") readahead(r2, 0x62abad94, 0xffffffff) 03:44:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 03:44:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x202, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x100, 0x0) write$FUSE_NOTIFY_DELETE(r1, &(0x7f00000000c0)={0x31, 0x6, 0x0, {0x4, 0x3, 0x8, 0x0, '\xba---proc'}}, 0x31) 03:44:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000300)=0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x40, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000380), 0x2}, 0xe000, 0x1f7, 0x0, 0x0, 0x0, 0x1c000}, r0, 0xf, 0xffffffffffffffff, 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ashmem\x00', 0x10000, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) r2 = gettid() ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) r3 = syz_open_procfs(r2, &(0x7f00000002c0)='smaps_rollup\x00') ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x400, 0xaac}) r4 = syz_open_dev$rtc(&(0x7f00000000c0)='/dev/rtc#\x00', 0x7, 0x400000) r5 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) getresuid(&(0x7f00000001c0), &(0x7f0000000200)=0x0, &(0x7f0000000240)) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x06@\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r8 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x455) ioctl$TUNSETGROUP(r7, 0x400454ce, r9) fchownat(r5, &(0x7f0000000180)='./file0\x00', r6, r9, 0x100) openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TIOCMSET(r5, 0x5418, &(0x7f0000000100)=0x9463) ioctl$RTC_UIE_OFF(r4, 0x7004) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r10 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r10, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r10, 0x6, 0xd, &(0x7f0000000140)='illinois\x00', 0x9) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2279.300285] binder: 30176:30180 ioctl c0306201 0 returned -14 [ 2279.396056] binder: 30190:30194 ioctl c0306201 0 returned -14 03:44:31 executing program 1: r0 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) r1 = creat(&(0x7f0000001380)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r2, 0x2081ff) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) io_setup(0x8, &(0x7f0000000180)=0x0) fcntl$setstatus(r3, 0x4, 0x46600) io_submit(r4, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r3, &(0x7f0000000000), 0x10000}]) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000200)={0x0, r1}) mount(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) 03:44:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:31 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$smack_current(r2, &(0x7f0000000000)='systemwlan0[eth0em1{[}-self/cgroup\x00', 0x23) accept4(r0, 0x0, 0x0, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) timerfd_gettime(r3, &(0x7f0000000080)) shutdown(r0, 0x0) 03:44:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000080)={0x0, 0xfffffff8, 0xe0, 0x0, 0x16, 0x4, 0x3f, 0x3, 0x9, 0x9, 0x6, 0xa13}) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 03:44:31 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2b}}, {0x2, 0x4e24, @local}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x80, 0x0, 0x0, 0x0, 0x7344, &(0x7f00000000c0)='lapb0\x00', 0x7, 0x400, 0xfffb}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x88502, 0x0) close(r2) 03:44:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 03:44:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2281.962578] binder: 30202:30206 ioctl c0306201 0 returned -14 03:44:31 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000004c0)='nbd\x00') r3 = creat(&(0x7f0000000500)='./file0\x00', 0x48) r4 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r6 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000540)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r7 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r7) r8 = syz_open_dev$mice(&(0x7f0000000580)='/dev/input/mice\x00', 0x0, 0x262843) r9 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000005c0)='/proc/self/net/pfkey\x00', 0x60000, 0x0) r10 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r10, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000700)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000006c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="88000000", @ANYRES16=r2, @ANYBLOB="00002cbd7000ffdbdf25010000005400070008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="e2fa119ebc483ffb0d46da4e4baf3b048c99db192348bb44fde86ad233dac7995c4678ea204d014497f833aa7ec2dc6120fb45e24cd88af23d05ac653354da6cd54bd6bc13a1abd58d29a08fe38dc96c31c882a7a1913c5b", @ANYRES32=r10, @ANYBLOB="08000100000000000c0004004b010000000000000c0002000300000000000000"], 0x17}, 0x1, 0x0, 0x0, 0x24000000}, 0x80) listen(r0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x40, 0x81, 0x4, 0x9, 0xf, 0x9, 0x5, 0x7, 0x2, 0x3, 0x6, 0x6}) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r11, 0x8001, &(0x7f0000000040)="0800b5055e0bcfe87b0071") accept4(r0, 0x0, 0x0, 0x0) r12 = pidfd_open(0xffffffffffffffff, 0x0) chroot(&(0x7f0000000600)='./file1\x00') write$binfmt_aout(r12, &(0x7f0000000080)=ANY=[@ANYBLOB="0701930738010000bd01000007000000ff00000008000000000000000000000038b5dccbd81fabdc5bd31ee37cd5f615c13c539e5621861446979afaba8bc79fedc97dfa80a124c13814a7ab648d265e38262d6faf6dc24a13fb6049f5da384a7704ef8188530f06ce4437ffe68a453f5eb950a3f01551c165ae4f3af95db507dcc35a3c681b4c2aa706ae9f303fe77c48f4aed8ef94c9e8d8bf8b4466c508a58a3fb6990582f6a72937813202075a4ae59198880c01b6733c7c6ce9442a094f9df716bae7be85741d61a95c6343ff353e32b1ebc61a7d72000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000002300"/984], 0x3d8) shutdown(r0, 0x0) 03:44:31 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x200, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_config_ext}, 0x0, 0x0, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 03:44:31 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000040)=@gcm_256={{}, "0de91a1c2fc9ed43", "02a839a6c7986edc3f8a6200c88e37de79b97525cedefaa0bded32e7d887ec99", "612a56d3", "7b23285ee4861a88"}, 0x280) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000000440)=[{&(0x7f00000002c0)='\n', 0x1}], 0x1) write$binfmt_script(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="2321200a8117fb62d5eb1b3c750c75c5533f018823a1699743876915922a9b66379e3db9e87bb57e1d384bfe3042c49ef9134937af481f2b44e023b3c35f0b8810707ef1dacca01048b2c20b884e0efb76d2659a715f3b513e331597c9d3c9afed9390b357d0744ddc020aedf819000000000000000832ff0769dea9ed32487d2bf1acafcf98d817857774004608d609000000701f793b97fdcccc62273deb40c4e69857745a810000000000009755979c72f645e9898fb9d61b0ec3a669af77550098323d175d496b"], 0xc9) sendmmsg$inet(r0, &(0x7f0000000b40)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="8c", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f00000007c0)="6704", 0x2}], 0x1}}], 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600), 0x4) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) [ 2282.063840] binder: 30215:30219 ioctl c0306201 0 returned -14 03:44:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) write$P9_RLCREATE(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0xf, 0x2, {{0x2, 0x3}, 0x7}}, 0x18) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r1 = socket$inet6(0xa, 0x4, 0x1) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000100)={0x400, {{0xa, 0x4e24, 0x3, @dev={0xfe, 0x80, [], 0x24}, 0xfb}}}, 0x88) 03:44:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 03:44:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) lremovexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='system.posix_acl_default\x00') [ 2282.172001] binder: 30236:30239 ioctl c0306201 0 returned -14 03:44:32 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000000), &(0x7f0000000080)=0x4) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x4e21, 0x200, @local, 0x1}, 0x1c) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(r2, 0x9, &(0x7f00000000c0)="3c172a64ea9cd4b1eb57ec9fd92c2f6adc6f2d56ab2b39a05af9eb5add4a3b9bc84f52689c4ef17fb68b776018f0d4b20574060a4125d31a4dadecf5f82e542cadd6919fb3b96345abc367ff92bae19a159bb5e8ac80") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 03:44:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 2282.269647] binder: 30253:30256 ioctl c0306201 0 returned -14 03:44:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 03:44:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SVE_GET_VL(0x33, 0x6655) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) sendfile(r0, 0xffffffffffffffff, &(0x7f00000000c0), 0x0) ioctl$TIOCGICOUNT(0xffffffffffffffff, 0x545d, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 03:44:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x52) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f0000000100)={0x7, {{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) write$P9_RLCREATE(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0xf, 0x2, {{0x2, 0x3}, 0x7}}, 0x18) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r1 = socket$inet6(0xa, 0x4, 0x1) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000100)={0x400, {{0xa, 0x4e24, 0x3, @dev={0xfe, 0x80, [], 0x24}, 0xfb}}}, 0x88) 03:44:32 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) r1 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="9e", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) socket(0xa, 0x80001, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000001240)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001280)={0x0, 0x0, 0x0}, &(0x7f00000012c0)=0xffffffffffffffb0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r7, 0x0) r8 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r8, r7, r5) r9 = add_key$keyring(&(0x7f00000011c0)='keyring\x00', &(0x7f0000001200)={'syz', 0x3}, 0x0, 0x0, r8) keyctl$instantiate_iov(0x14, r1, &(0x7f0000001180)=[{&(0x7f0000000080)="1ea28ffe770dd1f84bba5c7dbad1f7e10962e09333c939e4bb0739dd542c29d977dd87bdea5a9b84839e48c68ed13583f745a86e7fa9875385196973", 0x3c}, {&(0x7f00000000c0)="97e1ef1e00db218ffe3ce860f73c4f71b2eebf3eb4ae7f8be145af6edc52aaa4ecda23012e8fa91c3dad2ae11148738c098a27337a08d8a7f10f0af38aa62430c48aa5aad763332f6352f4637ac3d0270f90954d1b517deeb2c2edbf4c7d28d2c85eae3463ddcfcaca36dbb3be45df8c994cc388ac4de109a79f448209a51a55034e48f37c4b", 0x86}, {&(0x7f0000000180)="1d633c36768ae90ff05a4a77477af8889029e1c33795f69dabbd4ab0242067b485b50ed9e7100920e07c342367d97add19dd38e2e325060de86713308e0f4e9c46099d60209511f2a6bbafceb3abbd9be4092248d4f0adf68d62033068bfa9738bdc1f24d354ebf87ee74ffdf96d74e25d0ee671ba28158fe3c391bea7b204c0e78e2d8d0353c928cc277105467db0fd0715892abeeedc6219e7fc4607d6c45f9e9145421c420f95bb4e491cb98b0f0c8c88837c2d9fde07231bfcae469def764573949fa9aa9b912c4693177bfd2bdb3d0d3484fe3ebc36943c898a4160b3a4935b4409528bf2cefd06dc4d35fa3ec79746735ed0679dde64e51d3aea9f767d3168297dd8d21be8a5ac7f94051e2b274a3ce98c80a3273653e19c6577a80649c2c3cb6d3522d6ac88c4461ca86ae644399e8bdd10a4eb6d7fa2a3c43af243e5b9d68adaa9ce24caca2f9300fb81736f4b3d721168fbc277cd239e0622657c8574427d44f845c055ac48aed29971ce25561e76280b02a9a5909b95d7494bd54d8a88ffb1584f9f55a2f60d613ef8008479bde03ea5888fe8cb5c26e8131875fbb7649243fbb5d0e5c5f97a300f41bb7f66d86f9a6e451c8773430b3377541092abd44f124d6323d64dcb8a7b57cdf0758faee605fd2f417d804b476f390bfb67c49e0471d46ff0abf5d2f1370acc42f854023796b4f778ccf1fe346bf65138ecf27857bcd15c712806975f25139190868825f2d0a20896a68d4f84e2c834817d1caeb7ac5da7b3b8cca0fcede2655ac937820f499608ea355abc2823eb72341d20ed5cd1bc9c3d3831084ff0a6449ae22a3ce02ff4ffd17212beabdfb0300b90d38873e99c520ab3d2179be6811bee0cae5606b4d9eee26c13f7f8d2f2002554db65f75d3914228a22c5bffdb0c429ef2bc36be3d65e5d88bdb5269b708c94478e161d01d4b67b35a47a2bd993d1b35a05daac6634a9ac5e48c82ae3f0b9b4465b85fd42ef5a3e9a6ec24105a1eb376da091460a3a63f20699df8a312d5b8dd803bd3ce958c7580da4f1518eecea08037d4dc8c25fb1d20992f219f80ece2be189994554d9c38c341b3a1bedf7055ec47576f5855cb06494430246a5c20307d6f91cc49c7a3e99c3ed2167ffdff310bf8b5033b5eb19dd48f5552b3d4e950aee247b8c61d588d6e83b370a5d1d2a3acc63944c2c395a7ba11d4e4239901dc1cc4b54bab80110e7771e9152b1fddc5755ccbd14f38dc4895d956e7d138e8865b1cf79c43bd6b09b6b315913a13cd9445ff2674208012482a22dc589f9f0f4a9e3c5b59d14b1fa2927b750b5221de3fce084012886fc972e485942814e3f0f56289c821ea4acf5fe59a7f69bc454bede0b65d2ae08459900ce3604998b517739c1f6a0439f59d9b895fda740c8292ee00795e4fce172e7af236acada65a662e6c0671091c478309697030c232839c94d92b9f834b39af54aff77276e924207970999c48842e87f86b260cd7e9e73b3789784df21c2ccbcbb1a0f3590a10ada5bd45e90c10725dbc5d31ae68d350a918e5ef15c1240594d55c7e66fa200af56162d45bb511d89ab8281397c7455cb20a34af23d245cc098b774c7a2741be57f5a7403846a719b417c55fe915c5f78e8519c33dfc25a43c1e6f628597dff1471f6654d4e38ffa43f5cb3aa7cb5303e8ad7d41fa5e59213836c3be6632f66522873d068f8eac4d9074a0060f52803692d1b047ea237f8938e6212509fc98dc47912ba705d2fe71c67232293f5014a4f7a666584618419feb761754a2342b155be756f1db3e5d098ed1d539e95a46d365abceb9a1377c56d258fde602eef13e2ee10a918b63b240dd890b9c1b92c107e7975389be0cec2a5db862092eaffacf9018c7c55c0c9798924ca5f0b61c37d8c12ded821265321b8f7e458c634de9b04357217f836b1ec04e5817002025d9a050d1a8ba33a40adceee3fc68480223759d3f69c66b6da9f9a5a5ca5962fa2530ef53fe5c43639558b798971ab29cfabf583d77618c04198e21aa9212d32b69b294f3d5afa997b715920e17902edb6454d00572228d95de7a2fafb8acd38142d43aa7d408d7dec78896265df6fde08b68ccedeeb7e42dd0da92ffa936c6441066709d90521b265310b9f0951e71deff13ef95d2b1a2276361427df18c600455f94529efa704539e168c736769620e3e37d8d82596eb9b823bb6c7e36d5fbf243d2c0f9757bc6be80bd0ea7c7bd5b447e87b83a6cd9de7f289c5e7083c7d2b229dbda08226052a23b613948342ae5c669df72d345e8b3eacb524f8ee764ea5d186551c72b102dea4be24fe5f99871959fa29d16b3502c7c282d54a1a093031e95ead16b7b7c8779a65b55746bda26d0ac2e6aca9d76863e5e30504da457395fd93c84e2c8d32b019ae538e19091d03265f1407c82154bb6051cdba21bf676438166f04a49604d351e7f5a6fc22d4154faad9d1e81c5f8ef87b905b86371cc3d809fdd6a12cb419d21cf8f2522ece96456775d6e265459b10a716853b4cd9c4d2d7c15cd7cd100b489b98063c57cf6679887082207f25b0a12e9b2c7976bbe244c11999201fba5b24cb21d7ecfd69f89b6bde57a6ad2abaedbe7e1303abcbfa693f9ed1dbfcd5df87de0fdd4bba70a8308e7514925d545223a287e8de7c9ce53fdc39c5d6d595f7857f0e12eef1554fe3f0775fbdfe24b51f8247209a6b2c581131817d5b2931fee2204b375338a93b01896774dc03c460103ca25b580cd9da45cbf0c42ebc3c9a8f75615a814d836d5630fae9bdaff8418068067a9e492ee6b37730ccc20bd55f884f45ca1279b18ad9c545d8db0003aecd078dcff05f2cf9562f0ec83e3b8ff4d7a014277648d41773304775483d30cd9803b78b05354a3858ea5b5b768bfd0cb0a2a53e155a183e29a2ed338f5562fe75784b50b30fe9024aa420549b084ded393754e9237757375b01aef841044d9b35b7bacb0ea3318a5f0c096ea9b1c38ddba7bf1321758acb1e48c571838e243930ca4bf169abced6a185a864bba6b0f278b015ff42308acb1d08a46f5cc27128334c36f1804ea0898d0ff00eb77a6a1cb0f06cb39c702f74308cc5384ae9013488b8074373d063dbc8bf29f99ae12de81633c135adf66930783cf92512b9eae95fa46e5fc0dfe354f3ab5d7daab08e9d0fa5565614155278e0dd58abf1d4c397e25d995fc352abaae986dc0d9093879e04826ec48d92cc27bc3ccba89f969f75e7ecb4fe7cf9eec1ab4b7e63f27aed4a7bfb81d094223860976ce2238ccb376d5e8e6cc6fd8cce405488a781c98428b4d67b1f4783872528ad14760870ea974668c992eb20403b3f4158e85025052e2fa82eaa1ce9dd4986e1d4d2ebc3ef5ce424f22cea500b4a5da2dfa59d3e93897cd4d8c078592912485f2217d8e3d157622103ec9f660e22df9c26a1c48f172d95f3551423eefa373bf55b57a6bbe23547db2f03606f686a88a3cf5ea13510c889029885430df478a45a4dc3cc56ef33519aae1cafa23aeb990ca202d00ab8b170685dc74d41262fc7456b0b0b7bdf65ae1f46d5f0c1406d73ba725aa3c533c3b5c82d94fc887c8dad2450fbb8015503a7cab6ddc6d1577d01f3bd00fa54dc212eeb4937463bf06734f2a6253c13fabc6da272661019b318ebe7c829a43f522acfaca4588f30bf17a815aa617281cd22f5cc643b1fa6a0808b57bbdcb44400ef7ee68cf11923f457be6f88ce309d55d2b6236fb9bf42240592613d205977c0ec0d96da204244783963f0801324f2a181fee520298388323b5cec8f76b2e131ce80a975fd0016bd358dd13b2ee2d8dca2535dae1012d710748647feca01688f6000ff8a4234d5ea3378c17930e22f6959f9535e99fefedccb1a2a02a27f6307d1ac01b0ad6ee03d0608a1a1116f927bd0e4bcaf4f579be1bfacd74579b285d5ec169e7c0a6260e0b49df07fba959cd6785c6dcf7118ccec48566c5e4a96993f4d29db9bec7bcd3a87e54eecd223b44fc570d3599908261f555ae05013dffca287bc1308d87a357c3bf9c930742b7902fa0d2d45f42bd1ec59f13ef1a7f216196b37783b38b8a272c84cc823547c4ae376c75bab7b6e1302b602f9edfcc0ab7aa04eb1b5404de18a94ad0f4360bd14bf2e4a9c03912dcf02c88dfca801ecb92b66686a0467ad0abd6ae8716287f7ad7878375a4c511d5051ec86e6c99b53f7f6fc5a8207cb09f01097566b1ada9df0c56394f31c64a2301047d65877167f85a8d63ed213d6e32811152a3c41eb8650ba69f2bfee50036d130c922f4375a076c011c449d0c32e41c32da5083efc25a4bb2db745a1ec69dacb69586d4f10efb6556f8ae4f3127f0d35809294201a9175dc90e7d7e83b9eb6a8c3949751bcdcdc65c02dde9aa6da3e45e6aac5fb6b9faf6240a702e8f999ba92efe66c13e4396f4cc8c22ab2428c986f997e523aa9b95729b125ee55f20a101f74cbf9c92db9587c02620092e1a76e7a47b8a92f2a10cb67e852c117d56a00fa768c7538f7901f4f7edaeee482d1dcd6aade285e2a93b9dc2122cca5141e4d9b48b2944e16dbf88ce75eb44b558501a8005c1fb4fa28b9cabd2fca3bb70d2df5b308938b74525eecd30a6f235ea91a798448666bac192117a7bb5efb976f25537e01a9b304ccc82f4b1378acfe66b092a0eddd5e364e8d19136f7259f39a4eb6596593d23064a504bc1d3187d6b2541e443ad1ae314049105eb2d97ee2115bc85fbaa536af7da95788929875472bcbbca17545a8b15f58bd5a7ccd2df232cbedf2bdf03fbde1659b78ef130d4b5a7a7f30e06616b9710fd79926819bcb0f78d0b5f5cc9cc142e894439cc1dad1bf3497f4c3b8dbecd1f91dfcd5bb99ab07c6b3d53808ccff16b34323fb5b99920ad63ce43fbce95470a3094c9c10e31064ce26d7e9cfd05040bd1513996e056dc68115d800d5e8ca61bf6f4442fa2fb96887c7ab0a4a0c85a5a35a096ee50a899897c2a2b24bf44899117d276f0e00412dbbd2f780e078485534877011cfc6a8a22c804bef6431aab2453056955fc9ba4eb8ad1987a768b22e357973a5673d53e3bae60cb4807e60212a18a9bf39a62a16d29be49ca1e82db6e92f4f20d6b0620a2260e28c0c80ccf038135a3880f878a43ed84ed0c8bb59281f6a71945d905c33f5f982faecfc65529c9352ce80ff772625d3d7ae3f87066fd66f528e29a41ad84509734a25e73e372f898c1b750d798858083c9c1575b8b947b93bcb705273d95dbd6e9b23645cae7903ea26d455235cadc62350539112c3bd6bdb675e636fa8c467a52a147989a76a7e4b01ef500f7dd605e1c1c9f39212edb1d154d5ebc717e2df805429742d410d9bbcda86ba648a930e4f17eb439457d89048165390d21e0466b12fdf1b0bf23155aa4cb6d3d4e63d6542d03d8b0da33f2c9f0ae0a55ecbe6c8f9294ca1916bf8f2a93dd12e4a81e96dee904004c0cf1dfd2308d2985f448066d45b084df14ece80daae2c6e2f876d90629c4f115d951f7326c2e57f5f3946efb61c3f0ef9d64132c9f3fe412a9aea4f6f16dd2d510a6758b0845667b1cb347a0ea94c60c75f7035223bfd1bb566a0a4b42880c554d78ea81c1480cc294545098d7244c6d50166923608f962853fc7406b5ecad155c239f1e30d342fbf9dcbdea699770d1222ab56825d032962d8898a5d71c6d5cc724bae0b0cecb11f4415dac9aaadb6d59b20da878cee80f39ddbb8079911288ad0942187186418c54ab7774dfbf14fb437611", 0x1000}], 0x3, r9) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) 03:44:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) 03:44:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) 03:44:32 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0800b5055e06cfe87b0071bfd6f3aa8b0398e6ba9d969891743416fd79815401bd204af751fbb750662c28320e3626a48863ad97c3f4bc8a59") accept4(r0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 03:44:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) [ 2283.104339] binder: 30317:30320 got transaction with invalid data ptr [ 2283.113887] binder: 30317:30320 transaction failed 29201/-14, size 99-24 line 3316 03:44:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x800}) r1 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r4, 0x0) r5 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r5, r4, r2) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup(r6) r7 = request_key(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000240)='{posix_acl_access*\x00', r5) add_key(&(0x7f0000000140)='rxrpc_s\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, r7) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f00000000c0)={0x0, 0x2, 0x8000, 0xfffffffffffffffb}) [ 2283.163696] binder: undelivered TRANSACTION_ERROR: 29201 [ 2283.277283] binder: 30333:30337 got transaction with invalid data ptr [ 2283.286426] binder: 30333:30337 transaction failed 29201/-14, size 99-24 line 3316 [ 2283.309006] binder: undelivered TRANSACTION_ERROR: 29201 03:44:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x800}) r1 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r4, 0x0) r5 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r5, r4, r2) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup(r6) r7 = request_key(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000240)='{posix_acl_access*\x00', r5) add_key(&(0x7f0000000140)='rxrpc_s\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, r7) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f00000000c0)={0x0, 0x2, 0x8000, 0xfffffffffffffffb}) 03:44:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x3000000a0160101, 0x0, 0x0, 0x0, 0x0) mkdir(0x0, 0x0) keyctl$read(0xb, 0x0, &(0x7f0000000000)=""/115, 0x73) keyctl$join(0x1, &(0x7f0000000080)={'syz', 0x2}) r0 = creat(0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r0, 0x0, 0x8010) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fremovexattr(0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_pts(r2, 0x0) getpeername$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000240)=0x14) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000280)={@empty, 0x42, r4}) keyctl$session_to_parent(0x12) sendfile(r3, r1, 0x0, 0x10000) rename(0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$EVIOCGKEY(r5, 0x80404518, &(0x7f00000000c0)=""/151) syz_open_pts(0xffffffffffffffff, 0x0) 03:44:33 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r1 = getegid() r2 = getgid() setresgid(r1, r2, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2283.733399] binder: release 30350:30355 transaction 13349 out, still active [ 2283.747094] binder: undelivered TRANSACTION_COMPLETE 03:44:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2283.784000] binder: send failed reply for transaction 13349, target dead [ 2283.803312] binder: 30349:30359 got transaction with invalid data ptr 03:44:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x800}) r1 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r4, 0x0) r5 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r5, r4, r2) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup(r6) r7 = request_key(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000240)='{posix_acl_access*\x00', r5) add_key(&(0x7f0000000140)='rxrpc_s\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, r7) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f00000000c0)={0x0, 0x2, 0x8000, 0xfffffffffffffffb}) [ 2283.803340] binder: 30349:30359 transaction failed 29201/-14, size 99-24 line 3316 [ 2283.891030] binder: BINDER_SET_CONTEXT_MGR already set 03:44:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000280)='e\x02 \'\x99\xbe\xf2\xa3\a\xd0!)\x93', 0x0, 0x804) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000580)="8f1000", 0xfffffffffffffd64, 0xfffffffffffffffd) keyctl$setperm(0x5, r3, 0x0) keyctl$get_security(0x11, r3, 0x0, 0x0) keyctl$get_keyring_id(0x0, r3, 0x5) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r4) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r5, 0x0, 0x0, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r5, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400004e}, 0xc, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="0c010000f948c542d2d751358051e077dcd375539552039e3365bd4bacc77f0149edcd9f02518896e71889ef8ce38fbb3b89ff1b97ad128099b398a9e5b1ad171b482ef8a84bd78bca454009dd59bddf9c86616050df5e9c9db435a3d4c6d61e9a8ca8f50cb51110faea66ed69a35b54444c0efffef4d0b27b7d184081977eabe2b11ad4d75a1ee99a53", @ANYRES16=r6], 0x2}, 0x1, 0x0, 0x0, 0x80}, 0x20008010) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000004c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)={0x1b8, r6, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x40, 0x4, [@TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x87}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}]}, @TIPC_NLA_LINK={0x88, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffff9}, @TIPC_NLA_PROP_WIN={0xfffffffffffffe86, 0x3, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfacc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}]}, @TIPC_NLA_BEARER={0x18, 0x1, [@TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'eth', 0x3a, 'ip6erspan0\x00'}}]}, @TIPC_NLA_MEDIA={0xc4, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x15b0}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x628c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x1b8}, 0x1, 0x0, 0x0, 0x8000}, 0x28c10) r7 = dup(r2) fsetxattr$trusted_overlay_origin(r7, &(0x7f0000000000)='trusted.overlay.origin\x00', &(0x7f0000000180)='y\x00', 0x2, 0x1) r8 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r8) ioctl$PPPIOCSMAXCID(r8, 0x40047451, &(0x7f0000000680)=0x3f) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xffffffffffffff53, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000500000000000000000000000000000000000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r9 = accept$inet6(r7, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000540)=0x1c) ftruncate(r9, 0xdb43) 03:44:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2283.891039] binder: 30373:30378 ioctl 40046207 0 returned -16 [ 2283.894601] binder: BINDER_SET_CONTEXT_MGR already set [ 2283.894611] binder: 30375:30379 ioctl 40046207 0 returned -16 [ 2283.897496] binder_alloc: 30362: binder_alloc_buf, no vma [ 2283.897515] binder: 30375:30379 transaction failed 29189/-3, size 0-0 line 3284 [ 2283.922546] binder_alloc: 30349: binder_alloc_buf, no vma [ 2283.922565] binder: 30373:30378 transaction failed 29189/-3, size 99-24 line 3284 [ 2284.033142] binder: BINDER_SET_CONTEXT_MGR already set [ 2284.033151] binder: 30391:30392 ioctl 40046207 0 returned -16 [ 2284.050072] binder_alloc: 30349: binder_alloc_buf, no vma [ 2284.050091] binder: 30391:30392 transaction failed 29189/-3, size 99-24 line 3284 [ 2284.117600] binder: undelivered TRANSACTION_ERROR: 29189 [ 2284.123820] binder: undelivered TRANSACTION_ERROR: 29189 [ 2284.129507] binder: undelivered TRANSACTION_ERROR: 29189 [ 2284.135604] binder: release 30362:30365 transaction 13354 out, still active [ 2284.143298] binder: undelivered TRANSACTION_COMPLETE [ 2284.148592] binder: send failed reply for transaction 13354, target dead [ 2284.162220] binder: undelivered TRANSACTION_ERROR: 29201 03:44:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x1, 0x0) mount(&(0x7f0000000680)=ANY=[], &(0x7f0000000700)='./bus\x00', &(0x7f0000000380)='hfsplus\x00', 0x0, 0x0) getpeername(0xffffffffffffffff, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x950, 0x882) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000240)='\'', 0xfcc9}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r0, r1, &(0x7f00000001c0), 0x20002000005) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000200)) ioctl$LOOP_CLR_FD(r1, 0x4c01) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:34 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x3000000a0160101, 0x0, 0x0, 0x0, 0x0) mkdir(0x0, 0x0) keyctl$read(0xb, 0x0, &(0x7f0000000000)=""/115, 0x73) keyctl$join(0x1, &(0x7f0000000080)={'syz', 0x2}) r0 = creat(0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r0, 0x0, 0x8010) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) unlinkat(r1, &(0x7f0000000240)='./file0\x00', 0x200) fremovexattr(0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_pts(r2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendfile(r3, r4, 0x0, 0x5) rename(0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fcntl$dupfd(r6, 0x80c, r7) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r8 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x501000, 0x0) write$9p(r8, &(0x7f0000000100)="6510436312df6be5310fbe04811c205ab971a63799004e037be7b441759859c2fab68b0b228dd3e1c0d85d1e024cec5a73bafdcbce2274eaec14164f833851f823bc53101619a04119", 0x49) syz_open_pts(0xffffffffffffffff, 0x0) r9 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/create\x00', 0x2, 0x0) write$selinux_create(r9, &(0x7f0000000280)=ANY=[@ANYBLOB="73797374656d5f753a6f626a6563745f723a63726f6e645f657865635f743a7330202f7362696e2f6468636c69656e74203030303030303030303030303030303030323832202e2f66696c65300071ea94"], 0x4e) 03:44:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:34 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0xec, 0x40, 0xe79, 0xd5}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r3 = inotify_init() dup3(r2, r3, 0xa1766e0b4e5df355) 03:44:34 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f00000000c0)=0x5) socket$inet(0x2, 0x0, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000100)={0x0, 0x0, {0x3b, 0x10, 0x9, 0x1a, 0xb, 0x1, 0x6, 0x89, 0x1}}) [ 2284.639697] binder: 30407:30414 BC_ACQUIRE_DONE node 13359 has no pending acquire request 03:44:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2284.699699] binder: 30407:30414 got reply transaction with no transaction stack [ 2284.740521] binder: 30407:30414 transaction failed 29201/-71, size 80-24 line 3046 03:44:34 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f00000000c0)) fchdir(r0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x3f) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000300)=[@acquire_done], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:34 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) clone(0x3000000a0160101, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x1) mkdir(0x0, 0x0) keyctl$read(0xb, 0x0, &(0x7f0000000000)=""/115, 0x73) keyctl$join(0x1, &(0x7f0000000080)={'syz', 0x2}) r1 = creat(0x0, 0x0) lgetxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='system.sockprotoname\x00', &(0x7f0000000140)=""/54, 0x36) sendmsg$IPVS_CMD_NEW_DAEMON(r1, 0x0, 0x8010) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fremovexattr(0xffffffffffffffff, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = syz_open_pts(r3, 0x0) sendfile(r4, r2, 0x0, 0x10000) rename(0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r5 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r5) setsockopt$inet_tcp_int(r5, 0x6, 0x1, &(0x7f0000000180)=0x8, 0x4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') syz_open_pts(0xffffffffffffffff, 0x0) [ 2284.870051] binder: 30429:30432 got transaction with invalid data ptr [ 2284.883417] binder: 30429:30432 transaction failed 29201/-14, size 99-24 line 3316 [ 2284.903668] binder: undelivered TRANSACTION_ERROR: 29201 03:44:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2284.919809] binder: 30437:30440 BC_ACQUIRE_DONE node 13363 has no pending acquire request 03:44:34 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x400080, 0x0) write$P9_RSYMLINK(r3, &(0x7f0000000140)={0x14, 0x11, 0x1, {0xab3d6c49c1c1012c, 0x4, 0x5}}, 0x14) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000180)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)={0x0, 0x16e}}}], 0x0, 0x0, 0x0}) 03:44:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:34 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x1ff, 0x40000) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x400, 0x8, 0x0, 0x5, 0x15, 0x3, "aca9d3dcc559a547f7311cddb53b6bb0e2f6558ffcfdda26ac6ba5a1a205c6067e8daabc97ca4b86cd300512260240dd9d67939fa9a71e898f010a74d4c7b1ab", "620a10c73529a5633eec8efe56a3e60645b4e9d353b389611206c278b51ad0e690aa69662b396ce48c316d64d4224b089799b466842a0b459ee39274fdf356aa", "38487073d394306eb5a33eba9fc8e7da84c603d05722453418047404afe16f5f", [0x0, 0xffd]}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup(r3) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendfile(r0, r4, &(0x7f0000000040)=0x40100060, 0x4000400000000000) pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000004, 0xffffffffffffffff) r5 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r5) setsockopt$inet6_icmp_ICMP_FILTER(r5, 0x1, 0x1, &(0x7f0000000200)={0x225a}, 0x4) r6 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r6, 0x401870cc, &(0x7f00000001c0)={0x8, 0x4, 0x0, 0x6}) [ 2285.066722] binder: 30454:30456 got transaction with invalid offset (0, min 0 max 0) or object. [ 2285.092254] binder: 30454:30456 transaction failed 29201/-22, size 0-24 line 3379 03:44:35 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) getsockopt$inet6_opts(r3, 0x29, 0x39, &(0x7f0000000480)=""/4096, &(0x7f0000000000)=0x1000) r4 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:35 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2285.117436] binder: undelivered TRANSACTION_ERROR: 29201 [ 2285.140659] binder: 30454:30464 got transaction with invalid offset (0, min 0 max 0) or object. [ 2285.180352] binder: 30454:30464 transaction failed 29201/-22, size 0-24 line 3379 [ 2285.210924] binder: undelivered TRANSACTION_ERROR: 29201 03:44:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle={0x77682a85, 0x100a}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) 03:44:35 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) r4 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="9e", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r4, 0x0) keyctl$get_security(0x11, r4, 0x0, 0x0) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000000)={r4, 0x5e, 0x1000}, &(0x7f0000000180)={'enc=', 'oaep', ' hash=', {'sm3-ce\x00'}}, &(0x7f0000000200)="b58ba214a3905387e667061d69879169ae68444ebd86f298d2fe1e21346b816fd2a66ec2b0a202008615c3167caaccf72547decea560274d7d28b5c8b3ea655216d737ac4f5d0c05b9261d9086e2f59bf428b2d9c867b168ce91ac84d154", &(0x7f0000000300)=""/4096) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="0004000000000000004ddbde56f6d4df6600000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:35 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r2, &(0x7f0000000080)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x80) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2285.318350] binder: 30478:30480 got transaction with invalid data ptr [ 2285.333106] binder: 30483:30484 got transaction with out-of-order buffer fixup [ 2285.333136] binder: 30483:30484 transaction failed 29201/-22, size 104-24 line 3525 [ 2285.333433] binder: undelivered TRANSACTION_ERROR: 29201 [ 2285.334694] binder: 30483:30484 got transaction with out-of-order buffer fixup [ 2285.334719] binder: 30483:30484 transaction failed 29201/-22, size 104-24 line 3525 [ 2285.334915] binder: undelivered TRANSACTION_ERROR: 29201 [ 2285.405415] binder: 30478:30480 transaction failed 29201/-14, size 99-24 line 3316 [ 2285.415983] binder: undelivered TRANSACTION_ERROR: 29201 03:44:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='bridge_slave_0\x00', 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000300)=[@acquire_done], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:35 executing program 5: r0 = socket$inet6(0xa, 0x6, 0x0) getrlimit(0x0, &(0x7f0000000680)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='pag\x1d\x01\x00\x00\x00 P\xff\x84\x91\x13') socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x4, @ipv4={[], [], @remote}, 0x8}, 0x1c) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) bind$inet6(r4, &(0x7f0000000180)={0xa, 0x4e20, 0x6, @rand_addr="3ee06cb60354f3034535aeafa84382a3", 0x7fffffff}, 0x1c) setxattr$trusted_overlay_opaque(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg(r2, &(0x7f0000001bc0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000280)="706c3043cdd62749e079d8fda5f9f2cff4c98aa2181f38c7453ac2a23792c6d99a42432accc588cbd5c5ef430fd52af0020302e4b217e4959c8c9f4d024ca05b466934148aaffc0a7560a0366226fea54cc1d7c8a385bfcaa3e79b5118a607aba9611cac6baf702138205c8d8845f57000", 0x71}, {&(0x7f0000000300)="1dcd5e3445a03f28852d4c963c209c0f823ec0cca61c9e91357c4ba2f48ec658fd64d6d251b9770d421f5a19bd07500aaf0ed259e0450ce3182eba34fce823d909bf45af4db4c921e8bde851a439c4ccb7a5aa103d93fb418d0d3536f9b7d4f02f95864bfc74ac7752d0b59afdac3261eb0af524226d49f2eaf1caf6eba0b553ff9be9d071a8300542c726c96cd98de3aef27b6f3336d98abdb1491dc29d6044c51cf63331f33669fd2352ada7441b68c2a7f2428a0ed430313ba565ea01355f4637f065e818037e1e432f9e61c88cf25127ac7724500a8a09624ddb48afae64ba0590161e9c99c80d41d5058216", 0xee}], 0x2, &(0x7f0000000440)=[{0x28, 0x305, 0x401, "e7ee66551bf5d9b9213386f61a1060cd7e899dc8"}, {0x40, 0x0, 0x2, "70618514d768f3a23f7a11d8dcb578c6ee69f5d92a1a8db5dad5fe478ec785abfbf9a34b5352bdaf475c"}, {0x38, 0x101, 0x3, "55b53e0ce809b6078a6ecb59aa44a462d4071f6720ed9615a1e836a2833c703a23"}, {0x70, 0x0, 0x2, "2c472a9282d13a77107759e0658da2b60bd4e22977d4a57661ab37dbc0c6082e295c7edf35c7b7acb1ae9110e3256edfaba439bef99dd5663bbd6d1a96b1324289c74f8f404f16ba83f9b8a26381cddfa64111326ab8f0c982d4be4778f37c3a"}], 0x110}}, {{&(0x7f0000000580)=@nfc_llcp={0x27, 0x1, 0x0, 0x0, 0x4, 0x81, "9203ab05d0f9c1f966d87eff9d211917ffa0863b69a2bc502023554811a5161bd52e1fbfffeeef41211ed465aed8b5f414482166f00ffa4de8dc2d844764e9", 0xe}, 0x80, &(0x7f0000001b00)=[{&(0x7f0000000600)="7035ac94e4e04199e373d9800a46837cc4f58d482674c77398b38b3289aedc987c5f87d2a12bfcfe1b7017267a80ddf4e72051f608fb64827c1d3b83d97378e7cd8287a5a5db94df5ca3b9f860611b92a5314547601b117624b961b2ac97a4efb0b0f69e", 0x64}, {&(0x7f0000000680)}, {&(0x7f00000006c0)="1a87614bab3d42441078d5d0c6a608ec88c73132a90dd0e9b0ce2c5a39f8bf4692dde14c659130462fbf5b1674470bf475a1129f965ca8bcb89831167f63c65f976315adb80eeb757b7f90e2ab3ecc6fea47292604afadaa103dec1773aa0729231428605b2f657151c4ce913b4fab1145ccef9798d0d1b90216362d3972c8e8cc41c3f5c437dd53cd07c372702a1e136030232f54881664ae072027a4e94b75ffbcc357a1f64f7a6b2ef7f8c72f00388fce59c467b703ba0f9da8f3f3501060a42706e5ab79a2cf55b24302b011d58463b965f592b5d09d9817e572f13ead97abf15eae72c076940733a19e7fdf33ae606940bd89019caf97ed68b71532cbdaf76d9bb54eac791e7b4f48f819bbc692cc82a74fe2c1df2b7bb3fc124001ca5d0bc74430db518cb54adc1557edbbcafabea2553a2dcb1fd2fc3a933e3fec1bb06ad64c4a7b5722b1eae2f5aff5b52b7d0c4811a6bd9c3359542623caa0a5dca2d5260597419b60dfec9a043ca7b4fa1de3a60de003beb03250f806dfc3a5079cdac7a0aedf11c34df4e565a6bd300c08abcd528dc4d0f0b5f16d28f369afe32b97224ad1a79f521c606193b22b4fee1b6ec1b5292f20f5ec9c8545f6994e6b69da4c1e7ae7bcff146026b87e22120f104f9469280480de50a70aa6574bd277c5935e064ed1c039180182ff0cfc43a55ff62d173912e3f52228eb13e23862530c2e6bafc43a4df629f8bd61302aaee6570c811c774dcb0c01f11d7b44f7352bdeb947038543cae1302184ae6094bd1f05e1e53bbc17a8d3135befb8a936495f83f31e0470ccd3fd641a5d56a5b464a57c62176ef13a2c07194f9f574ea2816245056e94bde400e144d22af6ea71a89165690658aea5118511ad19f43d3466fa8cfbc5f373723404dff2ac0e7b26cf9a7d3ded67370a87ce7ce626fbe5098390a36bc07a0b9baf456b358250d332361fce73c0484f80544962594d79065d3278123097211158959147b06a1681464460b135cae3b74ab876022b9653f2f0eafbdc51128a2d5fe1d4ab576b7c17826ae5d7f6b68e5bd7e824e82022a9a4f547b8a41cb985b930615e615020e3db12389be2db882f167b3d0806c7a1b155803b0f8b7e1366c8f1f09a61b434202b56ccb98f971e3c953a14677a4706f6a09e4154caf63f93ae7c8e3ddb46fc8e37896af8c0ed34db8d716983945183146cd8803e9deafeccbc9db44b83689898710a69142fc8adbd777ec32b5cf7ce3c37ec3b069d2dad37330031c7cfeec370e1f9fe61b82f50ff213e9106011a86eb4d67427f05538a37e38e2d39b95edbd5f19a35019cec7c6637a7ce099a92584df1790fd8f4f478588aeae13436fd5e8920ba58505cb93d7825d008c8e23fb74ada274ee13a78d679c3c90d066ae7903c1022fcf2a6a9a49f4ffe5097c619805ee6c765957cf9418835fb2904854ab3d5d5f3e3632665d1e3b5d9264dfae696177d2a7ea1762efa0216d37a52692c801fd3688f4b5e1fe83b6b49cf40426c5a8c6cfdcd924ced9e6d0e55742d69fc4712f3e344a14bf80e79a69172b066c65adec69adc76262b9cf815db67937c51b3b33e1abed74b1e06761a87aab53ca1e3dd8fa63547cd76cb3301415ff34de0a62fd1f40b41e782696a4fdcd34522bfa66ca72b588255d733c1ccf53bf6215e712ba0b10dbfe21cc27c710f96478958b52a7872fd7b070a803a4a388813dcc48843be9a0b7441fb4c26fd9c6ff3e150f19cbd87b5e54b21acb1ea59d4e8ba8f4d3270a9c1cb1f28e00d844b9789ec91e3754694b2a05e6623af3aff43bccc486953911ce634083d4290088a458c5dd2c3ba32086bf694bd87e33b4a6b6dfe64fd175ec18a2fd64112b14ccf497c7dff807210be636b9d71aa169b4d1d7b98ade9720ed6e2a589037bf944f67a5d4d8ba6eb083b9be9bd057ec7a908f0d40186aa35f1fe35bf52af5bb37353e46d5b1e020933792a49565e84ce670a220b6971c20f335b5fc5deecb2606d16a9da3b53d746cd1349d638271617e7dd19af8c1e4dddf51123186f89b2c1323678d048a472dd0320f0aaa9e0e87e1a265a1aaf21f02734e1872c43b5c8f7b80d63e50aab01bf2ff9a0a8a2ef3380262e633ee1a5c0d395bce86d149c21cef07c60d603407a9b9ab329c61faa5fc39cb28450e7c867d4107b964f8cdbcc5b570909de4e25965bcda0f4db288095cd7aeabe7b89bb5be3748b58c7afd136adb344124eacb5afd83fada3c5a8acbad57b5ad6b4640e3c91950cb109154110f914ebe4e394180cd03a736c5f9fca8bb1f56efaffa700607cdfec9ec14f8fe833a0d056eabb979e275f70a0abed4cb27187eea54d9adb3dd671c3c489693f99f018364b6578c4fd2e0d00eeacb27c59c1b6e24312d68366ca2912b495cf46a0bda95a8d7f75e6fd1477d2884a440c82c89c9acaf521fc58b1f8c1f83bc8af560306c4dc97bb93fe7fcd6a2854a30ee8ca391801b0c6b1dad2b43b3a882b0b5a825dfa7386fe871267feee3f3e44485deec42c738234746c1a4ca7720be2e126d1d333f90da89df3df470ef69d5a0d151693df1ce5a3d66854f5d81536d775a79369e9dda0cb7b57196a2a70a4e95c832007882ccdddfae81f810078c2ed88ba3e2012e4c3454784832648ad0f6f38f14bf958a7b12cfe6c9ded21a8759ce25b943b3afb57d26bbb93844ae2327fd673237d0c3d544fb8affce9e99f76ed00feff41d06a234c1b4e4e94d42f62fa1355353d36b1e31262370b05f0a677af2e769eb73040909d7d6f6e05c4fb729a4d0d4ac5992e8f06201bef13ad91daf99fc0f51b8008251323058c2a220a4e994d7ebd0e29d046087da232db2c2f0640556f56e0e2f23c049df7a8e5fe1172af4123426077a9ffa54c6508792207afc7f70990243dfcbb26a6516f3a3c511beccb6041f72d4da82f99c427c0ce3a39522205cd24f7c52790a496984d9680b7260af6cec1cd28be458c4fedd6539785410a2a739d675e300e589582d3abc6986c4d4c57f0a563cc8bac1c94febc983aea3c9448540236f6d6c259393ee2fcd0f632afd57ef9b685132d4e301edc129104b5842667905aea0afe90eea98cae4723a7d579591785ce3189ace45a45dd44a30a0d6a21221946fc1f32727f724f45423bdf6b0cb130e791fdf94e5aa4864a028280ad1a1b83e927a4477a5fb3597f26ac1147e4c1cda30151fa764fefab738d333d97f45a8e490a05acb033cad9e2839a16253823f4c9c06b6720ba9a93e1b850fecc9cedf61fe6a360ddda016c4bbc4ac0a62aef321db77f584931337819cb43cf6705d3c4083b2d199292e823dd483aed3fe625a78bd86a774bd3881eacc3818d53c93554264657f44edc1591dccd9ef8ee9f10e993a47a72e22945b6a97a931f1f8ae9b20c6a7f8b63a3f55af247ff52272871e7d9cd3f174f115319d4469dc518bf5b9a82006b47b95a8f81fbed88d68baf945e38e4f21e12ef224f9cd0dee6f68c3edbcb16b60cd22d08554d7d945506c2c8d3464468bd1f9327e7ec289dcf1aa6070902524c917d993dd7062175a6feba5870d3a2d6a13164fe2a467f24ab52184fe51abe509f8e4a7f51a587e3697acda63da1ab4211b2a0d9428810f938ce5678b492462fda6de5b50d2d2ec69ac466cb7dfd3f0192738a6bdb66ea7c40dc2633144541bc0b826c3c8111674a01dd90d619cd86de60f4bfc2ee6433b890cd21d862ac28cf135c49e5fbcdede6c3edca7335f972ac5f6d70e3c559d4d62e1d2b9ccc103af6eaad1f7b60a374dbd4174cd792e1a52ea74c32de2fac154dcd771eed98787e64d765e5910b3fdf3c6c87e6e81adf0e50591d0df114c20518fc74f20ec56c907a75f1bdb5bbbbe91c36d79bef0a6778324b0b8ec5423f8912ddaa08f9bfa9099ea1fc0190f8dd1ed7734d145c8c1d30a17caf5aabcedcbca59c0e8f15427bd132c54bbe13464dee559e046a9e1e17a46a34fad428c3f5b0944d8a9ce7ec3ac0ddb49025f01f84c3ef65447f86604690407d34116b000fb0ae74b5e0eab4a4a1877cf227e4ea0212fbc4249ef4d616973b335b7217b00f45a4e1f5371e1f24d3338f93bf98a471fe4addc9f116a1221790f0cdf7ddc6b41eecb35fdbc1921b9cd3893a6edd2e81a3957c590c5eb9838f923f1be097952ce64342daeb11e0ce0fbec1393455bc77e7028cb39cc67971e2f5afabee043ecfc16c8f35bc3a0f6137029e35339ecee161fe079c84dca169e6025c9f36745f354e093bc0c14efb74e60496ee00e8b8893fdc39051bf0d38ce821edb2501a643e7be3ef33a9aede8d89775bd63edca7bb6492304ca3ed4d276eef45b56d0db0172cd44c2a43466934cdb03c61022976418a069b1052702d30a27efd48b70cdc4722930a0b4c8989b39321bd1672e872218557ad2e0d50bd577b43b9e1f1512a6a27bd4edd73830f946636ca7edac4bd37f3ae1fae9b75bfca67e4e62f6d0120b46b36183442a5a8e851f1fdd583040bf47ab8b11a2a58bed21d2f4714a54a4318fee471a38c21a4fb409b15ac5862a9fc76e721d2b004de67ad6fb380fb23b9ef2f78cfae8cfe73a241f552f990e9d22cb5845a5aa8f233810d97700f18f8f8a3b88f1b333850ecdb60d0b07b1b9717d310232088985330a1a38d50c8cc3095cdd70d5358f3b46851f0c086d3445c5a437ae76ad61bc48eeddde29568c8529eadd46007235a6859dea1e3e1026b29c89a3362ace7194dade26618bbcb274469005368b0a409121937ce437afed8b0eafa1e96e01f68d8a7b95510d118c240c42ec622653c434fcb8f8a418e77f4389f19c0c5c2b97b919ab4fe9b309ea79dba6ecc4138bc9587af80a81c750b208c86e4a4d17b98bba3ec3928cf260f418314bca3ee6d9104dffc605a9a216ef8904d5614c208109862373b3674f687c40872eea157dd59f1d029b19b3c037218a095b83a0d41c1c42e208a3231c349d6579df01869e3351b3a0ed05597d1dfec477a9c3835e82891f1d47c6ea0ec9112b0c4fe1753fd0b9a79213f6064c6841e88a87cd063c1f01f6c254b479f6b74d7822b1bb00a1c27102a26c6ef7b18c9079734ffabdbfc8bfffcd240e0fd821877ca5e17a36f236d3515c293e6fc06bcb4dfcea9dc8d6ecc95dd9e0258bcf5ca193dee65de0ec98acd46663031b0e70ff46afc29c1f76e092a91773a7fcff6fc84a54fcbee0cef05ffe5c567643bfd33c71ddf447468518b2cc3b852fea5642d18fcd4a877afdcc82244567f5ae6e698f7b3a49913511c7ae1c23777a3137b13bf23fb7414639f7b93a8f69e7101f2d04b8140659dc00579cfb09b9196816c7074385500ef524284676d16727c3007464ee24b18a8ca830e8ed90d2b009cab772930607880aad9754935ed1518834c44f3bbad3ae63926ae1078e1cfaf14e5c2a7d878d7f59f124dee920f66419999fc5da9aee19f0a64c41944ac335d5f8a31c2ff3bec8fc70e35dcecd8321091799db08e9d6f3bc3f8bbc065b7662036c5d3ec49ada5b630e56180fd2e8ec3df903a267481684c48e4e44f5c334313c718af629317d08ac81bc971836f181d60d261254d3f832e9af30953adc72c8020062477311d32ac250c5b9d46fb879579a43cdd02f7f23f58ce44a1c9feac8f2bfea8d8bce26bbc798e60caad51c1b8328b704b5e3cbb39d61c1b0d2e5cf539a29f996e05ef0da7d67c9b017f3143ad0b8d8cfcfa1df9d16bebfd2753a63f41a33f49c9629eef06165b88ee8a3968c6220ba3077786743b", 0x1000}, {&(0x7f00000016c0)="d7817024890e0a104d66aa4e91c392177e392a7c0bb287fd633c90b2e53661d67c0f1d419804e37053fb99c74a83407fff281402ca2e3f77783c9c732278efa027b16946d2fd228b4e748cb5c338ce9235e2a518cbe7bbe35b94c67d09782005cea549762e2f5367bd528f31736870f50f75", 0x72}, {&(0x7f0000001740)="2c9020479693c2ab87531bc644c35016a079492b8465e2f35107291f1640ad2887ddbb0446dafabf1af1a1383c4854448b44be79cb67d50108e29c8b07fa305c763bf312d5e6a3632b82b8f141e7d090af2e0f159a2a2ac729dc1c00d395c13037d567b64e4a6475f962a95eb9d12fe91138a589d0a394a8ae330d427ed20125273b37fd6efcb14023903d4a2502dd7b4135cac703eb9ad8db054e1ace1fe2257cdf56928ecc470e973c62c81acbc1fe7823fb36b83d7f0427bbc84492819a", 0xbf}, {&(0x7f0000001800)="32529f144291ce92ce590d54159e75a668a7d8b51d1efbed39d514c781ca1f421646fbae73eeeae7de0b16b2552cb0aa62bbd36cbb1d1bc60e98dd0c8a10c72bb1116b332f3cd72d8a39", 0x4a}, {&(0x7f0000001880)="834a5d521f8283228ababc30079e76d4e18f3e29d7c9f4a0a5eb0dc88fd67c61e4ed5ac904b1eb912aa57c719f67cb0c33d4c56b32fa34b31ee6ed31f8bf4a0df775269d862aa5706b7ef4f33c615a05316210545d541d58c5bb332fc9c8ff16e2375c4d98d480f7898254ffef594167a98e4e16a780c3e2ec77f3d4d7402a62", 0x80}, {&(0x7f0000001900)="14f3dfd9b92ace835bea9be7bb0f06b2802903be2571f4f7127c77c35985c4154e5c829b731e8b323de1fa5d78cc8b041ff653b20feaf025e21bebd1c33db0e91495f08f1a58ec56815993751a37aa19aee02d4df1a6d96dc5ba46385090d42f907cf1494036810266183692be07b3ad0d9f4b8552f27ef2421eb61fa48ff3377fadab337db37c572db24ebe73aec2c1d68fbcf6a59b7a5ae3e170e549d2041b8c9d647eb8d9737e42ab34ee48499fd1b55ecb2ef5094aab4b17e8def93b863c83bdc22ca71c8fdbfca71be20a3a8895", 0xd0}, {&(0x7f0000001a00)="ec51f7bf99bb3700b171a6aaac3bd9c23610aacde452450a76", 0x19}, {&(0x7f0000001a40)="f2609373ce40127b248d3c38ad85f2ed4cc8e10e56c5eacf137fdcd17087d86716e3e9d9823de4ac87759dd26c776a3e16c71a542e864f4d11f7e51238f3915a2ccc9ca7e6116c803491f7b32a478a05308df099e85bbe1efd6760eeecf7ea79e7e68292a1d03ee929a0a75c70f15c6d75e0b1cbc825ccab278793da285dcd702bc11e483858d873e4ca80e3f790362aafe3c6dccb8a7aad4637d4a0509044d9268a1fc1eec44b464bb03a06635de9552b68ae44d915a188b330f7a8f2af68", 0xbf}], 0xa}}], 0x2, 0x1000) fcntl$addseals(r5, 0x409, 0x10) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) sendto$inet6(r4, &(0x7f00000001c0)="c130f8c854c055e933bda4912e6e890424f31d7ef8f271b5b7223574b2d669b76920b869a1fce754d09b", 0x2a, 0x80401, &(0x7f0000000200)={0xa, 0x4e21, 0x8f, @remote, 0x2fd}, 0x1c) r6 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r6) ioctl$LOOP_CHANGE_FD(r6, 0x4c06, 0xffffffffffffffff) 03:44:35 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x1d, 0x50}}, 0x1040}], 0xffffff5f, 0x0, 0x0}) sync_file_range(r1, 0x5, 0x5, 0x4) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r3, 0x400454ce, r5) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x60cd00, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r7 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r6, 0x400454ce, r8) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r10 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) ioctl$TUNSETGROUP(r9, 0x400454ce, r11) stat(&(0x7f0000000440)='./file0/file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r13 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r13, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r14 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r14, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r13, 0x400454ce, r15) r16 = getegid() setgroups(0x7, &(0x7f0000000280)=[r2, r5, r8, r11, r12, r15, r16]) r17 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r17, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TCGETA(r17, 0x5405, &(0x7f00000003c0)) 03:44:35 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000e1a600"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") listen(r4, 0x8) 03:44:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msync(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:35 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2285.731182] binder: 30503:30507 got transaction with invalid data ptr [ 2285.746772] binder: 30502:30514 got transaction with invalid data ptr 03:44:35 executing program 5: r0 = socket$inet6(0xa, 0xc01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:35 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2285.746799] binder: 30502:30514 transaction failed 29201/-14, size 99-24 line 3316 [ 2285.746934] binder: undelivered TRANSACTION_ERROR: 29201 [ 2285.751239] binder: 30504:30513 got transaction with invalid offset (29, min 40 max 104) or object. 03:44:35 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) 03:44:35 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2285.751268] binder: 30504:30513 transaction failed 29201/-22, size 104-24 line 3379 [ 2285.751282] binder: 30504:30513 ioctl c0306201 200002c0 returned -14 [ 2285.772416] binder: undelivered TRANSACTION_ERROR: 29201 [ 2285.777312] binder: 30515:30517 BC_ACQUIRE_DONE node 13383 has no pending acquire request [ 2285.829127] binder: 30523:30526 transaction failed 29189/-22, size 99-24 line 3138 [ 2285.829376] binder: undelivered TRANSACTION_ERROR: 29189 [ 2285.835574] binder: 30504:30529 got transaction with invalid offset (29, min 40 max 104) or object. [ 2285.835604] binder: 30504:30529 transaction failed 29201/-22, size 104-24 line 3379 [ 2285.835621] binder: 30504:30529 ioctl c0306201 200002c0 returned -14 [ 2285.851450] binder: undelivered TRANSACTION_ERROR: 29201 [ 2285.913566] binder: 30535:30536 transaction failed 29189/-22, size 99-24 line 3138 [ 2285.913768] binder: undelivered TRANSACTION_ERROR: 29189 [ 2286.003017] binder: 30545:30548 transaction failed 29189/-22, size 99-24 line 3138 [ 2286.003287] binder: undelivered TRANSACTION_ERROR: 29189 [ 2286.064627] binder: 30503:30507 transaction failed 29201/-14, size 99-24 line 3316 [ 2286.080079] binder: undelivered TRANSACTION_ERROR: 29201 03:44:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000300)=[@acquire_done], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:36 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x2df, &(0x7f00000002c0)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r4, {}, {0x8ed914d01c707291, 0xffff}, {0xaa08236e92d0859c}}, [@qdisc_kind_options=@q_sfb={{0x0, 0x1, 'sfb\x00'}, {0x0, 0x2, @TCA_SFB_PARMS={0x4, 0x1, {0x4000004, 0x6e4, 0x8001, 0x2, 0x1f, 0x8, 0x3ff, 0x2, 0xffffffc0}}}}]}, 0x30}}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000080)={{{@in6=@rand_addr="587ec315c275abd7010c3e26df68fdff", @in6=@empty, 0x4e23, 0x9, 0x4e22, 0x4, 0xa, 0x80, 0x20, 0x0, r4, r5}, {0x7fff, 0x100000000, 0xfffffffffffffffa, 0x1, 0x5, 0x3, 0xc8, 0x3}, {0x5, 0x5, 0x80000000, 0x62}, 0x81, 0x0, 0x400b27f45d244cad}, {{@in=@local, 0x5, 0x2b}, 0x4, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3505, 0x0, 0x3, 0x4, 0x5, 0x0, 0x2}}, 0xe8) r6 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r7) sendfile(r0, r6, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:36 executing program 2: setsockopt$netlink_NETLINK_PKTINFO(0xffffffffffffffff, 0x10e, 0x3, &(0x7f0000000040)=0x8001, 0x4) r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x18, 0x0, &(0x7f0000000280)=ANY=[@ANYRES32=r1, @ANYRESDEC=0x0], 0x26, 0x0, 0x0}) 03:44:36 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:36 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="00000000000000001f4e6ba324c285ced799afe7326be275b620e841b4d77a43e8b52bf13ec46c1115cc818c0cb6a250be84591e627a79a01181"], 0x0, 0x0, 0x0}) 03:44:36 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0), 0x8}, 0x0, 0x10000}, 0x0, 0x3, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x10000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) prctl$PR_GET_SECUREBITS(0x1b) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, &(0x7f00000000c0)) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) timer_create(0x4, &(0x7f0000000240)={0x0, 0x1b, 0x1, @tid=r1}, &(0x7f0000000340)) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x11, 0x800000003, 0x0) bind(r4, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000200)={@remote, @rand_addr=0x2, r5}, 0xc) [ 2286.567670] binder_alloc: 30559: binder_alloc_buf, no vma [ 2286.581005] binder: 30559:30561 transaction failed 29189/-3, size 99-24 line 3284 03:44:36 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fcntl$setlease(r5, 0x400, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r6 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r6, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$selinux_load(r6, &(0x7f0000000180)=ANY=[@ANYBLOB="8cff7cf9080000005345204c69097578a83f6e1e7197dd1f210994af8e5521d743b0479c6a0525505a8ade06a4375c136d3042d3ae74c65da31cdbc130f3eb35c66df81dfc76d5609752123e8651c66c3723ba69475de6fdca05f660de5d887948d144f13bf0a98eb6b73f57a46f0783d9"], 0x1f) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r9, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r10, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f0000000400)=ANY=[@ANYPTR64=&(0x7f0000000300)=ANY=[@ANYRESOCT=r7, @ANYRES64=0x0, @ANYRES64=r1, @ANYRES32, @ANYRESHEX=r8, @ANYRESDEC=r9, @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYRES64=0x0, @ANYRESHEX, @ANYRES64=r10]]], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FICLONE(r2, 0x40049409, r3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_binder={0x77622a85, 0x100, 0x2}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff2000/0xe000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff3000/0x2000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff3000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff2000/0x2000)=nil, &(0x7f0000000300)="0df58e305c80610313db5b565975179e8df13e7d189e25abbf65db70075d1ce2d7bae079f3c04ca368ed391ce7d7431af29f6a52ad2e847cb044363e817256153ea5deba3314409e0323ef28672c7dbc30b9a7a156d25e0cf529902a18d3bb5289cfbffa11add7feb9fc9fde5c844725de780404d9e52d490c39b4da9726e4edba7b73433e", 0x85, r0}, 0x68) [ 2286.593586] binder: 30557:30560 unknown command 5 [ 2286.593594] binder: 30557:30560 ioctl c0306201 200002c0 returned -22 [ 2286.596719] binder: 30562:30565 got transaction with invalid data ptr [ 2286.596746] binder: 30562:30565 transaction failed 29201/-14, size 99-24 line 3316 [ 2286.597009] binder: undelivered TRANSACTION_ERROR: 29201 03:44:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000000)=0x0) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/policy\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r2, r3, 0x0, 0x7, &(0x7f0000000180)='vmnet0\x00'}, 0x30) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 2286.619327] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2286.678363] binder: 30573:30575 BC_ACQUIRE_DONE node 13397 has no pending acquire request [ 2286.683122] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'. 03:44:36 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x3b) getsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f0000000000), &(0x7f0000000080)=0x4) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/policy\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f00000001c0)={@in6={{0xa, 0x4e24, 0x0, @ipv4={[], [], @rand_addr=0x90000000}, 0x7}}, 0x0, 0xc4, 0x0, "a6c2fd961156e21f143a96ccba4da0b0c85580458763a30857b2d287e35259669f0d25f6c1812233f8f69ead715d3199fcddf3c5966a2fc9ce0cb57f79d7b8212de784c9b159f58fafd2d5d029e7571a"}, 0xd8) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendfile(r0, r2, &(0x7f0000000040)=0x40100060, 0x4000400000000000) read(r3, &(0x7f00000000c0)=""/145, 0x91) 03:44:36 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = accept4(r1, &(0x7f00000000c0)=@ethernet={0x0, @local}, &(0x7f0000000140)=0x80, 0x800) sendmsg$nl_generic(r2, &(0x7f0000001240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001200)={&(0x7f00000001c0)={0x1014, 0x29, 0x400, 0x70bd29, 0x25dfdbfd, {0xa}, [@generic="739b0660abcf7347cd2abc5ad57eec595b1e2fd7c0272ca991703528bd94f7c15384c1d49697b91eef4bcc3b31cd62a0901b6612f8562faf8bfd2dc2d3b6fc266e0290325db72393d0c103797c890919f31ca5dbe661699d0c77a9a07224de1ff11e0c8baabd00ab7902e7b48fc08d90039a9c98b9048561a4dbecb37db3615399a2520a938f94f30bed65f68666db820f8c91f9f0be8c6a38f4e065c026bbbfeca718169837961054380bbe79367f08cf238b45d74e6c2eb36f00c0b6f1a6c3a9efeaa78e410329cbd4562b004453b78ccde00859d75e6c456561525a4ead6efbe4f768a710ab54de3fd72556ca226e3b379d651a3339019587532bdf371d82027ceaf432c69838e76e8fefaa1eef9ff45c79335adea48d4d2a5bfa7bfc8ace984941019bb8a3debb63cb699abc408a29f6ede5b56473cf55b5dafa576b4303adceb7c2254ab7d40ac419e12e3658b91f5c105d165146b2754608a2012af6ecdfa6aedd44e5d1a2df1224bd6b3a54d082e314a32ad5a8e25eef23c527099e2250df51fb0b32a796fd503d4cb22882b00e143aec4f2b6f6245ac621a4329a4eb9ee1ce3e20f993b466c1d7ca417bf3a996a4d2183aae996faa62c11237ca7989a3db205a2c900842286fd1ca6387441ade8be7d3278ff070ed8bdb3d2f80d442365a98d237c83ea2fc028b71946cc47e3947474b5790a9c747a308843bbbffc27c561167c554f5e6d46622aafac40a595a649e12560f5be5e91918ed1c8013f6f2eb72da9530ac4397708fa13939a9122bd21fd1a2747b066421754809eda53863df35b38bc48cbe715612929abb5d91442b7d662e58523cc4fa20bbfa18bacc5425bcbc2c899913dd32a1dd21ee83510a0e7d6f04708f6212143ae15162fca75443b7ab3be3f3972e2b2b559389aa2e3eb7f24a513ae232942b121103ae4ff0b29e4797a473be3f244825dfa44c42980843bcb59f89969f2b0f614aee1f9ae5c7a3307dd53a591271911650d3c55b7d244073d95eb1f2ad1e15224f7ec4dadebd30957b63bc83fc5e528262a30b02e3cfc7548991c4337697dd684c974f2bb126525edf82eda0fdff536181babac3cee5089ce9b63182a956d527d89ca087b449450c2c53593826b9404419327038a0c3d2f3ccb1f49cf1a9f9c3e9efe6a8a4f6233bc7e14ec85a463c46cc122b5ce16f00444fe6c5c52245c581f1c9b73d600e2f20b02dc79039ab53eacad9eab8ae29ce59179bd016e63d382c1dd9abbc1c9a4b0f1927a84e4ac5de7dd59e92ed259d41296c0fafb3494d082682c0d68c57fdf5791794090fecf6ae0c41475c676f4cc2fb5de9ea2634852ceb27099a39213eb620009a712c75b150cccc8442ef1cc8dc475a527e1db80195573d5971e8ac5d753c7f0b0648f0fe5c61d4780074e8f3f71de5a6d21fc8a8c16dc58b48f6a0c49e057482247899376ea7a9c78af8c256f96a998e1b5c4b5fc166994c344467aa0662c87abf74ab1828a08a5fe0ba653f301833bc43ca25b1957d749906b36efb5ca42b94ef9799f4346a5756b465e1ec3d6e92578b1510fd4ec0828812eed93881680aa3dbab9a8868707bb5d41198c5ad4177bf88ac7a53c340074aece0aa9a9ca8ef484714ad57ccd9665683bee7efba1db28da3afb36b3b2686c344ca5004d2f4b5319c6d259f5f9bc03e1e68d1837b5ca86fe646d3e7166906590128bc95097f28e782fd0366260a0d158dec4330bb25257129d33e8aec321e2f80ea44607f87833e46164be32debebc604a026634fbf8eb9ee38dc1b106d6583c8f126873a8fc15965114311cea01212cde0ffe48153a5fe19c3a4a899b996c9616fc065867640d4e72ecedc7511395ea7b168a81ddfc17a6d6d92c03b771e4e3abf7796d5ac7cf03f40287833f7217f9cea83364fe536efc8662f775c8001a781658b344a1df07ff78815635fd07a3c4ce1d3e1d46b1e3b2585026faf400c1c3d885addd1da94d1f8ae66ba97dc7277828da37c8d685ae4e539bda71ab6c94dff28b40a2a81fe0156fdf6efb20839b21f253a504922da7af6beb3ea215165787b7e7700a32b896f0020f126d1e042f012b0518aef211af8fd693b3b9344e3b9d2a9878f3fd54dcebf74991c08c2d0b11ca687868aec9632f290635409afabc2535b9d1cdd665497c8da2e8b2851b4c1ea373ee9829878ac7f99976ffdf5a9ad4cef1eb50482ee162a8f75f575663dd8b97e389cade0c9bef1a0306333b36bab46540fdee49cebc7c25d6bee220ff01fc323b26fb3bb534e0f07e8e9e5f9826a763caf223cc4685a68619e9d1e06488b9f43bb849fe4ab0bdc42e8d6c9f81daf81b38bda449de6deb0d19e2a0f3aa0ecd6a3c88bf60596d89b1d60fc380c76792bf1880021b8fd4a7c7e2df211720c7eb2e115f279bdd8891666fa44af34904ba0f85dbcb953c6b62691461b5a9d063989134324411beb111c7a73b467d82b2fd1bc4bee32de69620dabc00815f99a6777ba9941acf263f07d73e0d4438f85147b6daa5a7a3f1d33a0172fc3efcaeeca2a24df187885d63bdd9bc145f42eabb6e9a7cd4769ab7ffaaa8300be790a0b36998f1fdadb2af317ea691a61279496bdc2fddfb723301f10d43c835d4e1f796f4b6db85e9d7256d9ff9f787c5c8792b810e9aaecfe7514b85f5319b789f70c504a75213075e1c2821e0d093756b4cfaafb5fa942fbdfb89239aa1f5de80357c560e95ba9b90617534b4391d9a12e89dbac4e399d3772f5d619c39593f45a8b1263ae27d8e557a8c5b0abf58a7312198ee33e15600f693dd0122cca5a152a71dc2c74da3227d88fec3c2801f65c67b944c1e3f015ffd6ece3c083350b91da50aebd7439d8568dc34e9bcb52dbbfdf4799902cc5c4c3abf3b9ee736292dd7c41a43ab5bef47c55ba14f15302511454436948a224834402f5d65bcec29326371fbd673b31bc6884a37d64e5bf93025dc4dde0201f5fb029f8b38c83852223f745b3644a8369a4ba6311a038908d0dfae1cdcbe88995c5f20a1fb42e2aa0cd10487df04ed32d8576219452f7c316ac33a4583f692a26b264f8ed1293027f9e948d882933fc5723c59ea933690d531154ae9e1970c84046a4cedab0b632b4e8924d4cfe5ebded588ac005dd01ad7b8d76c4014f12d0639c4db110274e491490bb9eb9d19fc2b444ba751913fa03945232d9f290b74e1ecf0eb640bdda521130fd5390e78a6ee71a95af8701207f6d1708537b9f46745a9154d740cdc9bd644ecb5df97aa61e3e819b350a20e9b812c66dc8e19d98717748420ce0a6386f5dee1a8dcc7d8cc7669e2f131150cf83296b5167f07ab229649bd2e6b12924eed58d9cc53b987a62cb51131a76266c58c9b1a80cc0200fa4fea9c2ed0329d0fb7f58fbc40cf2aa01021b9b2de8bb75741ecf79c63224bd963cd80571cb1852b53d21b86a3ee85f440650a57ce3562cf529133452508608eb1f8742d573e5b6c75c728bc4f90bd1ce65b39c7ecd7929328e3b7b4a5d36a84abb626d432058f7b9367399c70f76704346455fcfd01e3186a0c860669a197be2be93fc4dafc33258eb97aaf73adcec610824e66101834eb3f43fbad800de2127a659106cc84b97b473c8a31ab729c71e5ab13a1987ebc35330766759413790062da7be6c4736eb43cd3c384af45577ca9950d72f4809a72fccc4a75f4fb06ea1c63c8a13d49586da1504bc002465b38b80f15e21827c7b00adb4d43656685d3e257744cd08ea88ff3546f24d4776df03215463d6df562b210fd49b650dae172e4504117288b67e099a56ef372d6e5679ffc07c82d5b1d7e6b79ae5964a5f07bef52f49590866dc4e192158e8b69a0a7290daea5375ab7644d45653588fe294679457bdbc32fca3ca009f84f93bac09d5d032840295171b0d656a18f20678a196f5aa3e4ce26320b0243456e98fcd15d2058332a58019d1866940464811aaa42ca7adf2c012b7b6029c868d06d65e9c0e8031191549caf81242ea8ca56acafa2bbba7634a41d535d7e3ec15202be1fa444ae81dd77f42397f9600162adaaca49599a70618ec235bb860c9183746d91f55bc5cec1214f515f4f21d5837a06bda0d1cd4c99eee4b39df4e7912cdb1fc869bbfc1ac4feef1a29bc6a30ed4eadfe7564b6460437c18c6890f2a6267e399757dcc751823c2583aa875ecbddfb1e098ba15d1a72dabfa9fac735460212ec4c1d30f0849c07f74bfa500c22e1909c53f081b52c8ed7c46a7f69dcf1b5f4a3ae396832f85a577a870c29a7a66b71df84246aed5a3501ae8cc582e1ed457db66bda8e79b2621a20e594ac35986a66f98b9355a4758a68b37e02ef8f4044053e2790adf432bc03a3cea453e18d1eb3c7fa95771ed743a6d41832f86dcb19b1cdb0e40701a773369725cd5a04453af39a7c3b8d84635cc9bb29b251740f85007c60dacba8009079b3bd750f81aa118166701c6afccc8b45daca988bc96371061678934bf56ee508ab29e6a56b5d354054202b3437d2df486d93470d7feed032a61aa81a72393a94c2447924eb789b218513b3bba5788ecb849334fac31ece245646b19ac73f329a927fa4c61478bb7898b02e74a54d652aa0873f5ebf30f768fe8c8605d7f29a744a867b6ca3834280d6168299b94a10e5cf5b10a1989b19426747241072a587901f1ce84f314b41eb6e224b2d831f42e887e5d726c1c413c417a0a490f459bce52017cb4844c4d9422e84a0d629c005ebddd06eae4c3110c974655798af5f00a51894ee9999eceb814be7204ebaf675a978a228109f62de27c4f7ac83c0becb6e56c3804655e8809faacf2b459ac401bbf523e73d685217876b27681f7c8e1127f55bfeb73483ba2db5c9245dc23a12f26bf8982576bd6fe3500864d9b6055ac37c059cb71ed29c8b0cef74328ad3b7fcca8dca75b66efd08b37a7f797a6699de1cd3d266c04688d4d207287ed7512e174e30748c674153db30f27c2a8f7a4c5444da33998fac7f955773f14c5bdc3a6bf0a3277e12ca018c283df359eb3b76466969d27f7d6696274be2e8712ae570373a09e41d85435e3e378b634bb22f174a347245d349a354a028083269cd8331814f9f81984a0ac98ce067fcd3de74277072ea0a0644a7a2f05d98d034e2e450af21ee17d076df5a91ed16659a012d00968f0d4e6da909c9c7b3684d50f95b178edc59a31f96a9edcec73b6d2f8846d7a57a9977c8ba8705df71f0ae76f6c024f53028545c725e4577de99c035f54570aa282952ac6aa1b10a6f8b85f94d12cf05fd2e5710b693e308ebd7ab1c331b4d7bba3f8d4c2fd7f05388dfd56c4605bc64a8b56f9bca415caf4d75432dedcc69d94134e5efe99c81b7fb6c36b40d5ec2a9f79be7b3786fdf15bfff8e638586710ca079d802f6bdfb86afebe998c27a06fad99e54a58e3b9aec7dfd7dbfb05d7012b6ded0089630bbf6fe65f018992749b7c173d10514311c433cbe1e0a6c57f78c07cb0c251b9c8bafa37301a61dff59e6db838b92916dea0a3771a942da6a747fcc1a2d592bc8cac8c43843f8a95405888c66341021ccdde17867f941aab63037a6a7a1f7e47fec1c43781196ff8e32b585e947b3f9db407a44d9994dd607654d8a2eb1ee496def816efed88b2c7aeef95c4039f20f38c985f20c1f56a8087125d98d64bcf947338dc8172d35e044d7429f917cf5ae376f5b7ae0ff51fa572da1c0977c942f746f026871c3155800ced5d1e95a5cad598fd1b05035fcb958223eaf8442f68604faebf524321"]}, 0x1014}, 0x1, 0x0, 0x0, 0x4}, 0x8000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) [ 2286.689587] binder: 30578:30581 got transaction with out-of-order buffer fixup 03:44:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) read$eventfd(r2, &(0x7f0000000040), 0x8) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00') writev(r3, &(0x7f00000011c0)=[{&(0x7f0000000080)='8', 0x1}], 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, 0x0}) [ 2286.689614] binder: 30578:30581 transaction failed 29201/-22, size 104-24 line 3525 [ 2286.689951] binder: undelivered TRANSACTION_ERROR: 29201 [ 2286.691446] binder: 30578:30582 got transaction with out-of-order buffer fixup [ 2286.691470] binder: 30578:30582 transaction failed 29201/-22, size 104-24 line 3525 [ 2286.691810] binder: undelivered TRANSACTION_ERROR: 29201 [ 2286.704109] binder: 30577:30580 got transaction with invalid data ptr [ 2286.704154] binder: 30577:30580 transaction failed 29201/-14, size 99-24 line 3316 [ 2286.704798] binder: undelivered TRANSACTION_ERROR: 29201 [ 2286.799913] binder: 30585:30588 got transaction with out-of-order buffer fixup [ 2286.799941] binder: 30585:30588 transaction failed 29201/-22, size 104-24 line 3525 [ 2286.800292] binder: undelivered TRANSACTION_ERROR: 29201 [ 2286.801428] binder: 30585:30588 got transaction with out-of-order buffer fixup [ 2286.801453] binder: 30585:30588 transaction failed 29201/-22, size 104-24 line 3525 [ 2286.802664] binder: undelivered TRANSACTION_ERROR: 29201 [ 2287.128447] binder: undelivered TRANSACTION_ERROR: 29189 03:44:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0xa}, @fda={0x66646185, 0x0, 0x0, 0xb}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x400}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:37 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="000000000000000028000000000000005000000007370000be1f69cad880f72e580199060ae61b0f6219160921d008512159d6696f3950c72203f820a73c1e5bcbe7ed3be544668060f2fd7cd727e9387edccbbfb064c500dd0ad0375a92c720ab12476e246b21a7c77c65bbc368550c2945cf5f21aaebcf3733a9016211018ee629bab3da9c26d06350b7e45699f103af8a1a9823337ce533394e08d396d94ae53a981f216a9db8a391beb358c83b21621ff58d36e98dac0959e8dfa75d43265abdccf1fd7ce06c58bcfeef"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) fdatasync(r2) 03:44:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000040)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="f4"}) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) r6 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000012c0)={0x10, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="03630840", @ANYRES64=r6, @ANYBLOB="01634040"], 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x154, 0x0, &(0x7f0000000500)=[@reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000180)={@fda={0x66646185, 0x9, 0x1, 0xb}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000200)={0x0, 0x20, 0x38}}}, @free_buffer={0x40086303, r6}, @increfs_done={0x40106308, 0x1}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000240)={@fda={0x66646185, 0x4, 0x1, 0x29}, @flat=@binder={0x73622a85, 0x3ddccb3674aab530, 0x3}, @flat=@weak_binder={0x77622a85, 0x1100}}, &(0x7f0000000300)={0x0, 0x20, 0x38}}}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r7}, @ptr={0x70742a85, 0x1, &(0x7f0000001300)=""/4096, 0x1000, 0x2, 0x1d}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/43, 0x2b, 0x2, 0x8}}, &(0x7f0000000400)={0x0, 0x18, 0x40}}}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000440)={@fda={0x66646185, 0x4, 0x2, 0x28}, @fd={0x66642a85, 0x0, r8}, @fd}, &(0x7f0000000680)={0x0, 0x20, 0x38}}, 0x80}, @acquire_done], 0x0, 0x0, 0x0}) 03:44:37 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x8000, 0x0) perf_event_open$cgroup(&(0x7f00000000c0)={0x2, 0x70, 0x3f, 0x3, 0x0, 0x99, 0x0, 0x80000001, 0x20000, 0x2, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x8, 0x8000}, 0x2000, 0x3, 0x8, 0x1, 0x6ef, 0x8000, 0x831}, r1, 0xffffffffffffffff, r0, 0x1) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f0000000180)={0x0, 0x98, 0x5, 0x3}) socket$inet(0x2, 0x0, 0x0) 03:44:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000006300000000000000180000000000000000000000000000009040cbfe94498264d707fd285cf745ff7add5448eef1ccfc181baad9d8860701b38ea9e3d18afe84dbdbfea59ec183aa97c139faf5977ebdc01b92457c99028b383d0e920c3881e3d513b901d27ce7eb8fc4eb8d49b64124ab42d99acb81af1ee0ef560eca5d61d65e80e27a521ec4d78223f63ef170701f6acd1478c7d2cc0d949a591956deaf7cacddf658eb2e09f8f708d689016714510110b7d0fb2d94a6a99884366219326aaa22625928e866159e5c8e77dcff567ab44f65", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x400}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:37 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="1000000000000000"], 0x0, 0x0, 0x0}) [ 2287.490195] binder_alloc: 30606: binder_alloc_buf, no vma 03:44:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) [ 2287.498693] binder: 30611:30616 BC_ACQUIRE_DONE node 13412 has no pending acquire request [ 2287.498705] binder: 30611:30616 got reply transaction with no transaction stack 03:44:37 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000000000)={{0xa, 0x4e23, 0x8, @local, 0x5}, {0xa, 0x4e22, 0x7, @mcast2, 0x7}, 0x627, [0x0, 0x1, 0x80000001, 0x4, 0xfffffff7]}, 0x5c) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0xeaa1d589c2cc85ae) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000300)={0x1, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1c}}}}, 0x88) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x58, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="116348c0000000000000000000000000000000000000000000000000000000000000000068000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYRESDEC], 0x0, 0x0, 0x0}) 03:44:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) ioctl$KDDELIO(r3, 0x4b35, 0x5) r4 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:37 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt6_stats\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BLKRAGET(r1, 0x1263, &(0x7f0000000180)) sendfile(r0, r4, &(0x7f0000000040)=0x40100060, 0x4000400000000000) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$IP_VS_SO_GET_DESTS(r5, 0x0, 0x484, &(0x7f0000000200)=""/41, &(0x7f0000000240)=0x29) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x11, 0x800000003, 0x0) setrlimit(0xd49cf4a602c4937a, &(0x7f00000001c0)={0xc860, 0x3}) bind(r7, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r7, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000080)={{{@in=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x16}, 0x4e23, 0x200, 0x4e22, 0x9, 0x2, 0x34b816db95506629, 0xa0, 0x78, r8, 0xee00}, {0x1, 0x6, 0x9, 0x1ff, 0xfffffffffffffff7, 0x9, 0x7, 0x5}, {0x9, 0x6, 0x6360}, 0x1, 0x6e6bbb, 0x0, 0x2, 0x1, 0x1}, {{@in6=@mcast2, 0x4d5, 0x6c}, 0xa, @in6=@dev={0xfe, 0x80, [], 0xe}, 0x3507, 0x0, 0x0, 0x8, 0x5, 0x7, 0x7ff}}, 0xe8) [ 2287.498714] binder: 30611:30616 transaction failed 29201/-71, size 80-24 line 3046 03:44:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TIOCNXCL(r1, 0x540d) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) prctl$PR_CAPBSET_DROP(0x18, 0xb) [ 2287.501360] binder: 30608:30612 got transaction with out-of-order buffer fixup [ 2287.501387] binder: 30608:30612 transaction failed 29201/-22, size 104-24 line 3525 [ 2287.501654] binder: undelivered TRANSACTION_ERROR: 29201 [ 2287.509029] binder: 30608:30617 got transaction with out-of-order buffer fixup [ 2287.509058] binder: 30608:30617 transaction failed 29201/-22, size 104-24 line 3525 [ 2287.509437] binder: undelivered TRANSACTION_ERROR: 29201 [ 2287.567503] binder: 30622:30625 got transaction with out-of-order buffer fixup [ 2287.567530] binder: 30622:30625 transaction failed 29201/-22, size 104-24 line 3525 [ 2287.567669] binder: undelivered TRANSACTION_ERROR: 29201 [ 2287.568456] binder: 30621:30624 BC_ACQUIRE_DONE node 13419 has no pending acquire request [ 2287.568466] binder: 30621:30624 got reply transaction with no transaction stack [ 2287.568474] binder: 30621:30624 transaction failed 29201/-71, size 0-24 line 3046 [ 2287.576505] binder: 30622:30627 got transaction with out-of-order buffer fixup [ 2287.576533] binder: 30622:30627 transaction failed 29201/-22, size 104-24 line 3525 [ 2287.576781] binder: undelivered TRANSACTION_ERROR: 29201 [ 2287.597841] binder_alloc: 30623: binder_alloc_buf size -52363845448169384 failed, no address space [ 2287.597847] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2287.597864] binder: 30623:30626 transaction failed 29201/-28, size 99-24 line 3284 [ 2287.598010] binder: undelivered TRANSACTION_ERROR: 29201 [ 2287.622552] binder: 30629:30631 BC_ACQUIRE_DONE node 13427 has no pending acquire request [ 2287.622561] binder: 30629:30631 got reply transaction with no transaction stack [ 2287.622570] binder: 30629:30631 transaction failed 29201/-71, size 0-0 line 3046 [ 2287.683882] binder: 30639:30641 unknown command -1068997871 [ 2287.683890] binder: 30639:30641 ioctl c0306201 200002c0 returned -22 [ 2287.688120] binder: 30640:30643 got transaction with invalid data ptr [ 2287.688147] binder: 30640:30643 transaction failed 29201/-14, size 99-24 line 3316 [ 2287.688380] binder: undelivered TRANSACTION_ERROR: 29201 [ 2287.713385] binder: 30642:30645 BC_ACQUIRE_DONE node 13433 has no pending acquire request [ 2287.713394] binder: 30642:30645 got reply transaction with no transaction stack [ 2287.713402] binder: 30642:30645 transaction failed 29201/-71, size 0-0 line 3046 03:44:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:37 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x1) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)={0x178, r2, 0x200, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80800}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}]}, @TIPC_NLA_SOCK={0x34, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1f}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x615}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xab06}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x100}]}, @TIPC_NLA_BEARER={0xe0, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffeffff}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x4, @local, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x5, @mcast2}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x40}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x4000}, 0x15000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 03:44:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f0000000180)={0x0, {0x2, 0x4e20, @multicast2}, {0x2, 0x4e34, @dev={0xac, 0x14, 0x14, 0x2b}}, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x17}}, 0x8, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000000), 0xe843, 0x4, 0x6}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x30200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r2, 0x20, 0x70bd26, 0x25dfdbfb, {}, [""]}, 0x1c}}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="0000000000000000d6153d5eee3b650fabaa33c927a9928d87efaa1281e171453f2784dc168c8d8afc47de7f46f7df6041d4e3a4cf0e334588f28c68f70695ff7cf7ad4b57359289a3f1c166f1ec7ec5a405c58de4b59f379b3457ccd94ddda32ee767238a2c1e3eea2cedd807a2367e03dcf95fe8c95b520a46349c3d18e30d707ab6d8e96140a428db94b93d2f50d9ce41aa1ca40050f666"], 0x0, 0x0, 0x0}) socket$unix(0x1, 0x5, 0x0) 03:44:37 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r3, &(0x7f0000000000)="1ef50568e4caac66bf2ead8f606d9f6304cb1f8e2ebca330c2cb8fe5e4", &(0x7f0000000080)=""/186}, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:37 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f6811c1f4b41d8b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) openat$cgroup_ro(r0, &(0x7f00000000c0)='cpuset.effective_cpus\x00', 0x0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2287.774792] binder: 30649:30652 got transaction with invalid data ptr [ 2287.774820] binder: 30649:30652 transaction failed 29201/-14, size 99-24 line 3316 [ 2287.775220] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.060980] binder: 30606:30614 transaction failed 29189/-3, size 99-24 line 3284 [ 2288.071083] binder: undelivered TRANSACTION_ERROR: 29189 03:44:38 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/member\x00', 0x2, 0x0) [ 2288.115955] binder: 30660:30664 got reply transaction with no transaction stack [ 2288.133498] binder: 30660:30664 transaction failed 29201/-71, size 0-0 line 3046 03:44:38 executing program 1: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2288.153744] binder_alloc: 30669: binder_alloc_buf, no vma [ 2288.153765] binder: 30669:30674 transaction failed 29189/-3, size 99-24 line 3284 03:44:38 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3b) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) setpriority(0x0, r4, 0x10000) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:38 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xac, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@handle={0x73682a85, 0x100}, @fda={0x66646185, 0x8, 0x2, 0x14}, @fda={0x66646185, 0x2, 0x2, 0x3f}}, &(0x7f0000000000)={0x0, 0x18, 0x38}}, 0x1000}, @acquire, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x3, 0x1, 0x3e}, @fda={0x66646185, 0x5, 0x0, 0x2f}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x20, 0x40}}, 0x420}, @register_looper, @release], 0x42, 0x0, &(0x7f00000003c0)="efd23016e56f1b6af703f5e7ae5d0a6fd6322a63ca047b4f7a77a1426ef45a4705df8620a22e9b6b790f60810bafa75ba10db4e21af2ea53936ac1470fe30a802a3f"}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:38 executing program 1: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x3}, @dead_binder_done, @dead_binder_done], 0xfb6039777489137, 0x0, 0x0}) [ 2288.154000] binder: undelivered TRANSACTION_ERROR: 29189 [ 2288.156183] binder: 30659:30667 got transaction with invalid data ptr [ 2288.156209] binder: 30659:30667 transaction failed 29201/-14, size 99-24 line 3316 [ 2288.156774] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.180904] binder: 30659:30677 got transaction with invalid data ptr [ 2288.180935] binder: 30659:30677 transaction failed 29201/-14, size 99-24 line 3316 [ 2288.187454] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.286034] binder: 30694:30697 got transaction with invalid data ptr [ 2288.286061] binder: 30694:30697 transaction failed 29201/-14, size 99-24 line 3316 [ 2288.286206] binder: undelivered TRANSACTION_ERROR: 29201 03:44:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:38 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:38 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = accept(r3, &(0x7f0000000100)=@pppoe, &(0x7f0000000440)=0x80) setsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000480)=0x3, 0x4) pselect6(0x40, &(0x7f0000000000)={0x9, 0x4, 0x53d, 0xbc, 0xdb12, 0x4, 0xf274, 0x7ff}, &(0x7f0000000180)={0x3, 0x5, 0x91, 0x1, 0x3, 0x7, 0x2, 0x8}, &(0x7f00000001c0)={0x5, 0x0, 0x5, 0xb437, 0x9, 0xbbbb, 0x101, 0x1}, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000280)={&(0x7f0000000240)={0x2}, 0x8}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000630000000000000018000000000000000000000000000000db60311fd5593e1e31ff1418f4d83cb6432e3b57fe22525aa0c882b1ae197cf90ed15764d9d4ce88ab02bc2f2c857cd321395ef4390236cfb20fa58f0babfad75525304e2be6ad453a3593fb4d75be20d1b9f96b18316371bf34e7fbd73c3f5c42521fbb1fdb49cfd9c59bec2abac8b28b6cbcd1796ad1819b0c3d2883e8d70fa7560a62e4476bfc8cf68810b0c8ea17d6970900a4cf5518b46826aabf96af4d38df0ec5bb3cb8cf72f1945b1d1b3fb12795429d68b71dd27ecf375d2daa58ba3486a43f6125b26769d3b2e1cf6055d9855b280d433243b5b1ccefb9c2b571eeddb082fd6e8526319f212ec4b1bd28", @ANYPTR=&(0x7f00000004c0)=ANY=[@ANYBLOB="ff0000ff00000000000000000000fdcc85ece1c6925acfc4e934b29fffbce77568a0b01c1600000000a80035fc95bd0139fd71c25870cf6038eca99ebb5aa3b1b2f2ad44eedfda058f046852d3ce9a141ebe8b9c6c541d9d26f0c08c8c00437f000000fe5aecd5349ed40a55452a0fbfaeb9ebbe6d16dec683540c874570afaa726ea525a7e9e15cf06a98e75da1a03ec9072ac47462bd662d9cad8acedfd5ebe34196e911a4c277cf7b31911908b5d98468e48c993324ff27594be93d7a2d6702c8bc0a470f3f91c86af19898e1754960fc524f19f05c76150af6b0d4a3d3b8c5c322ac635c5f463627675bdeb4e9ccc02211f41022b8f144582acd22dc72ac5e33e3b561980a0c5265cdc62f4627a3e713f5fc05"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:38 executing program 1: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2288.344551] binder: 30700:30705 ioctl c0306201 200002c0 returned -14 [ 2288.468156] binder_alloc: 30711: binder_alloc_buf size -5315134917316378696 failed, no address space [ 2288.501999] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2288.510948] binder: 30711:30714 transaction failed 29201/-28, size 99-24 line 3284 [ 2288.527095] binder: 30715:30719 got reply transaction with no transaction stack [ 2288.527104] binder: 30715:30719 transaction failed 29201/-71, size 0-0 line 3046 [ 2288.577306] binder: undelivered TRANSACTION_ERROR: 29201 03:44:38 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0}) 03:44:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6f, 0x0, &(0x7f0000000380)="20272454fc7267d0c3be413ce09292a312130c891d20c28446ebc7d6654cac5b4a726d814637075e6554d33fe6e4ee7bc4bbbcd759ce88665ceeb309dcc15e078fbb07ec3d6f685ef9c93df9b18ae0cfd7c0006aa805d7e2a14ed7a804494518347283ce3250caaa07a0eb6c5a0df7"}) 03:44:38 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:38 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000200)={0x0}, &(0x7f0000000240)=0xc) getresuid(&(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)=0x0) r10 = getgid() r11 = gettid() ptrace$setopts(0x4206, r11, 0x0, 0x0) tkill(r11, 0x3b) ptrace$setregs(0xd, r11, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r11, 0x0, 0x0) stat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r14 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r14, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r15 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r15, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r16 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r16, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r17 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r17, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_cred(r17, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000001500)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001540)={{{@in6=@mcast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@loopback}}, &(0x7f0000001640)=0xe8) r20 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r20, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r21 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r21, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r22 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001680)='cpuacct.usage_percpu\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000016c0)={{{@in, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@loopback}}, &(0x7f00000017c0)=0xe8) getresgid(&(0x7f0000001800), &(0x7f0000001840)=0x0, &(0x7f0000001880)) r25 = gettid() getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000018c0)={{{@in=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@broadcast}}, &(0x7f00000019c0)=0xe8) getresgid(&(0x7f0000001a00)=0x0, &(0x7f0000001a40), &(0x7f0000001a80)) r28 = gettid() ptrace$setopts(0x4206, r28, 0x0, 0x0) tkill(r28, 0x3b) ptrace$setregs(0xd, r28, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r28, 0x0, 0x0) r29 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r29, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_IP_IPSEC_POLICY(r29, 0x0, 0x10, &(0x7f0000001ac0)={{{@in6=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast1}}, &(0x7f0000001bc0)=0xe8) r31 = getpgid(0xffffffffffffffff) r32 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r32, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r33) r34 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r34, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r35 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r35, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r34, 0x400454ce, r36) r37 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r37, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r38 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r38, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r37, 0x400454ce, r39) getgroups(0x4, &(0x7f0000001e00)=[0xffffffffffffffff, r36, 0xee00, r39]) r41 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r41, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r42 = gettid() ptrace$setopts(0x4206, r42, 0x0, 0x0) tkill(r42, 0x3b) ptrace$setregs(0xd, r42, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r42, 0x0, 0x0) getresuid(&(0x7f0000002380)=0x0, &(0x7f00000023c0), &(0x7f0000002400)) r44 = getgid() r45 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r45, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r46 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r46, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r47 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r47, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r48 = getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000002440)={{{@in=@empty, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@dev}}, &(0x7f0000002540)=0xe8) r50 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r50, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r51 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r51, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r50, 0x400454ce, r52) r53 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r53, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fcntl$getownex(r53, 0x10, &(0x7f00000027c0)={0x0, 0x0}) r55 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r55, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r56) r57 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r57, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r58 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r58, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r57, 0x400454ce, r59) r60 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r60, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r61 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r61, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r60, 0x400454ce, r62) r63 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r63, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r64 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r64, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r63, 0x400454ce, r65) getgroups(0x4, &(0x7f0000002800)=[0xffffffffffffffff, r59, r62, r65]) r67 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r67, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000003200)={0x0}, &(0x7f0000003240)=0xc) r69 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r69, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r70) r71 = getgid() pipe2(&(0x7f0000003280)={0xffffffffffffffff}, 0x800) r73 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r73, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r74 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r74, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r75 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r75, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r76 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r76, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r77 = socket$nl_netfilter(0x10, 0x3, 0xc) r78 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000032c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r79 = openat$tun(0xffffffffffffff9c, &(0x7f0000003300)='/dev/net/tun\x00', 0x101002, 0x0) r80 = epoll_create(0x0) r81 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r81, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r82 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000003340)='/selinux/relabel\x00', 0x2, 0x0) r83 = dup(0xffffffffffffffff) r84 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r84, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r85 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r85, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r86 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r86) r87 = accept4$unix(r86, &(0x7f0000003380)=@abs, &(0x7f0000003400)=0x6e, 0x81800) r88 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r88, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r89 = openat$uhid(0xffffffffffffff9c, &(0x7f0000003440)='/dev/uhid\x00', 0x2, 0x0) r90 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r90, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r91 = pidfd_open(0xffffffffffffffff, 0x0) r92 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r92, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r93 = openat$cgroup_ro(r92, &(0x7f0000003480)='io.stat\x00', 0x0, 0x0) r94 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r94, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r95 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r95, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r96 = openat$selinux_context(0xffffffffffffff9c, &(0x7f00000034c0)='/selinux/context\x00', 0x2, 0x0) r97 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r97, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000003940)=0x0) r99 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r99, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fstat(r99, &(0x7f0000003980)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000003a00), &(0x7f0000003a40), &(0x7f0000003a80)=0x0) r102 = gettid() ptrace$setopts(0x4206, r102, 0x0, 0x0) tkill(r102, 0x3b) ptrace$setregs(0xd, r102, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r102, 0x0, 0x0) r103 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r103, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r104) getresgid(&(0x7f0000003ac0), &(0x7f0000003b00), &(0x7f0000003b40)=0x0) r106 = socket$inet_udp(0x2, 0x2, 0x0) r107 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r107, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r108 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r108, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r109 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r109, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r110 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r110, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r111 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r111, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r112 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r112, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r113 = gettid() ptrace$setopts(0x4206, r113, 0x0, 0x0) tkill(r113, 0x3b) ptrace$setregs(0xd, r113, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r113, 0x0, 0x0) r114 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r114, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_IP_XFRM_POLICY(r114, 0x0, 0x11, &(0x7f0000003b80)={{{@in6=@mcast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@loopback}}, &(0x7f0000003c80)=0xe8) r116 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r116, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r117 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r117, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r116, 0x400454ce, r118) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000003cc0)={{{@in=@remote, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000003dc0)=0xe8) r120 = getgid() r121 = gettid() ptrace$setopts(0x4206, r121, 0x0, 0x0) tkill(r121, 0x3b) ptrace$setregs(0xd, r121, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r121, 0x0, 0x0) r122 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r122, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r123) r124 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r124, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r125 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r125, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r124, 0x400454ce, r126) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000004040)={0x0}, &(0x7f0000004080)=0xc) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000040c0)={{{@in=@initdev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@empty}}, &(0x7f00000041c0)=0xe8) r129 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r129, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fstat(r129, &(0x7f0000004200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r131 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000004440)={&(0x7f0000004280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x85, 0x85, 0x3, [@var={0x8, 0x0, 0x0, 0xe, 0x5}, @fwd={0xb}, @datasec={0xe, 0x1, 0x0, 0xf, 0x3, [{0x1, 0xa8, 0x78}], "aae8c5"}, @datasec={0x7, 0x2, 0x0, 0xf, 0x2, [{0x2, 0x7, 0x8}, {0x1, 0x7fff, 0x1}], 'JC'}, @typedef={0x6, 0x0, 0x0, 0x8, 0x3}, @typedef={0x1, 0x0, 0x0, 0x8, 0x5}, @int={0xf, 0x0, 0x0, 0x1, 0x0, 0x2d, 0x0, 0x1c, 0x2}]}, {0x0, [0x30]}}, &(0x7f0000004340)=""/239, 0xa3, 0xef}, 0x20) r132 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000004480)=0xffffffffffffffff, 0x4) r133 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r133, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r134 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r134) r135 = openat$cgroup(r134, &(0x7f00000044c0)='syz0\x00', 0x200002, 0x0) r136 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r136, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r137 = creat(&(0x7f0000004500)='./file0\x00', 0x40) r138 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r138, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r139 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r139, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r140 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r140, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r141 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r141, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r142 = socket$nl_route(0x10, 0x3, 0x0) r143 = openat$random(0xffffffffffffff9c, &(0x7f0000004940)='/dev/urandom\x00', 0x406000, 0x0) r144 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r144, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r145 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r145, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(0xffffffffffffffff, &(0x7f0000004a00)=[{&(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000001c0)=[{&(0x7f0000000480)="2bda80bbea92a541921bd1ca608ac5d41d3875c64e0c4981a3ba9827dbf087c996c8d8f6e163a7f60039d1bb0fa3dfd31a149667e93a26b1ed2a554b4e3829e3ddab90152e391aa6439ff99d9ace5ec4763bd782a1c22a9a4c303827f8528faef9d309c0e86973d14ff2e4d536a728f3ad6e39ac9432bf9dec0fdb74b48b1823cda885da6d0c712b6b63bf247f63c40393528bc09a502889f194c82e103b1a2e4d264d9b9b7aae3afdedc475e695e5122c3da2032a9c06ac74ea968e4b1c4d63446dba0468221ebf3fb0f45e17b6195b63a15ac5653301569297c226ccadfcac25d85e2489b864092d5071b0cb7679fa9a9d8ca2d67be93d05b8c3803926b3be8028d49224c56a49b93df56e556af8a9e2f4d9167e544934b8664c3353c0931e067e0c48789ca872b35797589006e42dff18f638cfce44f5366c95ab5863382a3176dc31639a2faf5e537ee4e3c1e7c09f2fbdb84d9c865e08b607d4d6fab1773a6c111b19512fc1525a93bcaa793ba78c7d2a118c44287a2f4ef5b32f0713908a28f6455f9f58c06ca40c2c6125aa09636deafc46b23d6b9ebbee8024a0e0be854080678bc37b9e8e17bb622ef02ca2d5dbbe3e4bdaaaae0db20935650cb740b459425740efb59a4120306b1191cfbce822858440e2174827dba57d813bd09bdb731400fc6862c7b923c6b33fe26ca3e7e895a3f99e358155a5e316ea50b266e08c4513fc7f6fdd185821ebfad101202bb1316f071ca8dadd46a8bae426fe81cb3b305a04d509ba55b5515e4d3389a18b459177fbbe53e37ee74e7277efdc707605926e2d2a6c025728952f13431f1acf10a2316cfc12c6d36608bbe50a9a139b20eba84af3dd1979d981685e9cceceafaf33602863d3d27cea826fac3242d26f64730c75333b29b3010a05560edb2da5208fe080865146ebc2f05b658b0988b5f48219356058800a9758884f826556f95cc32129b55ec8cfc73fb3b5bd9f2576df9ca6a7bfacf9a0f18740dd8eff65aeed06d78aff8ca2a91c94e4f62ab59d656efcf291b20d83abe60025e0453f64ee6634af5124f2535b8152d7ee5910baca3484301ea8d9326e1a1ac9abd062dea4828f6fb0032ce3c8aee76d074834468de5b6999125dbe88ad2a4c071fe8261222600958e062b9c5217dc1d0b49dfaf79ea691a3060c78133ef981ae9f0e9760d02a868ea176871bb1aa8cf55c702a043a4a2c6f7d646cc03c9d55e26deb37c07753669fd94289580c60dd529f1bbd54dbcf7abfdd1d5862914421275915f42ea669d42dab929729549ad63688e390ca48251f27aaf36b0996aa6d31c4c4ba8b872acd0b5bcbf6137126c2f8200fa9fc30b78dc725877b1236283ea2cf1642ca2a0f028ebd039dc4896a5b647f01f8a8da5336677e3c0f947b649f609a134190a506b43a5ce1dac3e996725c6c104c4a46ecdbf73cdc2816b16e480c81afbe6958872d00bc856e7e4784f80d663111638e6dad05f669d6d03f819f8ffd6041d69136af77ca96d02c42f4f25fb419a5dd53726fcfef0cde4c019cb1b0077edc6970f8d63b965e11d271706836a9b56ca025216a5e859f580cadc06a2a057e72d527413aae3a0b12312ac83ba85245f7fb737d03b3f064f7d4bd1245a08b393461ade34f36a50b4536e7887ba025201d6487dd4cb6c46bc809a2b78c1a688a9091d47b4beef8d750a17a2258cdeb760e6c8a41bf7c492d6393bb87bcacc50cfaa4ff66ba13f452bf39ca5d1301c6fc4d49115ac665c26f9edde529bfbc5231ec4aa1c85b3edc829abbc3711ae81122ae90d8d69a0a3fe4e28439722b6a72b17fe216790f775d1959148abc99a3e673f72c5322f1a8fb8c1f7d96cb82d0ed6c9c0043ebe64cfec08478a98dc1023b4736a8b6605fba98a2c19e9c454306b3ba589c409e77720f144286612f1b9741132b8fa1c3fac0b9298503842e1b253cc79fb4d92c2c7a8153dbd2eb14a0debd59e7413080da5d0be883bf5b76df4b9088682a6b8cd5e416aa2a19527ef30a4e7620c3183f9645331d2e843069270aaecc80fd9f0e5bee2d5b8779b42face88a828ecadc00eab94355979d3ec014b6b9234675bff0e198bec2856ff488ea4bc87251c6647a2687214cc5508dfb847c17cb2ae3b2e57872086988e368cb5048afe2fc247fc0fff622479c315620b2efbccbbe25cb95d1f5d625f863ab0c7a4b7a1cbdb099a44034fed83b8f4cc96f68ba394e112b65a1aeac9950a8e7e23001d2d60566537a535478fe64ffed38ee6b157ce7ebaf7a9abc9c7366bb351e91af16fff4af891c95a44e372b03e4b92b9d470f7c7406dec4b7462797dc987c2b71665e3b1e12762222d468241b648a949e4f0f207877d008a4e3ec14c6b45dc683654665cbaccb5cc4f0e4f62ba6042f0a892aefa1bbfe6b2ca354ff9ff4a89fc0b01b6cb62f095cd18d8558254a1e59b2670d57a60c06af14c46586c2557a68770cb12ec9f2c3b4d1fda6a732823a396574fce3ffb9b3a0cb926683acd8f99ba99c352fa2c0ffac4cddc0733b9af4d5b8c33074c0afbbafe8cd72e90663aefeae55bb3848778b021b2339b9a3fb57a94f4864c1ad2753b83497be11f5ec6fcb3654f7725f7bf1cb741e3b6735c2979e8233bf20b73eaea92fe713ba2870f810ff9db40db0b23974da918ef7a03d5079146096d21b288883f2cda75bb5c08e5d12113e2bdf970877c04365a53e982b5d08edf25e7f0a08c310e368e0cd99258ccfe585a7e6e8d78a9147b57ab11c07548a4dcdd2a66a144d6bd9336b675ab19b701da4aa9165b6bf2456286873be0fcddc985fc035d24b73ee2559583349eafd170c4e4e9836e663ab0d4814e23924b608ff74db8a46d8a7cb8c27cff9a1854477eb95cffc3f4ff8e3e8b0eac415fff44a662d22ceb11cedd9a8654a276b47ed604b51fb50c18a74f34e650027c67865a7d19c30f8395913c0eda8a9be3cd59371b1aa3b26174dead9815d0e9fe160dbe2f17feb3534f463c3dda72ecff122d03e753fe390783ea4cb677345004933e7cdcb4be9c946843f5b0099e2a2aca79bf3311e477bbf78bd82cb0936987f2fe7074b5f5f573548a71459940e8d10c83d2feee368a1e95d5d3c1f4858ce067790a24ccd61475173842714ae70afcfbda67b8a326d5bc2ffc89b9304475010865ee27f9a28b1603a7df55bfdf500ffe981342ad36de2ac047e58465964bccdde893c163cc6c6683f8b4787121ed9300fb81b4f65308855a39d98b07253760dd08fcda2cb378beaaa7c9c38d850ef6cb5c0b465d2d341c81dfe6b5ef09a8445c4fa446d9308076770af3958c52765923eef7259005633bbee2b116784db2be8663b187ea5a9e4d9c8197d401509e7897d1a68182122ac24e141419450d2b9b4d6eba36efa00834c1827724e5079b8bf47d23d88f384514458af5294ba4dde0a55e6e467f2cb6ecf67ad4540dcff13083a564c0ecdaecb58f0ccc54fb0d9d124af5a70df0f9aa750928d345fc970d9b617772e664a7e1380d64e25a61c5eae0048d217125c5d95e456e29632feba07de7d986010ab69bfb9d7fab15b012c8d2c4ce26f36894277eb6f2561b127270de24aae6eb1be23af9df2d0c30d01c32ad08489f5e9120b9aaca30f76dc2be9ae27a9409d725d5c9d3299ded2b4a14c0eef3a8269043608b59d4bfc23b4b733d47f42dbf692bc3b3eedcb1bac716da7509a4847eee7348aad0c53b9a749278e8ca13cee16ae3ea1d924d2bbf23e2ad91fe78db780853aefe3b902bae9a6de783e01924726f56a4ad21db10b65d75e78402114efb3d9b9ebcdba68198cfb3e787aa3adc7a89e9328e2bcaa413ea25f6cd083d41d57cbe9f2e3cfbcc4aa6c7e80daf404edcfa0c29012e6055df4b7a4d9ca0d9de5327a4013c4a7b0315ecf98cefb55ac3c032559d81d0e91e9ad9f69972927b584d3bf70029f0860fc5445698e3d55596cc1429f3b3bc548ab34aa19e53d7582ecfb3c22f585232219f5717db192d877000438567dde9a653ea27b137bfa34868bc0279b0eccc7b09f2ac0b9a23be8607ebd3c7218b4ca0b94428d2973f1b3087ee2336972937e6902a2be9046d7504263874427bce040a9fc6a299c9d9c5d20fa90e1d5ba8c73a17ee4da8f0a45c5a8421d53687cb7f1b76e09da4162cdf2fbe6b4c9fd61a242bcea543b0ec41a8f109748b43feda7bbd5798111d65a60e0eeb6364e388802bac6278143ac36f65d9e4c2578ee8617c5010e58fb4f2845b1efa85cb9a145dc2b0d87ac45215d8901efdb6e360ea1682d5702c6091d66d9514c809405f0c8a774bbe72a8a8e8c9f637df183915e4b5b9fc5264c051f3ab2ecafca4bd0ed469bce528d0b0e2ae3ab44fcb14335ba36866b7157b001c01bb1dbaa8e126095ec52258d0b6191251b5a77cce6ac7b915ac894c261fa3bfd46de78dacfa5368eea0423ef6d5579b427663c61773090571910865f3c1fa481bb176bea485ca95fc259835020c896034ac535adce7cee4e62fd2642743396168df980581146436c2e19f3fdeb22c11e15d200cef28960f53c4f7d6e596bc1d26f5e62c70f8e7d4edce9fb658cb2b8a0530b9ddef55474f001bce566c855bc1ccc1e84152ed16068d24f2a7feab537738d39e7f916adb70473639d26736f0acd718eade193b51811cc6bc046d40e0481881a7718f52f373ed38551b5ea9979e76f106380d5bd6d84420b18646f92ba95fa3eb7ca6f7b0e60f02c912c4734afd7e4e1493a2f2b93597eee369cc01758d0cb615e07bdb37c48a2faf41f3a9adb285e331ffc90961c7e2053298116b753ca3a9c37e5ac124471babf5cdf24176f6ee1ace9295ca35395dc3c329044bd8d5614939e7bfe70a3173e5ccec1f29bdc020d8f5bb17df607fd0b3aadb57d44ed38527659ff154dc86c10e8159840684c350fc8ea8fb135e2e398bab8800117fc08b9cfa0c64e53a63a2f2d93e7dfb65f563cb03c986fe73a3f7c855e545b92d4c66291c6c6327239ed10c4069889c4f69a318035ceadd0ab18a6c610878aae6dced7f09f352a47e505c9784149c7f5d46ee279093d5f4357cf318e5b79472e35b0edccbebfb64eabf3ac070c26cd6ae1e2dbac2e5017292c544d2b3a18d89c65fd60e6c12498652a44b1ac354962d934cfaa1cbdeeabc3a444e027b6eb49b52967b7b1b1117031f457d9c0285fdd1bd69e7d274bf2317d0f8b0d8901d9da2232531a36999a6c925d9a1c37bd9a50568d9907e04e2c8e6f169f6963d9ca2383c0f76c854c325de98752b5affd1fbfa9322416db5129945bcca27044c782fdba2c73ab4c2a51c0418d0bf41f09f49fa599b71025a9e922e7a36883b27db4b065c9aa2b626dfb054e25ad2ca2d7c287e1b962bfe2f9d81c85de67f714c1e1bb5ad30c7c425f38581ed5e768242479e34c80cd1d3ab7aeb3a786c1ffb4edce0c8096376a7047fe91c433697c16e513def34b01cf61d1dd8116b77e32c686f6dbf4de6f1cb395350dde2dafb7da41ad87d359d78c0ed864d9b086f6a081e31957675abcda2135a30de2f287da31dd9174c39c98782b3286deedc63652e22487f287a1c0cd24f1bb7d3fde0fb79eb5591e8a0a17445360c8c60febdc8842d47db1b927490a55f80bd00aa7b98a6d7304650ebc2f2a7c71ecd87a67b7b5ef3113c703637cc04ec0fd4bd8cd8761cd13fb9a6d290e10946576f523d7694836bf5ea21d0bbe5aae91a869c5fed1b5527470509c77d7297723dbf10d4b30d7da685517652a0be919d20f25d4f1ff401", 0x1000}, {&(0x7f0000000000)="a079fe2d556c2006e4b026e9220a42581ef453a8cce00f5f269d1b5ef83accd845bd6d2f", 0x24}, {&(0x7f0000000100)="7e5dbf3afeeda7b30a6a3b9bda39638144fcaf3d842396f10bbd29f0fef42824315a8f6d465d851cc4be5a231d81b4402acbeb6407ee1cbab0f2bc63d35e36e84e655a2341625ab24cfba748a5526daf8d57ad1624d6f18f1e2d46a8d6ceb8518d499942b2ae1b78de584876b0e1577f92de044ad78bd9c3756e678d165b834a3cf845f87d14148bcb99", 0x8a}], 0x3, &(0x7f0000001c00)=[@rights={{0x18, 0x1, 0x1, [r5, r6]}}, @cred={{0x1c, 0x1, 0x2, {r8, r9, r10}}}, @cred={{0x1c, 0x1, 0x2, {r11, r12, r13}}}, @rights={{0x18, 0x1, 0x1, [r14, r1]}}, @rights={{0x24, 0x1, 0x1, [r2, r2, r15, 0xffffffffffffffff, r16]}}, @cred={{0x1c, 0x1, 0x2, {r18, r19, 0xee01}}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r20, r1, r21, r22]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r23, r24}}}, @cred={{0x1c, 0x1, 0x2, {r25, r26, r27}}}, @cred={{0x1c, 0x1, 0x2, {r28, r30, 0xee01}}}], 0x140, 0x80}, {&(0x7f0000001d40)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000001dc0), 0x0, &(0x7f0000001e40)=[@cred={{0x1c, 0x1, 0x2, {r31, r33, r40}}}, @rights={{0x14, 0x1, 0x1, [r41]}}], 0x38}, {&(0x7f0000001e80)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000002300)=[{&(0x7f0000001f00)="474bef1514bda248f3f4d203b36ed5c28b5d226564c2c71153e678b6308bfde98500e2a82f875277066d93ad2711d0c6eb4f472ec1d571d2cbcfc1a4d4a24e48ff8daeac16e2b8cb706aaaa1aecf5163733039eb58f69435f3f011626484039eb4e64a9f35abf434cc57f9f50b71072a98451fc6e9acae38f7ba0894b58b107b7f8aab863c742cf98376671be9fa702d3df5c150475da8ead9d8476b8c1e9fe3a91496143cb48e250bc85e04323d3eac7e614d483df9e81921a5cc2687682f3dfbcdbb", 0xc3}, {&(0x7f0000002000)="fbf7ef4714a5fcb9c05bbf0d373c266a96724dfd0f066d8cbb8093c529c1a84bd6abe9310d0d2fc862fa75255a64df89600479b8e8741f2af260f728070492ada256b561670cd0ef6e30533e8cf494168dcac6cd285377cf9bcee142d3c02640feb475b65539552d867745b4203bb9215f0f2e48fb2c21436e8cce528d31415ec9d3f79e328ac2303e96ef49ab107379fcd65161f70e8e25e210df41f019ba429922c316b14cd3f4b470567e00aab73b2b228fb034ddda7d75b6c9635a59bc161cb088e1492903177b4b6c2da8299c7600836a4bd8c87b106d5f060fece4475712a090b7f419944e8a73d1c1e5e7f2cc90", 0xf1}, {&(0x7f0000002100)="d8d562998fc3cdd7e29c0c6afbd24e467db67559b65ee21ebe69446ea1316fec677df4c5f7b34b77bc15605db628a23b85", 0x31}, {&(0x7f0000002140)="a79b273891c4c2d4bef990143c22b06d575628dd3d3843e3b5940b3cbd45cabf75d76c74d650e1919f29fd468cde4b490e51fc043b96c78732bc768ada3f6d8f82c5a3175d21a830c4b6afeecfffa3bdc07309075a975c25bb218e5d12cc18078c7730ac", 0x64}, {&(0x7f00000021c0)="1b50d9a86e8bf656dff386e2df5ebfcd16c1efca2464aa7c63e86d6d01a654dc8253ec083ccce2d7d0dd3a7138262f3209b3318f225d5befab44610510921b2f2de9e87f4a861dcb52607bd81ad9bf0c544171ed15ed8797cc73e08f3ffb44dadc8d0590a11a599e98ec3e591b601a93e7005dc18927e4466ac32808ed9ecb49bba3f28d57db324186d535e98ea5", 0x8e}, {&(0x7f0000002280)="6725a7d708507864f234a90dc7037208488f00eaa71170b64751b0bd4dcd7951fac9c1ef186f60ee19d5b775257b312cfdd639d86344aef9fd71a428081341dc898f7012ec89980ba4ce5e334062005ef980ba859148cc290f168accd9056c7fdcaee8bcfbfec706b83698636c3a20bd", 0x70}], 0x6, &(0x7f0000002580)=[@cred={{0x1c, 0x1, 0x2, {r42, r43, r44}}}, @rights={{0x14, 0x1, 0x1, [r45]}}, @rights={{0x18, 0x1, 0x1, [r46, r47]}}, @cred={{0x1c, 0x1, 0x2, {r48, r49, r52}}}], 0x70, 0x48080}, {&(0x7f0000002600)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002780)=[{&(0x7f0000002680)="9bc14627d08df7ff61d9ede0ed489f7532d9a08827cc1e580b6d23a9b2ed6bb15a86", 0x22}, {&(0x7f00000026c0)="94b7912104e31f832b9de3031393b6cd97083e8d2f68a7f208613d2f54259fcbed6fea23b508a43f75860af2e71010f722924e6df22ed1e4f2f89fce18bb96ef37d4136f341590c3b2789bd9e209dcac6f232efc2eb1d1e36402bb6351d44e64e816d36bcae15c872b9d6bd5885cb91207274f69cbd7f6c7c117bb8c9ed37313702943401190942ac208aa2b7d050d61680dc03c0d9a0c3b280f8b054e6e7fcb7d0976bbfacf0b", 0xa7}], 0x2, &(0x7f0000002840)=[@cred={{0x1c, 0x1, 0x2, {r54, r56, r66}}}], 0x20, 0x8800}, {&(0x7f0000002880)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f00000029c0)=[{&(0x7f0000002900)="6660c10ddfd462b3dc26b9fe0ed6d63b03248e09282505a225f6c06bf9f2443ab87436a64853932dab2435a0ce57635e9e62de12b06a437de8da77692a9240c198db019cf0ae56231f702286c0e53c9120a9952a40d0d172136b2b1cd666dadceaf0b8aac8d512eec07827759e545887cf1c43779059adece7a9f55f5d889f38a0aea2c3b9f0ac6c9d8dee7a993fd47299721b79c029953fa2ffe0d1f50e8358598c80fd0f9cd78fdf6924e41364718bab", 0xb1}], 0x1, &(0x7f0000002a00)=[@rights={{0x14, 0x1, 0x1, [r67]}}], 0x18, 0xab225fe92e1269fc}, {0xfffffffffffffffe, 0x0, &(0x7f0000002ac0)=[{&(0x7f0000002a40)="d9fd699f445170153ed7bc59f80ff78024268c986fe923a14c5b5dcf0f064a9b2af8b2e2acb30db70312104d2d2534f3424f50e987464b55b056ac4f300ba104de8e1c916bf8a1595e", 0x49}], 0x1, &(0x7f0000002b00), 0x0, 0x4000000}, {&(0x7f0000002b40)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000003140)=[{&(0x7f0000002bc0)="aa509caafa04707a8ad64acf23df2a583d07b3bc9e4144d01ba8760086c72e0bfa585539c5ffc287b8b5a5eec01335a9a48968686a5ae21dc71c24ddb0460d8d479002ccf4282f018281e5cabe000255e9497c0d76d4d2bed489f433f29ac36db36572ff885491e713571892a91b3c8917f6e0d757351ec738db64537f2e89b24626460e4a7f285ab4517aa661cf435fef288e4810411a184bc11638d33bcb4b7ea4a36525a1892024eae4ad35090e351d16397936946f9435", 0xb9}, {&(0x7f0000002c80)="c238ee5e5d85b689ac2a97e5b9e5c4ff7e6e9114ac9df2f8efeb014070ee57ed8fc378f2c2e21aefd27ca02efaf818868a1b7600a02e699c86c808ea579d1c5358701f02a44408125d790b4b31987927901e278322c7a1d8bf121652032034bc253555c961f64f167d86462bd42060c2c1ca87764fa82028195868baa485c300c39c2fedff4856693a938d93a1e83e68791f5d0396de0c80c54f3df32aa1709a226853b4a614e2aba42d51fb6f757de03869788ee5fe850b978b0477c1eb10ca0fb8407f04d6c9251c33e0b2a44fc90cf22500cf61591dbd77654bb613f5cbd586932dff13b4f2ed64d96ff5157de4137bc4aaef0ff4f795d56880", 0xfb}, {&(0x7f0000002d80)="2cd891d3d723ae98c293ea0438bc9aaac8a68f4dbfa059f23cc7bc84d1228c96c53a4a7ca0a570d6bfcfca1b22072b7427aebba998738472cb9548a5034df76b41f183f3baba511044a873432101f94f1e407ae5098eebc8e6546dbb481a517c33a4204300d3372f7ea4eacf6044783814770c751fdc0fac4cff6c29d5763776253f50de5cf36ff101", 0x89}, {&(0x7f0000002e40)="6d137be895bab58955b1a5796ceeb67746b065d844fc5485d907533288078436c9c7c97571947a4cc190bb5ad180ece9fd6ca4e57604a7677573e63b374b0a5912bd2d67dad0de4461e4086d3e3380ff51a7cec82c795200b24860642511e5a766cd38f8bf89d588e916498fc169c23697437e09", 0x74}, {&(0x7f0000002ec0)="3e325e5581f47fe9664f94ba461bd6f3cd5def198e6f1ac909cc7097fffd48d419ff06c69f018747e4df8573063c270a8ddc8fceff1fcf11e5336dc842adfbe987f5161828d7f036d1c52738dc1876fb9228d8d08a897a3ce3d85648874be07968436613a251927f05a10100167bb212b157ac712a286d8fec10d032d026a33b8468e2be2a9c1f7b0c58cf6f4ffcaf5ac7defc21d98d88467b5ec5b1973ced2ad48bfaf6ad8bca67c1c27848de", 0xad}, {&(0x7f0000002f80)="7b09fbcef50a48199b89cde8fe3196cad01622870b704e063314", 0x1a}, {&(0x7f0000002fc0)="a837ce2fde", 0x5}, {&(0x7f0000003000)="6451a37314b642", 0x7}, {&(0x7f0000003040)="6c0d32612c5ed778c70d92f3900c30a698b00348266ce4eb60239a906fa893e1f2283d8f2a2b3b6696133206b9fceaea4126cc175cda8c8b0aeede117fcb112a8e334c62c5e3b48c4eaabb70bf610bef6dd4e9615fe35d79ec939bf27a3fdbc2ba378def44c0ed83a980db49ebad5628bf9476040b0fbdad59b635f4b065b4a94ad2b5d770931e737f749f7201102dda2e38089c59506a0e1750272d98c6", 0x9e}, {&(0x7f0000003100)="b257c78330f9f389b1f33c445a7ee24dd3f8ed548abfe4c57e5a4f3bb04180a315812f0d668101cb687d5714d0d7b6", 0x2f}], 0xa, &(0x7f0000003500)=[@cred={{0x1c, 0x1, 0x2, {r68, r70, r71}}}, @rights={{0x2c, 0x1, 0x1, [r72, r73, r3, r74, 0xffffffffffffffff, r75, r2]}}, @rights={{0x30, 0x1, 0x1, [r76, 0xffffffffffffffff, r77, r78, r79, r80, r81, r0]}}, @rights={{0x1c, 0x1, 0x1, [r82, r4, r83]}}, @rights={{0x34, 0x1, 0x1, [r84, r85, r2, r87, r88, r4, r89, 0xffffffffffffffff, r90]}}, @rights={{0x2c, 0x1, 0x1, [r91, 0xffffffffffffffff, r93, r94, 0xffffffffffffffff, r95, r96]}}], 0x108, 0x800}, {&(0x7f0000003640)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000003900)=[{&(0x7f00000036c0)="12c2956031e7fb35f0a8dfbafd3e6f909a55e4913af2253ba4ebf99f79b41564b7ad683ad4109a1b5daf139bc326a15b8999dfd7ddb7226ddc5666c49b787c04e9029ee2a4f4ae339ce1bc0090287fd467b46678bd364f149ce0987b532a86439d17fee8fb924594e3777cc22a81db9a77d4c1dc20abc826044bc5d205442befe900a976a254c1b117a06350460768a5640224ea87229c35b5c8df2a8916a9b31292c650d1dd59f5752e9809843991b0b970477714aa57dd75127c679fcf4f9667216ac37c3531cdc6f25a67329ca8f819b36dcea7ef", 0xd6}, {&(0x7f00000037c0)="7299fa05acb1c5f2df03cf15930a9c98a96e209cd468ed8c5fe9bc1cf6d9418d0100a36ed23fa75d163dc495cdd5e56405c8a1957068c292206b2b4b4d", 0x3d}, {&(0x7f0000003800)="bff125d4fc96e0f6aff63426c1711d33a642af53d455d4d70286b38d4e9b2d20eb105da8258c12a412cd555187af4f3fe537cfd3f2fa33a9945f4d5cb09438ce1e0926ca2bed44804b8fb72b145c7b38323bf1403244df5730f7fe0052aaf9e6c4bb7d28d230b0caa8396324bedfff57bee89a3da50432f00917bdf6cbc3a80ac9e88e7398855400dd7078e0a8fc27157f8381472e42fc2bc252d84b18e0e313641b36902b9f948e87f1dd7fa73ca3075dfc3078cdc8583ef56da76c9838f0dce66f81677482825494aeb2f7cd890c895aabb43e4650f5e3200c1b614c1e444f957afdb789c849d3859aa1f0dafa0615", 0xf0}], 0x3, &(0x7f0000003e00)=[@rights={{0x18, 0x1, 0x1, [r97, r0]}}, @cred={{0x1c, 0x1, 0x2, {r98, r100, r101}}}, @cred={{0x1c, 0x1, 0x2, {r102, r104, r105}}}, @rights={{0x20, 0x1, 0x1, [r0, r4, r1, r0]}}, @rights={{0x30, 0x1, 0x1, [r106, r107, r108, r4, r109, r110, r111, r112]}}, @cred={{0x1c, 0x1, 0x2, {r113, r115, r118}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r119, r120}}}], 0xe8, 0x20000001}, {&(0x7f0000003f00)=@abs={0x3, 0x0, 0x4e21}, 0x6e, &(0x7f0000004000)=[{&(0x7f0000003f80)="07277d008e4df5b572e821f1c75910c52405eb992add2e62dd294f89c74d68599c29411546a1cebc80c483cff4d968ddf7fd518e836e38fd8879ac93d862a8e1980961cc1d8d1402932613202f3b37b9059bda874c372a337efc50ffcedcb6f080ec8f60eda8c36dc9dfdb", 0x6b}], 0x1, &(0x7f0000004540)=[@rights={{0x10}}, @cred={{0x1c, 0x1, 0x2, {r121, r123, r126}}}, @cred={{0x1c, 0x1, 0x2, {r127, r128, r130}}}, @rights={{0x30, 0x1, 0x1, [r131, r132, r133, r2, r135, r136, 0xffffffffffffffff, r137]}}, @rights={{0x1c, 0x1, 0x1, [r138, r4, 0xffffffffffffffff]}}], 0xa0, 0x4}, {&(0x7f0000004600)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000004900)=[{&(0x7f0000004680)="753789365ca469e426e507e430a76ccdcfc06efba1817f466f6ea00a61f590e2763fdc67630d1cb8e5f9f09cfbd57c5143e356d60fcf0a120294d7933092220a47375a4302e7978bab48bfc72e10672d224c47cb652d08", 0x57}, {&(0x7f0000004700)="2c03f145a4a863d398f3f9d796d17e6ab010227c50e6189667dcf04a90292aceb6a528680bfb552d83f2f1ee1e636aae231608e13de3316ba463e90d0fc24443f7cc745c889e68af4123f0cf0592c8b54047d004f1ac9d074088194a3e5b3e451b76143df8a6efcb2a1a870fee7cec59aaff611e75eb3a5940c7ed52da9a266ae0a234d58775faf6339b60c1c8b2df88becfae7af3acf3b8d98d8c37379af85f0cd261d2e5016445b191449b453ccd4d2e4f47d27b690c3336f1bdd9a2a3d290c271469256baf8277d88bc5a1d23eaec70fb5ffd2afe617b6c6dedac102b450faf2196b697bede25e6cf46c5cfc6fc69109ef2801e28", 0xf6}, {&(0x7f0000004800)="17caef64751072d42ee4dfdce4d0adbb7363419ce9a7b00ae48a2ae2cbe5314a18b5022ebe2b274d48ff162eb4885355a7bbeebfce7b33cf7c3191a2a62feb206ca4ff5239ab6b4194998e2b62e9e0d406990566bab5cf6aae935f78c3eef3bbeb0e96b27971928aab8bd12ec764fad17cff00778cabb7e64de7a40fddb93dbf3a8e6b0f7e985874d5e872cc5769eb355e9b93c1754693e46f6e54ab9537dcc9c6bd88fd7b8e8109f53d5b1211c3f8477c56bbc2de8ae197b0034b931d9606ae977573615baf6f93573166ef3bb680098c77", 0xd2}], 0x3, &(0x7f0000004980)=[@rights={{0x2c, 0x1, 0x1, [r139, r3, r140, r141, r142, r143, r3]}}, @rights={{0x14, 0x1, 0x1, [r144]}}, @rights={{0x18, 0x1, 0x1, [r145, r4]}}], 0x60, 0x20048000}], 0xa, 0x4000) 03:44:38 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:38 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x60, &(0x7f0000000480)={'filter\x00', 0x7, 0x4, 0x480, 0x140, 0x0, 0x258, 0x398, 0x398, 0x398, 0x4, &(0x7f0000000000), {[{{@arp={@broadcast, @remote, 0x0, 0xff, @empty, {[0x1fe, 0xff, 0xff, 0xddf58b02ac00037e, 0x0, 0xff]}, @empty, {[0xff, 0xff, 0x0, 0x1fe, 0xdfd5481634d1b9d4, 0xff]}, 0x5, 0x1, 0x100, 0x60e2, 0x0, 0x1, 'nlmon0\x00', 'team_slave_1\x00', {}, {0x101}, 0x0, 0xc1}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local, @mac=@random="f29d580469be", @loopback, @multicast1, 0xe2afd7cb16c9495e, 0xd63ae15c79ac184e}}}, {{@uncond, 0xf0, 0x118}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x5, 0x1, 0x1}}}, {{@arp={@local, @remote, 0x0, 0x0, @empty, {[0x80, 0xff, 0xff, 0x0, 0x0, 0xff]}, @mac=@local, {[0x0, 0x0, 0xff, 0x0, 0x0, 0x1fe]}, 0x9, 0x0, 0x8, 0xfff, 0x9, 0x3, 'hwsim0\x00', 'veth1_to_bridge\x00', {0x7f}, {}, 0x0, 0x228c8b903cc192eb}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @multicast1, @multicast1, 0x8, 0xffffffff}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4d0) r4 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r5, 0x2401, 0x1) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4000000, 0x80010, r2, 0x0) [ 2288.663701] binder_alloc: 30730: binder_alloc_buf, no vma [ 2288.674657] binder: 30728:30731 got reply transaction with no transaction stack 03:44:38 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x140, 0x0, 0x0}) [ 2288.674666] binder: 30728:30731 transaction failed 29201/-71, size 0-0 line 3046 03:44:38 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000000c0)={r1, 0x10, &(0x7f0000000080)={&(0x7f0000000000)=""/19, 0x13, 0xffffffffffffffff}}, 0x10) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:38 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2288.760499] binder: 30743:30744 BC_ACQUIRE_DONE node 13461 has no pending acquire request 03:44:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x185300, 0x0) accept4$inet6(r1, 0x0, &(0x7f0000000280), 0x101000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 2288.760510] binder: 30743:30744 got reply transaction with no transaction stack [ 2288.760519] binder: 30743:30744 transaction failed 29201/-71, size 0-0 line 3046 [ 2288.760675] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.821374] binder: 30751:30758 got transaction with out-of-order buffer fixup [ 2288.821402] binder: 30751:30758 transaction failed 29201/-22, size 104-24 line 3525 [ 2288.822156] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.827588] binder: 30751:30763 got transaction with out-of-order buffer fixup [ 2288.827617] binder: 30751:30763 transaction failed 29201/-22, size 104-24 line 3525 [ 2288.827811] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.837098] binder: 30762:30764 got reply transaction with no transaction stack [ 2288.837106] binder: 30762:30764 transaction failed 29201/-71, size 0-0 line 3046 [ 2288.837119] binder: 30762:30764 ioctl c0306201 20000280 returned -14 [ 2288.837344] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.873647] binder_alloc: 30766: binder_alloc_buf, no vma [ 2288.873667] binder: 30766:30769 transaction failed 29189/-3, size 99-24 line 3284 [ 2288.873914] binder: undelivered TRANSACTION_ERROR: 29189 [ 2288.889820] binder: 30767:30773 got transaction with out-of-order buffer fixup [ 2288.889849] binder: 30767:30773 transaction failed 29201/-22, size 104-24 line 3525 03:44:38 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2288.890008] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.898631] binder: 30767:30775 got transaction with out-of-order buffer fixup [ 2288.898659] binder: 30767:30775 transaction failed 29201/-22, size 104-24 line 3525 [ 2288.898797] binder: undelivered TRANSACTION_ERROR: 29201 [ 2289.071989] binder: 30730:30734 transaction failed 29189/-3, size 99-24 line 3284 [ 2289.084162] binder: undelivered TRANSACTION_ERROR: 29189 03:44:39 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x40000000141042, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000000c0)) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x261c41eb}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = gettid() ptrace$setopts(0x4206, r6, 0x0, 0x0) tkill(r6, 0x3b) ptrace$setregs(0xd, r6, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r6, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r6, 0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000080)='pagemap\x00', 0xffffffffffffffff}, 0x30) syz_open_procfs(r7, &(0x7f00000001c0)='net/ip_tables_targets\x00') sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="09631040004000000000000000000000000000001263484000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e6ff00"/96], 0x0, 0x0, 0x0}) 03:44:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000400)='/proc/self/attr/exec\x00', 0x2, 0x0) openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000000)='memory.events\x00', 0x0, 0x0) recvfrom$unix(r3, &(0x7f0000000180)=""/128, 0x80, 0x1, &(0x7f0000000200)=@file={0x2, './file0\x00'}, 0x6e) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$addseals(r5, 0x409, 0x5) r6 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r6, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x1c, &(0x7f0000000300)="8be5cf5be66dccb3e0447eb743ea2d761a2fef5b1d38ecc8723481c9fc6c4fbb36fc5c4e32996d6d821862c021249b3e117cc3fc47a29961d4edbc1b005eeb48d81e9b2faee189644603ae95caeabfe1deac7c589c99132b68a74296227c255c28255dd1f5b49f53f5c6ee5bc36a34ecde4cbeb5df2e762aa4a703ee131a7cbdc6af3c4afb448cebd2e1aef43d941435", 0x90) dup(r2) creat(&(0x7f0000000280)='./file0\x00', 0xe6d197b36c3c3b3d) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x408208) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="11634840000000000000000080000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="00000000000000009f6076c50f0a3b9015799f09f4059b0830786eb52287cb099acc2cf030e8d6e71fb1016e4b1c813d15b81e00609002e8f903f6f02bc9fdc7f3b3485a2185124182ae6faa89bd46a224ae"], 0x0, 0x0, 0x0}) 03:44:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x3d05988e3fbfff74) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x169040, 0x2) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x4) fchdir(r3) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000300)=@mangle={'mangle\x00', 0x1f, 0x6, 0x758, 0x0, 0x5d0, 0x510, 0x0, 0x5d0, 0x6c0, 0x6c0, 0x6c0, 0x6c0, 0x6c0, 0x6, &(0x7f0000000180), {[{{@uncond, 0x0, 0x2f0, 0x318, 0x0, {}, [@common=@unspec=@bpf1={0x230, 'bpf\x00', 0x1, @fd={0x2, 0x0, r3}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x14}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@uncond, 0x0, 0x110, 0x138, 0x0, {}, [@common=@unspec=@connlabel={0x28, 'connlabel\x00', 0x0, {0x3, 0x1}}, @common=@osf={0x50, 'osf\x00', 0x0, {'syz1\x00', 0x1f, 0x2, 0x1, 0x1}}]}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00'}}, {{@ip={@remote, @multicast2, 0x0, 0xffffff00, 'bond0\x00', 'nr0\x00', {0x1fe}, {0x80}, 0x0, 0x2, 0x20}, 0x0, 0x98, 0xc0}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x5}}}, {{@ip={@multicast1, @multicast2, 0xffffffff, 0xff000000, 'nr0\x00', 'bond0\x00', {0xff}, {0xff}, 0xff, 0x1, 0x4}, 0x0, 0x98, 0xc0}, @TTL={0x28, 'TTL\x00', 0x0, {0x0, 0x40}}}, {{@uncond, 0x0, 0xc0, 0xf0, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x18}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x45, 0x3, @remote, 0x4e21}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x7b8) [ 2289.105325] binder_alloc: 30778: binder_alloc_buf, no vma [ 2289.110939] binder: 30778:30779 transaction failed 29189/-3, size 99-24 line 3284 [ 2289.119582] binder: undelivered TRANSACTION_ERROR: 29189 03:44:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:39 executing program 0: r0 = getpid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$int_out(r1, 0x7e50, &(0x7f0000000180)) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x41, &(0x7f0000000100)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000079000040b84c818f8f6cdc937ff87d9988268700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c65eb59c00"/116], 0x78) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) prctl$PR_GET_UNALIGN(0x5, &(0x7f00000000c0)) 03:44:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:39 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getrlimit(0x6, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100064, 0x4000400000000002) 03:44:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='\x8bV\xa6\x9e\xb1\x7f\xa0sder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r3 = getpid() ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f0000000040)=r3) [ 2289.186012] binder: 30786:30791 BC_ACQUIRE_DONE u0000000000004000 no match [ 2289.194286] binder_alloc: 30789: binder_alloc_buf, no vma 03:44:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80200, 0x0) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) r5 = syz_open_dev$binderN(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x1802) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000014c0)={0x70, 0x0, &(0x7f0000001400)=[@increfs_done={0x40106308, 0x2}, @decrefs={0x40046307, 0x2}, @release={0x40046306, 0x3}, @acquire, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x846f035be2344101, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001380)={@fd, @fda={0x66646185, 0x8, 0x0, 0x13}, @ptr={0x70742a85, 0x1, &(0x7f0000001300)=""/122, 0x7a, 0x0, 0x5}}, &(0x7f0000000280)={0x0, 0x18, 0x38}}}], 0x5, 0x0, &(0x7f0000001480)="f13a196654"}) tkill(r4, 0x3b) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) r6 = getpgrp(r4) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f0000000180)=r6) r7 = dup(r2) r8 = syz_open_pts(0xffffffffffffffff, 0x20000) ioctl$VT_RELDISP(r8, 0x5605) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) read$FUSE(0xffffffffffffffff, &(0x7f0000000300), 0xea2) r9 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r9, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) getsockname$packet(r9, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="0000000000000000f10200"/24], @ANYBLOB="0000000064016374"], 0x0, 0x0, 0x0}) 03:44:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:39 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000080)=0x8) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendfile(r0, r2, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2289.194305] binder: 30789:30794 transaction failed 29189/-3, size 99-24 line 3284 [ 2289.195055] binder: undelivered TRANSACTION_ERROR: 29189 03:44:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2289.200118] binder: 30787:30793 got transaction with invalid data ptr [ 2289.200148] binder: 30787:30793 transaction failed 29201/-14, size 99-24 line 3316 [ 2289.200303] binder: undelivered TRANSACTION_ERROR: 29201 [ 2289.221445] binder: 30787:30798 got transaction with invalid data ptr [ 2289.221503] binder: 30787:30798 transaction failed 29201/-14, size 99-24 line 3316 [ 2289.222835] binder: undelivered TRANSACTION_ERROR: 29201 [ 2289.268266] binder: 30802:30804 transaction failed 29189/-22, size 99-24 line 3138 [ 2289.268673] binder: undelivered TRANSACTION_ERROR: 29189 [ 2289.335425] binder: 30813:30817 transaction failed 29189/-22, size 99-24 line 3138 [ 2289.335811] binder: undelivered TRANSACTION_ERROR: 29189 [ 2289.340061] binder: 30812:30815 BC_INCREFS_DONE u0000000000000002 no match [ 2289.340073] binder: 30812:30815 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 2289.340081] binder: 30812:30815 Release 1 refcount change on invalid ref 3 ret -22 [ 2289.340103] binder: 30812:30815 got reply transaction with no transaction stack [ 2289.340111] binder: 30812:30815 transaction failed 29201/-71, size 96-24 line 3046 [ 2289.377647] binder: undelivered TRANSACTION_ERROR: 29201 [ 2289.423239] binder: 30825:30826 transaction failed 29189/-22, size 99-24 line 3138 [ 2289.423606] binder: undelivered TRANSACTION_ERROR: 29189 [ 2289.527841] binder: 30786:30791 got reply transaction with no transaction stack 03:44:39 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) rt_sigqueueinfo(r0, 0x3e, &(0x7f00000000c0)={0xf, 0xe7c, 0x8}) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) getrlimit(0xf, &(0x7f0000000000)) 03:44:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x806) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:39 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) r4 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r5, 0xc06855c8, &(0x7f0000000080)={0xe, 0x1, {0x57, 0x9b, 0x400, {0x0, 0x3f}, {0x0, 0x7f}, @cond=[{0x9, 0x7, 0x9, 0xffff, 0x81ff, 0x80}, {0x0, 0x0, 0xd99, 0x6, 0x6}]}, {0x54, 0x400, 0x0, {0x2, 0xcefc}, {0x5, 0x5}, @period={0x59, 0x1, 0x4, 0x1, 0x56e2, {0x7ff, 0x5, 0xa2, 0x844}, 0x2, &(0x7f0000000000)=[0x6, 0xffff]}}}) openat$cgroup_procs(r4, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x2400, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:39 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) symlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00') r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='cpu.stat\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xe8, r3, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x4c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x15}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9b}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}]}, @TIPC_NLA_SOCK={0x44, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7760}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7ff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffffa}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_BEARER={0x28, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'eth', 0x3a, 'ip6erspan0\x00'}}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20040000}, 0x4000000) [ 2289.535907] binder: 30786:30791 transaction failed 29201/-71, size 0--7318349394477056 line 3046 [ 2289.547732] binder: undelivered TRANSACTION_ERROR: 29201 03:44:39 executing program 5: socket$inet6(0xa, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") socket(0xa, 0x3, 0x1) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendfile(0xffffffffffffffff, r3, &(0x7f0000000040)=0x440100060, 0x4000400000000000) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0x0, 0x59b5174b, 0xc}, 0xc) ioctl$FIBMAP(r4, 0x1, &(0x7f0000000080)=0x7) 03:44:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2289.579519] binder: 30835:30842 got transaction with invalid data ptr [ 2289.599979] binder: 30836:30846 got transaction with out-of-order buffer fixup 03:44:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r4, 0x0) r5 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r5, r4, r2) add_key(&(0x7f0000000000)='blacklist\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000180)="3b7d7c2507e75c4691c9da7fde1096ae349666195ed6d05932a2901ef61c9886cee984229b15b36e0a7a865f81922241f3c2fa7f15d5ff1babfaf9cfc30b2c4c8ce2eb31a2a351d2a5750db7d2fdc930da66b826f9c01ea3dbdd18d47507c01eb56725d7121ff8d2cdc79a654636049d48f00e1a3b1505", 0x77, r5) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000080680000d5ac0000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000000000000006e010000000000005000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r6 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r6, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x11, 0x800000003, 0x0) bind(r8, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r8, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r9, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) sendto$packet(r6, &(0x7f0000000300)="660661f57712666ad8af3ad517c08bcb7c4fd64892724da29478f946a866f85fdfa6c02a152fdfff0199a970684af8ba9d04023f31a150ef93f58fd08beda3bd29d78fd697fc661d472bc4276b7ac4e63411fe97", 0x54, 0x40, &(0x7f0000000280)={0x11, 0x15, r9, 0x1, 0x8, 0x6, @broadcast}, 0x14) 03:44:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2289.600009] binder: 30836:30846 transaction failed 29201/-22, size 104-24 line 3525 03:44:39 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pkey_free(0xffffffffffffffff) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x101000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = gettid() r3 = syz_open_procfs(r2, &(0x7f00000001c0)='net/ip_tables_names\x00') ioctl$PPPIOCGUNIT(r3, 0x80047456, &(0x7f0000000280)) r4 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r5 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) write$P9_RLOPEN(r5, &(0x7f0000000040)={0x18, 0xd, 0x1, {{0x1, 0x1, 0x5}, 0x7fffffff}}, 0x18) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000180)={0xb, 0x77, 0x1, 0x1f}, 0xb) setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f00000003c0)={'filter\x00', 0x0, 0x0, 0x0, [], 0x1, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x0, [{}]}, 0x88) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="116348400000000000000000040000000000000000000000000000000000000000000000680000000000000018000000000000008eeb2288dda3caaaf759f40fde387e90e75f9b99128cee85d600812decc1c91d725d818818fa34e1bc354133d06a6cf986f64ea7d536b13727a9246673ab9b4c847b44fe303534f9f7044cfe72a8d6ee191e2f32d01920f948ed5dbc81ad0de8e5f51f8ca8cf73d1d3d8acdf08bed5643cbcdba3f5d0419f16183640fba4690df38f7fa8b64b19957f3b0fc47606003e0f9610b5aec9af15b605ad4505fbf21b37591f3719d73c93617ea8568f99add6c0756c425233a62ae4fc508210", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 2289.601135] binder: undelivered TRANSACTION_ERROR: 29201 [ 2289.622299] binder: 30836:30848 got transaction with out-of-order buffer fixup [ 2289.622329] binder: 30836:30848 transaction failed 29201/-22, size 104-24 line 3525 [ 2289.622571] binder: undelivered TRANSACTION_ERROR: 29201 [ 2289.629145] binder: 30844:30850 BC_ACQUIRE_DONE node 13501 has no pending acquire request [ 2289.629156] binder: 30844:30850 got reply transaction with no transaction stack [ 2289.629164] binder: 30844:30850 transaction failed 29201/-71, size 0-0 line 3046 [ 2289.629327] binder: undelivered TRANSACTION_ERROR: 29201 [ 2289.735569] binder: 30861:30866 BC_ACQUIRE_DONE node 13505 has no pending acquire request [ 2289.735578] binder: 30861:30866 got reply transaction with no transaction stack [ 2289.735586] binder: 30861:30866 transaction failed 29201/-71, size 0-0 line 3046 [ 2289.735769] binder: undelivered TRANSACTION_ERROR: 29201 [ 2289.833568] binder: 30880:30882 BC_ACQUIRE_DONE node 13508 has no pending acquire request [ 2289.833578] binder: 30880:30882 got reply transaction with no transaction stack [ 2289.833587] binder: 30880:30882 transaction failed 29201/-71, size 0-0 line 3046 [ 2289.833746] binder: undelivered TRANSACTION_ERROR: 29201 [ 2289.856912] binder_alloc: 30881: binder_alloc_buf size -8795939010693603224 failed, no address space [ 2289.856920] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2289.856940] binder: 30881:30884 transaction failed 29201/-28, size 104-24 line 3284 [ 2289.857122] binder: undelivered TRANSACTION_ERROR: 29201 [ 2289.874627] binder_alloc: 30881: binder_alloc_buf size -8795939010693603224 failed, no address space [ 2289.874636] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2289.874656] binder: 30881:30886 transaction failed 29201/-28, size 104-24 line 3284 [ 2289.874938] binder: undelivered TRANSACTION_ERROR: 29201 [ 2290.037557] binder: 30835:30842 transaction failed 29201/-14, size 99-24 line 3316 03:44:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r0, 0xffffffffffffffff, 0xc0000) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r4, 0x4008240b, &(0x7f0000000180)={0x1, 0x70, 0x80, 0xff, 0x61, 0x6, 0x0, 0x2, 0x2000, 0xa, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x1, @perf_bp={&(0x7f0000000000), 0x2}, 0x14000, 0x10000, 0x800, 0x4, 0x2, 0x99b, 0x5b}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 03:44:39 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000080)=""/6) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendfile(r0, r2, &(0x7f0000000040)=0x40100060, 0x4000400000000000) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup3(r5, r3, 0x180000) 03:44:39 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000140)={0x3, 0x401, 0x9, 0x9, 0xb, 0x5, 0x5, 0x40, 0x10000, 0x6}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r2 = getpid() tkill(r2, 0x16) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000000c0)={0xf31a, 0x1, 0x1635, 0x0, 0x7, 0xfa, 0x63, 0xb2, 0x9, 0x8}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000006900000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000300)={{{@in=@empty, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@mcast2}}, &(0x7f0000000180)=0xe8) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r8) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)=0x0) fsetxattr$system_posix_acl(r3, &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f00000005c0)={{}, {0x1, 0x2}, [{0x2, 0x3, r4}, {0x2, 0x2, 0xee00}, {0x2, 0xe1e6d2b498b7e634, r6}, {0x2, 0x5, r8}, {0x2, 0x0, r9}], {0x4, 0x4}, [{0x8, 0x5, r10}, {0x8, 0x7, r11}], {0x10, 0x1}, {0x20, 0x4}}, 0x5c, 0x3) ioctl$RTC_WIE_ON(r2, 0x700f) 03:44:39 executing program 3: r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$RTC_PIE_OFF(r0, 0x7006) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) prctl$PR_SET_SECUREBITS(0x1c, 0x10) r4 = socket$netlink(0x10, 0x3, 0x15) ioctl$EXT4_IOC_MIGRATE(r4, 0x6609) [ 2290.047918] binder: undelivered TRANSACTION_ERROR: 29201 03:44:39 executing program 5: r0 = socket$inet6(0xa, 0x80000, 0x3f) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 2290.112283] binder: 30900:30904 BC_ACQUIRE_DONE node 13515 has no pending acquire request [ 2290.114172] binder: 30894:30901 ioctl c0306201 0 returned -14 [ 2290.128493] binder: 30899:30906 got transaction with out-of-order buffer fixup 03:44:40 executing program 4: r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r1 = accept4$unix(r0, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e, 0x800) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000240)={'bridge_slave_0\x00', 0x6}) r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file0\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/exec\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) ioctl$VT_RELDISP(r5, 0x5605) [ 2290.140672] binder: 30903:30908 got transaction with invalid data ptr [ 2290.140700] binder: 30903:30908 transaction failed 29201/-14, size 99-24 line 3316 03:44:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 03:44:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x90, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x2, 0x2, 0x3c}, @fd={0x66642a85, 0x0, r3}, @fda={0x66646185, 0x2, 0x0, 0xf}}, &(0x7f0000000000)={0x0, 0x20, 0x38}}}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) [ 2290.140856] binder: undelivered TRANSACTION_ERROR: 29201 [ 2290.166040] audit: type=1400 audit(2000000680.030:107): avc: denied { create } for pid=30900 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 03:44:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000300)) fchdir(r1) bind$unix(r1, &(0x7f0000000140)=@file={0x0, './file0/file0\x00'}, 0x6e) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r6 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r6) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f00000000c0), &(0x7f00000001c0)=0x14) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='auxv\x00') r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r9, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup2(r8, r9) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840030000000000000000000000000000000000000010000000000000000000000050000000000000001800000000000000", @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB="85616466000001000a0000000000000000001788000000001600000000000000852a68770010000000000000000000000000000000000000852a6466abae0000d0c4b6cd5bd68c5fce929a8fdc37c6d77f6fab5e46a4d81ed8681c3a86653547579e9cd7e80764e0d67fd3335def1f07850a4d86f4f67f634624d450b0618f50a928fb4719796fd6c38c5ddf425c2e1a90b3484c7809f726b0fc31a2bda5e5e4187f168f42aa2190a6593f73b5cb4439d06873b5306f34038c7816a2a76256affb6752c1c51cdad86319ab61e27f406610b292980c1d37aa9dcf1ce041e8c9946b27a1b3e0221bff31d0b9b31b01c546542df6eb16c0496cb7fdc832742816c505b1e3826e6994a2", @ANYRES32=r7, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0002000000000000"], 0x0, 0x0, 0x0}) 03:44:40 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) r4 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r4, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e23, 0xff, @mcast2, 0x80}, 0x1c) symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') [ 2290.171237] binder: 30900:30904 got reply transaction with no transaction stack [ 2290.171247] binder: 30900:30904 transaction failed 29201/-71, size 0-0 line 3046 [ 2290.185879] binder: undelivered TRANSACTION_ERROR: 29201 [ 2290.191222] binder: 30914:30918 ioctl c0306201 0 returned -14 03:44:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xfffffe73, 0x0, &(0x7f0000000300)=[@increfs_done={0x40106308, 0x2}, @acquire={0x40046305, 0x2}], 0x0, 0x0, 0x0}) 03:44:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) setxattr$security_ima(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='security.ima\x00', &(0x7f00000001c0)=@v1={0x2, "8dce0750bd634a"}, 0x8, 0x0) [ 2290.210270] binder: 30922:30926 got transaction with invalid data ptr [ 2290.210312] binder: 30922:30926 transaction failed 29201/-14, size 99-24 line 3316 [ 2290.210547] binder: undelivered TRANSACTION_ERROR: 29201 [ 2290.291335] binder: 30934:30935 got transaction to context manager from process owning it [ 2290.291349] binder: 30934:30935 transaction failed 29201/-22, size 88-24 line 3129 [ 2290.291680] binder: undelivered TRANSACTION_ERROR: 29201 [ 2290.322451] binder: 30939:30941 ioctl c0306201 0 returned -14 [ 2290.380498] binder: 30949:30951 got transaction with invalid data ptr [ 2290.380874] binder: 30949:30951 transaction failed 29201/-14, size 99-24 line 3316 [ 2290.381204] binder: undelivered TRANSACTION_ERROR: 29201 [ 2290.387372] binder: 30947:30950 BC_INCREFS_DONE u0000000000000002 no match [ 2290.387382] binder: 30947:30950 Acquire 1 refcount change on invalid ref 2 ret -22 [ 2290.387388] binder: 30947:30950 unknown command 0 [ 2290.387396] binder: 30947:30950 ioctl c0306201 20000280 returned -22 [ 2290.472605] binder: 30899:30906 transaction failed 29201/-22, size 104-24 line 3525 [ 2290.483718] binder: undelivered TRANSACTION_ERROR: 29201 [ 2290.484601] binder: BINDER_SET_CONTEXT_MGR already set [ 2290.484611] binder: 30899:30921 ioctl 40046207 0 returned -16 03:44:43 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x8, @perf_bp={&(0x7f0000000140), 0x1f}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$BLKROTATIONAL(r1, 0x127e, &(0x7f00000000c0)) 03:44:43 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) r3 = getuid() getgroups(0x1, &(0x7f00000005c0)=[0xee00]) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r9 = gettid() r10 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r11) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r13 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r12, 0x400454ce, r14) r15 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r15, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r16 = fcntl$getown(r15, 0x9) r17 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r17, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r18) getresgid(&(0x7f0000000600), &(0x7f0000000640)=0x0, &(0x7f0000000680)) r20 = openat$urandom(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/urandom\x00', 0x80, 0x0) r21 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r21, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getresuid(&(0x7f0000000d80)=0x0, &(0x7f0000000dc0), &(0x7f0000000e00)) r23 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r23, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r24 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r24, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r23, 0x400454ce, r25) r26 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r26, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r28) r29 = openat$cgroup_int(r28, &(0x7f0000000e40)='pids.max\x00', 0x2, 0x0) r30 = socket$inet_udplite(0x2, 0x2, 0x88) r31 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r31, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r32 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r32, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r33 = gettid() ptrace$setopts(0x4206, r33, 0x0, 0x0) tkill(r33, 0x3b) ptrace$setregs(0xd, r33, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r33, 0x0, 0x0) getresuid(&(0x7f0000000e80), &(0x7f0000000ec0), &(0x7f0000000f00)=0x0) r35 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r35, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_cred(r35, 0x1, 0x11, &(0x7f0000000f40)={0x0}, &(0x7f0000000f80)=0xc) r37 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r37, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r38) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000fc0)={0x0, 0x0, 0x0}, &(0x7f0000001000)=0xc) r40 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001040), 0x4) r41 = epoll_create(0x7f) r42 = gettid() ptrace$setopts(0x4206, r42, 0x0, 0x0) tkill(r42, 0x3b) ptrace$setregs(0xd, r42, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r42, 0x0, 0x0) r43 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r43, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r44) r45 = getegid() r46 = gettid() r47 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r47, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fstat(r47, &(0x7f0000001080)={0x0, 0x0, 0x0, 0x0, 0x0}) r49 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r49, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r50 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r50, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r49, 0x400454ce, r51) r52 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r52, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r53 = epoll_create1(0x80000) r54 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r54, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r55 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r55, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_SIOCGPGRP(r55, 0x8904, &(0x7f00000016c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001700)={0x0, 0x0}, &(0x7f0000001740)=0xc) r58 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r58, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r59 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r59, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r58, 0x400454ce, r60) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000001780)=0x0) stat(&(0x7f00000017c0)='./file0\x00', &(0x7f0000001800)={0x0, 0x0, 0x0, 0x0, 0x0}) r63 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r63, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_cred(r63, 0x1, 0x11, &(0x7f0000001880)={0x0, 0x0, 0x0}, &(0x7f00000018c0)=0xc) r65 = socket$inet_tcp(0x2, 0x1, 0x0) r66 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r66, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r67 = openat$cgroup(0xffffffffffffffff, &(0x7f0000001900)='syz1\x00', 0x200002, 0x0) r68 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r68, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r69 = syz_open_dev$loop(&(0x7f0000001940)='/dev/loop#\x00', 0x0, 0x400000) r70 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r70, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r71 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000030c0)='/proc/self/net/pfkey\x00', 0x8000, 0x0) r72 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r72, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r73 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r73) r74 = perf_event_open$cgroup(&(0x7f0000003100)={0x4, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x37b, 0x143992, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x10001, 0x4, @perf_config_ext={0x8, 0x7fffffff}, 0x4a7c2, 0xff, 0x6, 0x9, 0xffff, 0xef, 0x3}, 0xffffffffffffffff, 0xb, r73, 0x8) r75 = gettid() ptrace$setopts(0x4206, r75, 0x0, 0x0) tkill(r75, 0x3b) ptrace$setregs(0xd, r75, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r75, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000003180)={{{@in=@broadcast, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@initdev}}, &(0x7f0000003280)=0xe8) r77 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r77, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r78 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r78, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r77, 0x400454ce, r79) r80 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r80, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r81 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r81, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r82 = gettid() ptrace$setopts(0x4206, r82, 0x0, 0x0) tkill(r82, 0x3b) ptrace$setregs(0xd, r82, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r82, 0x0, 0x0) r83 = geteuid() r84 = getegid() r85 = gettid() ptrace$setopts(0x4206, r85, 0x0, 0x0) tkill(r85, 0x3b) ptrace$setregs(0xd, r85, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r85, 0x0, 0x0) r86 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r86) getsockopt$inet6_IPV6_XFRM_POLICY(r86, 0x29, 0x23, &(0x7f00000032c0)={{{@in6=@ipv4, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@empty}}, &(0x7f00000033c0)=0xe8) r88 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r88, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r89 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r89, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r88, 0x400454ce, r90) r91 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r91, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r92 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r92, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r91, 0x400454ce, r93) getgroups(0x5, &(0x7f0000003400)=[r90, 0xee01, r93, 0xee01, 0x0]) r95 = gettid() ptrace$setopts(0x4206, r95, 0x0, 0x0) tkill(r95, 0x3b) ptrace$setregs(0xd, r95, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r95, 0x0, 0x0) stat(&(0x7f00000038c0)='./file1\x00', &(0x7f0000003900)={0x0, 0x0, 0x0, 0x0, 0x0}) r97 = getgid() r98 = gettid() ptrace$setopts(0x4206, r98, 0x0, 0x0) tkill(r98, 0x3b) ptrace$setregs(0xd, r98, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r98, 0x0, 0x0) r99 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r99, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_IP_IPSEC_POLICY(r99, 0x0, 0x10, &(0x7f0000003980)={{{@in6=@empty, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@local}}, &(0x7f0000003a80)=0xe8) r101 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r101, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r102 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r102, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r101, 0x400454ce, r103) r104 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r104, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r105 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r105, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r106 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r106, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r107 = gettid() ptrace$setopts(0x4206, r107, 0x0, 0x0) tkill(r107, 0x3b) ptrace$setregs(0xd, r107, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r107, 0x0, 0x0) r108 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r108, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r109) r110 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r110, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r111 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r111, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r110, 0x400454ce, r112) r113 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r113, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r114 = gettid() ptrace$setopts(0x4206, r114, 0x0, 0x0) tkill(r114, 0x3b) ptrace$setregs(0xd, r114, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r114, 0x0, 0x0) r115 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r115, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_IP_XFRM_POLICY(r115, 0x0, 0x11, &(0x7f0000003ac0)={{{@in6=@empty, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@loopback}}, &(0x7f0000003bc0)=0xe8) r117 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r117, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r118 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r118, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r119 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r119, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r120 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r120, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r121 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r121, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r122 = fcntl$dupfd(r120, 0x0, r121) r123 = gettid() ptrace$setopts(0x4206, r123, 0x0, 0x0) tkill(r123, 0x3b) ptrace$setregs(0xd, r123, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r123, 0x0, 0x0) r124 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r124, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_IP_IPSEC_POLICY(r124, 0x0, 0x10, &(0x7f0000003f00)={{{@in6=@remote, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@empty}}, &(0x7f0000004000)=0xe8) getresgid(&(0x7f0000004040), &(0x7f0000004080)=0x0, &(0x7f00000040c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000004100)=0x0) getresgid(&(0x7f0000004140), &(0x7f0000004180), &(0x7f00000041c0)=0x0) r129 = getpgrp(0x0) r130 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r130, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r131) r132 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r132, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r133 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r133, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r132, 0x400454ce, r134) r135 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r135, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r136 = fcntl$getown(r135, 0x9) r137 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r137, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r138) r139 = getgid() r140 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r140, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r141 = fcntl$dupfd(r140, 0x605, 0xffffffffffffffff) r142 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r142, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r143 = socket$key(0xf, 0x3, 0x2) r144 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000042c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) lstat(&(0x7f0000004300)='./file0\x00', &(0x7f0000004340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000005600)=0x0) fstat(r0, &(0x7f0000005640)={0x0, 0x0, 0x0, 0x0, 0x0}) r148 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r148, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r149) r150 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r150, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r151 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r151, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r150, 0x400454ce, r152) r153 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r153, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r154 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r154, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r155 = getpgrp(0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005c00)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@broadcast}}, &(0x7f0000005d00)=0xe8) r157 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r157, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r158 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r158, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r157, 0x400454ce, r159) r160 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r160, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r161 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r161, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r162 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r162, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r163 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r163, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r164 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r164, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r165 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r165, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r166 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000005d40)='/selinux/mls\x00', 0x0, 0x0) sendmmsg$unix(r1, &(0x7f0000005e00)=[{&(0x7f0000000400)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000480)="340f23b52bc604e528bbc3f1cf70f2b5812048562c43fec8996602083d856416b42f91467b8d3efb794133f510a2cd2bacfe9b131bef969dde4da892b8cc68a897487bed049c7225e4baa4fea986e22b04aaba4547c05790b76f735685c943121d0a4634ec9445fd0b912fff5cbaf57e6cdc7e69750a88e1136be191aba5528e4bb7a94bf9ce9d32e40a8fa7eb85970940dac07c5c9004a09170cd72d403d4fd91b8a957034276804c30b36227736799c3cb59cc504349c4695aa297524002a280e8901df642ccb0d41b27d311ea7186cdda5b1bf3f8f4ba693a62dc44f860bfa7c02990b29622", 0xe7}], 0x1, &(0x7f0000000700)=[@cred={{0x1c, 0x1, 0x2, {r2, r3, r4}}}, @rights={{0x18, 0x1, 0x1, [r5, r6]}}, @rights={{0x1c, 0x1, 0x1, [r7, r0, r8]}}, @cred={{0x1c, 0x1, 0x2, {r9, r11, r14}}}, @rights={{0x18, 0x1, 0x1, [r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r16, r18, r19}}}, @rights={{0x1c, 0x1, 0x1, [r0, r20, r21]}}], 0xd0, 0x8000}, {&(0x7f0000000800)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000d00)=[{&(0x7f0000000880)="e273fcb5341baa8c40e71f685984a97adcba5bb1328de54d9528abe56f27a9b5d675d395b0142d449a99b1f7f385939bea79d0a3bbb1e06e56028faf1dcf1ea3308aab5dba5e4db1da3f9aebf61ca43ca210b94ff11d53b700f2c973fcb9c0dc7e11d519f3a2e1b9d68385b1e2571dde5db28acaae5a905e77cb0e4a2664d7dc0a1cb034cc64562f113e79a4c96c659a3a63cc7d98f888ec36c8d400ed0eea6c5fd88519cbb547bad9bedd4ea8e2cda9324ed9d2d650232dc0dabe3d7d7f469a65d2109f32bcc4dae3eb70e953e9bb59f33e61510e6ec20948e67a5a9510ecb0a0a65840f1", 0xe5}, {&(0x7f0000000980)="18f0c2e5e8dcb66661cf40edfebd3d9f3a61d74da95683f4a3f36d", 0x1b}, {&(0x7f00000009c0)="1e3abec883eb9348b9824822e7e112dd7b9cd17982e388766e43cac854cfd1718cba70a1cf8ceb4af72b6be37673291bc613618dd7bb28c1c4cc9709a43f043fd2dc209c9d5a2bea53f976e1d94b542f8bd7556ae905b8c13df93c0a19fbee47c61a87c679c44e2a4b0b4f1d93a295017a85a3f194fd1f3c0fcf04b0f904dda1a27c6fe284fc0846a8c63946e09632f069", 0x91}, {&(0x7f0000000a80)="720096188f939cb7d98ce52cd3111c7c5e50c565086d9e12e5d5c8c99869d411fc7cf4a09a9d8d4bcb84a5122264094db5072a79e3a5b7711ed95569c9a76e307a797e016312acbf6e738bdab7695f4bd2a01fc65f910ab6ea7577d5b3fb4572dd512acebee3985c2e6da7baaebb7f4e516657e19b25c1ac684ad532e8f783950e704998b963280cc9e175e5b5029b6ff12c980b8446a0", 0x97}, {&(0x7f0000000b40)="9b0768c275844d2e5acf5c42d49ca3c36068454dd28ed949415ed25e46cf768dd39843a713c07a7c9cced0366d73970d67febcccbe74d3428a613c1ab397bc4c88d4955b4232abe9ebf8df218122b343b7c345151f54e98783b2d8f949d553b4b5be0ff87efe92a1cb27ead851e5a49af480a143ae8d82681d", 0x79}, {&(0x7f0000000bc0)="a35606caa939e4d303e6f05b098642877f742cd977aa826eec5ac2dfd3117ff85017167adf36719a301798db6b0255edc267", 0x32}, {&(0x7f0000000c00)="ac99dbe5e8d444e5e49c9e76783c076c13c7ed31344bc0ae0a32bf6a90d0b62bbe8f8cb922c08634f777f032712e04bdcae76e963e8bcfe59e7b01f8d14c", 0x3e}, {&(0x7f0000000c40)="0ccbe3f47e615a04f2ada18a5ed85038effee816c9873d85bb24edf8d25121782280b2386a360b1036be12148aa1819d087fafaadb82a0c4537651b32cb61ff2d2016f97ab0dc5565119585454a9ebe29a8e4541585bb9f8a506e207668dbd158f05fd11bf9733e3234a05f796dc5e7dd6a6a2f60f1149487f6f03ee1458f4889a30951b59bd8c1f2161ba2a30f8ca7f57f6ae97923a2a5b3491", 0x9a}], 0x8, &(0x7f0000001100)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r22, r25}}}, @rights={{0x2c, 0x1, 0x1, [r0, 0xffffffffffffffff, r26, r27, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [r0, r29, r0, 0xffffffffffffffff, r30, r0, r31, r0, r0]}}, @rights={{0x1c, 0x1, 0x1, [r32, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r33, r34, 0xee00}}}, @cred={{0x1c, 0x1, 0x2, {r36, r38, r39}}}, @rights={{0x2c, 0x1, 0x1, [r0, r0, 0xffffffffffffffff, r0, r40, r41, r0]}}, @cred={{0x1c, 0x1, 0x2, {r42, r44, r45}}}, @cred={{0x1c, 0x1, 0x2, {r46, r48, r51}}}], 0x158}, {&(0x7f0000001280)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001680)=[{&(0x7f0000001300)="cd165ef2aafb37bd667d853e53d7c6ccfe85754a6ce488900e543eeb6d02c314d216c23108d6a551392c10547240015dddd8cd13d049381428cb29daf93ec6ba620f58287f91eeff780d53feb3d80f6a0d40cb0d4e8353dc041b00d09caa22bdb7ecf526cd2e147bd695fe4c4e86f528359f204a8c44165b8b8ad7771f6bbecf4e601962f99f222dc1e8512f1705179fb555c75a52b5aebc026d0770d1502210", 0xa0}, {&(0x7f00000013c0)="60ddc4542931d297fe9b59a733a913dc0351373799b14e9e705899be6415c7e6e2c112745d629ad95ac7fbae357ed9ddfc973eaeaceae094adfbeb14b30aa03d2b2551a4c853648bbf44efbfe1172ecd6e2f7f2eaf177b72b2db412dbb98ebf61d57779869fc1348dd113fd3f02a0092bc2113e095b6ae137bb9546a463b522671ceadc6d5efa1fcfb66ae9daa4c3ce0b62cec2fc7472771dbdc3ed8e6dcd3222966b12c0135d2acaf7cd9de97714d16f206f99b8057c0308cb801f44a9e03671b28794c0e9e56fe220a0e61ecd6bbfcf0af9646b51b2087ec361634799e24c44b20ffabe1c707c667b8a8800fc5bbafb46729ecee43ab90", 0xf8}, {&(0x7f00000014c0)="1abf09120ccc242a79b2ffd551eb9620be11e9bbe06b028f5d5d01809c64ff595452db61cda863d65171d896f6401f98e2e52e67fc01704b88798bb3faa1ec7ede1bba5636de994c0b74c977a8828310def38385c3c8a87720a6087d1cf0df5f59584c15ebeb1d867a4b25ddbb38c16fdf8f3f07cd8b29926432243aabcd5a6b3d55d71f62e180a7f622cecb4eaf0d7b74", 0x91}, {&(0x7f0000001580)="5e364f91ff181a17c173a743327baed6b5602c7cc380942d6391becc95bd78c8ae157fdd8eb867f27d07638379acadd03fc0ee3eb602fddcff84647ecef3d0134ed3ffb1095b63dd426b24ce23330398ec05c654e87fe12b75fa2c377312516b3894945814d3acf0e2c0a57f62e31e1ee32e45562964fc97aa436ffefc28ffd5205a4f78067ecdffa5ed96b9dd76fedee1ad99160a33f3ffccebebf48189f2fbac59ed7a31dcfcb00d15abde67314548c9f5a093784a62dce312a7041d937181b0889447080de1d0e779d3a520b7387be5a18dfca05279a07bb74a8793026b28193d23551f2c", 0xe6}], 0x4, &(0x7f0000001980)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r0, r0]}}, @rights={{0x14, 0x1, 0x1, [r52]}}, @rights={{0x1c, 0x1, 0x1, [r53, r0, r54]}}, @cred={{0x1c, 0x1, 0x2, {r56, r57, r60}}}, @cred={{0x1c, 0x1, 0x2, {r61, r62, r64}}}, @rights={{0x18, 0x1, 0x1, [r0, r65]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r66, r67, r68, r69]}}], 0xe0, 0x20000000}, {&(0x7f0000001a80)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000003000)=[{&(0x7f0000001b00)="40375a900a26b302036a8ab3479aeb7ab9fee09a6a57e2639e16c65d24b80258e4f166f27c16f5be9e9c4fd298e3", 0x2e}, {&(0x7f0000001b40)="5e7bbcdaeb487f0c89ba4ad0f551ec4e923b77ca165f6c0c93ffb7c840f306377f42958d8d04dabc8661fd7cdd2cd618e795aae22b2c9f756cd033533354f209723c7dd2a436b57ecccaa97b210c88d5cce7c01a424841bd7d363f5acef7c4a876af37fbc6e4a7534fe9e8a7fd3d67a2af9099328aeeab651282a0b95c7c3d1b34b39be1945b176d6fea87ebfa122a41825eb6527ab6ae3b54f92bb25fdfe46fd6d06f1d2db5b9e8b2f56dc70d0eca8d038ea0a4b98688e3cad2e1d79a2f505b194c59aecf475531aafc8db3f8855f91c17d890ad54452e9f8", 0xd9}, {&(0x7f0000001c40)="5b52dea37f162045f6eb5631a0f68ef26ee2fd9689a3891426bdf25061bd8fb257bcfb48cc3f8aefa70a11672162d95b08375a6cb85299ec01499b77fe91", 0x3e}, {&(0x7f0000001c80)="6f229bf6d22641370be131ab3f03e894adf0c9caffa98a93f7bafd924bc630ba61386dd65ea03bc080f8d9e285b670077949b83dace5fee5aa15b35edfc7722c19b617c653b0c71a993446f97e89c08dfe1f48a3789a6e110d0407fc7780e9b20244fc8caa3e7dd84d17f2909fca0641b4d1f61f11085711729998268c0f4acdce6a63aea2cd8e0c08d4dc681cf5276280a339ade588898c257dea19415db02f8a4e7189bf27797d640c5bfc0760a31aa944f27ffaca618c370643ce48cbe02c2a12bc2fe6db70e89536435832c01091f5192724ee979863f32a839b14287abe2239f5baefe105aaf2c25d6f83a24e918a92bb0f514449b0be34e98ad2abc6d62fbe26111ba76ad4278779069111e52f3eb05af686dc4df53a0f4cbc5e879ed40f66efaa6569006df796d1c3f0707e33124529d3c9dbb7317f1e9528b41e99e34152a834fa86d14764b69f6ea9b0bcc3186749533d1ec72686a6c746b147c9b394369f8a38062772ebc98b68faf35e15891b2b92368c6aa977c284c2c4f2fe5b33be43339ce4ac8dc7f16562cf08315655a3364a6ebd0fd74dc65213a776c31f26281ae8e5e04e6e3478ccd301e95bee972dfd0222f1b16829c91ede9cc0bd1f58c479a51bdb5fbca3a4752d5534c5f3576c941ae539552696d18a3c84e51ff07664eff8930bc44e1cdcdc7909db368888b03d835b949a8b32d58d30505b3c7ee2e6ab076800139105efdee51886a44b35c180a49b267cae27117f77c5cf6d380ee22f7017ccd3384b6baf434a51f580d2a5ef9233798fbe5f48f88e52a2c73b2e5b12695eb982c242e640f7011026d03eae0bfbcde7881ae3dcb5312bdfc12ce6b45d1b797f55d208b851074a9adb76a45e019e34c39a1f2de85cd62e2aaebf4ef6f18a33724deaa151a4097835fa78a5ecfcf0189bc956a37b50452942344a0d6d6a89fb36d7a90b94bfd19c6804c23f6fcb938253f15b733b754354ea9b5d3394b9a8419fc9ff801b5abea9a30272f14ee38aae72edd1563ccb023da001935dba1a37e874455dfb7339a632ab489f94af12d4801c97e9cb07f51ed6b90bc0d6fa39fcabd412ff978ed29491f375e6c3d465a5d2c98c4a9749be27b0f8b2cf5df1f0667f0b0e11e56b69b237d661635136061e08b02fc762cf07c46bc50f17b9c760df7439238180bdb87b31a13452cdea6a63ada76941f62b7012a3c8e6558f65c027a238bcb0a15ce24642110f00dd40abe4f8c7748fe25574af8ee86eeadd94086607343092b5feac4c46ad5ec00578c9bb65eaa3cd09377a592812183bcb4d20f777e9e32e0d43e9f9f6e6054db256c0a8a8c25d5e4fd3da7018661c98f9defa049aaac6dd25fea37037b2ff25785f26ef35ab4941c104de1eb0a8fe36313482806f5b00b5c2bc9e9a0b6ef65737930589f4f84b93244d86e11df5ca6fc7af97f8b5cf8acb6298daf60732a8a2edd4fd5cee5d3d3bc8b66d6e554f13cdaa3c7a8181318630ef0d77135c75ec0a3cf10cd69fd432a5e270a7ed9756c7d7c8412e9929ccfe4ca33f4810a0a24d97c7f74bbb730ec456570eed09d66e20163878f2d264c1396e30d510889847131b170f095b4e1fe7e4c120d3a716b04a1de20cb1c2b0ccffbffb9198be0083684190cc273bdf97f390daae8cffef0ee88c1b17e22874e8ace5b4492e7b6a4ee357ead649eedeff03c60ac27414d9b713eb020f713a27fd956516a0da240af4ddc1f7fa7c2ec735c9f3c582d5d19ae5724e1b6ae95a618396eb92660e5753ab20a4222e259a1c39b1a3301201c8dd40b803c5a11d01bfcca25627e31f224921b809de93421a4ba72bfd06d8db2fe0a38fdb36a77c3efcb75cbd572274161257c1041c8ec728f36f03dc6cba0fb4b45d0849c45628f54ae5322d181b16d999dff65b87db15afb6c1b6ca53985d1fcaab62249201f4f790850d5ce529a27efc4c54e3eb9e1ec49cf00cd0b8eefcc0814b17710d077688675c31cc4f2bd20b7e78149b53e82ab972e093628f025603840f9b2208f1ac9b750319734d9229bea12360b577867b8fcfdd29a210255cd14350a472bcaafeec269bafa522ec08b726e8b7f02badf46a019b8c77ba8b50680d79dfba55ff608463f8c77ff272cf1b7ff9a678c6e5254f450550a0220cc0366a6ce7ebf243259c83ff67bfe7190cf7afe28d6a59854ac5c41c2af1290254378966bab1e7d898dcc4118451fbaa4813e1e0c8083a5d96b1ea45f91ec1354025be118ef3399e0f3784f425c6980a551a22aab540dcc9e01dee9578567b9efd34cf634ebe0a1fd3ca7f408d19622e8f6451724e50f98f5de254cdc1d6135298f8cd101aff20651f9ff62221fbdd2f0258366d5553631add165d9a01143cf6196a614550dcdc82825486712d36a1d713f6a5d1a7631954ad20aa3a5970813a9b002cc13a982e6958df51084c597721adf419576cbb82c5064c0c0d7f71c5f6941e68700699fddc6fa536015b8809524a51ec75ba70877c3b401b5688a22d7e71be2a6786c28fa80d9937f1ea05e950882a844dc3d1c23b31049b87c571815b2ee5afc2ce907acbc071c35a82419204275f2c6627b1ac64075f128e054ad4d07be3f9542ee37324b8f83581308b84cf8d94d0deb5b0215e392b70359855d99ad3325adbae7ae1facb9fe990ec9f3a9ac14655886c2d514d391f71ab3e94f23e5d6f07e14e85f775ce599ab18a18f98868aa508f14378de78e130ffafe8db6ede3b6b63eb619a98c1027fb90c71a3053d0b24958a1d7b8f23238153c3c81cffef7dda208f63a640e4b3da6b7963e9924b9984d80a425374c2ef5d05dd9044774e22f4030c97ac2f94e6da93ddace9c980112967c0c5a822896e286c963ea8a5f56ce608797c3613317b04335cad635573d12e28a1dfd480b38dd776194fb2a4622cc7a28c07f7bc028589f4b2ce85d8a1354ce66b3fa3d6f35c10d50d23dcce26c34d90b207cb10de86a58da0df7bca3ecfbdc9fccf5c99873fdfd852152984505f700b8caa7f446fabc2ad7f57f6fe5928215e84608002bc08fbc138215a28fd24aac103a5406e92afe30f6fc3a3e3a523f50cfea88e38e27b99f93cf4b4d3aae27bcde824ed69c1e120734c097980b0706616c7f93e389a9febd73e743b82d87a0159816abf68cbdb279a2569fb05e624950f059efcac2f09f0a678eaa91311c87a9687fc48a56eb2517f159b7334acd189d95832c94a00fac07ab5216c5b6026358e659e8dd047c1c53b30004c29e56fca008ebb1180e53c1ea9da54c11d15769d31c234b66a1ea8ae6c3bb0c1dd73b3b24e7e44345820d34651fbcf1dff1a97bc5d500b0d7ad146cc269d8db90173359a9947ca8f9ec4d04c1e07c3b762e62176262615c9dd732abeee88a0ba3206f8a44c4898ce3254a9643f04976db9ecb4144e378c0d4c09d83e93e55141ac9efffb1d4c2e6b80d493c8d3640d00bba1e4b947eb35dac9b875c3acf1f541bdace7f06728fa3ac0fc88f489f8a99326b3d61e10fe7618eaf29938fa91321dd7a74dd2882c568f930ab2f5db73648dd0dce6a2a9e765065981c8b51957f8733f9dc6d16be9f0dac186afb1f167f0fa41700845754af2db9a4c80b3ccfc5826a96684cbcf9be11db0f3d92598f34cf02ba7cf80596434fbf634cf97981dc3e70ca6aa5e978415a979596bbe7c0c70381ff077b6ced61a63c93f0b6723fed598ae10440f7d12f83d96d8f9a362653633be6e594e04158dddb119c91398bb7b292b34145a1805fa967d6b5a90c83e4b551c5edeab20544054d0c7deae16fd9a700eef39aa8f8ddb62f0a82aad3bb7b22f787fec80ad15073f3a178a1169b2dfd74f8b5faeb60747df6209885e25c22b79920d2cf37d01a83eaa7ccf3663d1ffa7fc4ed524a2718e78c4e3ee5a711bfb6b1b0c520ee63d7cb51232fdc2559f27583304d1e3a152759df8d52bb1e20e1cdc1e121994b990c76aaca2b7230dfae171aab1d61f0d6e893b763a3857f23127eaff2377ee4d2a5b59e98c2b635af2ee52e6503cce95e860d12af035761082c6d708d52130d693dccb183baaead4177fb4d4e17a511ef1af6474c40f761c456b30f8d445c2751ba0c875689e34e362a160192e3859dcbf270ec2fd3872fded7c883ea1c1562c5cbc64b52609c6dc790018c8c0111d197488a875a41e3099e61b898aa6ab86fa8a8b56344764513ab970b392ae0a75c87794a5f41a6398293d6a32bd70f185d4cbd115529cb876d6d68c5d808aa1694c05dfea9353e0fe3b0b4fa994a053236c2e8eca82ad12724fc25d97fa0af76f4b04990d99b5fbc12652afd2fa17ce29ded72d3f466e98d8a3e75fca89060270bda3db98672597312ba79e082580dff71d7377642e1f6322f9345f0f824cf6001aa3a9ee549c71f6e6cf80cf2fccf2e6b60afeca62e3b54ece18f5f674cfa69d1ad77e9e51c7ed9c42c501b134ed36ef9c11dd39a0f577cc72747c14a78d90055e563951cc5e8e27383062dd07d8be81ce01bb1d438294c080b1d4893ee8f068da320635ce10d485c35cb110094086dff323d841e7711b323f7f8ec999dea628a9f2b8122f3dfac6b670ed2f21ebfc1e9b564555bfcd3dfc5394569576c1db198bdf624e80ad3d80a5222b98bc5f35d1bd8c6aa0a261f207fbc57b5e98ce5ad2a147918f62bd5a5e39f1e1c607d68ba4845233d31513d75573f629ff5e49c6743116b69f48cebcce9adf50e1d7a5f98f8265e27605265c0b031b5f8a470ab572689bfc4c481c69d43ee49f6a1be44bdc3d9758cc11425ec7960e17b3d401b094392b98e79f8e95a75cdae514188e54602de2321b4108eafb972446bc730b0c345e254d4363e95d7a0daa5f7b381f7bed3fa9a012ddf7b1d92a2683493d4497447a3ed2d61d88f8a5534788dd6e5029d70ca70d2e6168fba89d4301860183a195d192885d15e6f737879aa0879def911b344acb3d7abd72de3967e0f65d5a45c8cdb2551852e8302be9d02c95373817f766383417648a640a09b53af468cd6c4f464624e054b0a28bee175f05f53455556d3c9dd5c6c70e9507aaa57474025c541c290837fd78abf092ee38e7705fcf9b40023c092bf14593a5172cd17c891f3595524075c9e614970652c4e43aaa2e11a0f7668ee96a9ea9969c8c8975034396e0d694e2821d13752a45e101db923b9f7b666aef563857498eaca57e1a2b0f1214097a9940d84a16a3252c6c4d430219b7c5897b52d70c46ae5ca9e1b83e1f9680e99804af5feea8a8aaf5b316302b5d5f68f945b9c2c7c6be494dfdad04ed34be7b356ee65ef54e7daef4366338734da7aedc39428da379abf3af48152df4ff616dac978c08e4ab1e9c34f8df0bec03da88cfa8aae7b8c0ddce595b7e37a0f2396c6e023849103756bac54444ef9d6f732e980c616ff2d1fb6cd0e8d49b5cff48255ebd13c19dc505f4d9c7507010e7ba617ec7f52b750f94e973bfb94b694b6aa240cca65981eab5c0bfd930a26adcc1f002f2e7bbfe106c81a15db2958ccf694276c93c33b8c8ab7862946ff0b7c7f924a9aa065972877b44454f4b92066cb621f5a3ae02f6f218df9e7d2413aa9187f67f7fcface35d31f2bf737702c56ab5b401d187ccab4b3b3dc6b5d6041a4d2de9b5a9470e1784a6b06ec9c4d6d46478e85088c45f6a2491a36d568c01751b26e0968667d14a9c62b46b67416f7cc162f4e240229007a1140b6ee757810b24a911807a8f4de20ed191e5623d76506632ad6eed21a38d0c08669bb7ab981ebda9369ad", 0x1000}, {&(0x7f0000002c80)="1bd7a6840d6d7e6756ef1fb7badf358977a7c9bf46ed875a6914a0352d97a86afd72cf6fb27219638eeaa0f89c1b035576edfb18ebaf7d132cf83aec9b55", 0x3e}, {&(0x7f0000002cc0)="baff0c518a69cf1b112e6e057b38a47dc27bb87969207eae9fbf7184d903ac8c07340fce6a6cc54d3e0f15ca722b25a0575b43bb59f1b2d566", 0x39}, {&(0x7f0000002d00)="1a4e3a69c1945b10b0633493ff3d86c4965e433f9aff6e6fa1d951476621c32fb4c267631e7b7c73bc9199afb13b2cc37c65a8331ca97b23a6bf0664fcad3d7a6b12b98e8c1471177718b2389149189d75eb1e7edb19f20b8ba43893486fc6045173ee6a60dbdfd271577279c0e31163fca7de68ab9d7550b9268c3afdf3be328bff96a4b55465448cc98dccd28ee95712e60726f6c7e9ea40f4b242d1dce34ce3b96d2437e2be4099ccd75180ee6aaded26", 0xb2}, {&(0x7f0000002dc0)="351efca331daa037779b824b968f6352d291cfcf298c36c3bf1a0f1fe6751ba4665450a08340c64dfaaf341b7b66c3348f8a46c21ef07230f5aa42c0f2dffdeb55d184d56c7b40f456fc941d2a7b1eeeee963e4f0f86697f8bfbed18b36de5c6cc91ee1bd61001b3ff6db440553f4907b4154998faa647db8d8d56f2f04ef11ba4a5c373c80e1941fcd6cd29138e20e861fd70ddc725d2c71c08775b9b81db1c85fc4359b1c2cab7f94114984420f19e0711297bb7fbe3ee898ddf801b27a11e3c473c32b2fb44575c3ea6d3de1f29d3b289119d276cd3c982fb4b7782a1e0beeb2ace04a31a", 0xe6}, {&(0x7f0000002ec0)="f650d4278fce513c7e5e0138c0c8711f00e576e3347e64eed034b8a97e21e298f512a1cb46e035058c41d308373ecb0d656e9c84674fe9bc8e0c89511466ca2c6c10c25e014dc12873c1cf08da2fe605b48e6aa5f30d8df3d677cd1d870413662242ea2bef52cc5a07449e39fb65e1ecf3179772a0681a06da45bb633c7ea36c26505fbeec27e5d31e1c58eaf222302105e8ede4d301c5c02e7e6a16a846074c11665a9f7c56252a730f3038154d2956c648f84eb3e57b2b1c56628f9c8bc1eace23c69505426f7796aca78d45c1083ebdd772db84bbf10c76b303cd", 0xdc}, {&(0x7f0000002fc0)="b1b841a1e8", 0x5}], 0xa, &(0x7f0000003440)=[@rights={{0x24, 0x1, 0x1, [r0, r70, r71, r72, r74]}}, @cred={{0x1c, 0x1, 0x2, {r75, r76, r79}}}, @rights={{0x20, 0x1, 0x1, [r80, r0, r81, r0]}}, @cred={{0x1c, 0x1, 0x2, {r82, r83, r84}}}, @cred={{0x1c, 0x1, 0x2, {r85, r87, r94}}}], 0xa8, 0x34004041}, {&(0x7f0000003500)=@abs={0x2, 0x0, 0x4e20}, 0x6e, &(0x7f0000003840)=[{&(0x7f0000003580)}, {&(0x7f00000035c0)="82a51894c70b", 0x6}, {&(0x7f0000003600)="f6290085a1d67c63520967a336d82c9c9f00e4d6abd5ed7b531428e8c15e114ac80d896c092d8d08e0a6f12ac2fc0aec26cb8b6dc9634eb1a8c4f407c63c3d5e6370103f0d82076587908467c0c6541b55237581abddaf682dad254196f642b34b61d4ab970b408247f7783671eb283c0df1cd508e4019bc155d0339b7504d3323fbed42689639e25e98c1dda66c1bf38821e5f816f9347db5337ef9abd68eef7dff", 0xa2}, {&(0x7f00000036c0)="0a654ff61e760402057833483f9f1b62730bc37bd0a90237a4a298bcaa01914c3c19d70945bd9ac2df1dd7d01b9fb8af0928277451a4072a80cec8574765498c12b61780cc67d8", 0x47}, {&(0x7f0000003740)="3d1ec40e0c94122d8d5a66a21813502f30b0be0de7819b8aedea1a81de15d603d01a0042eb04ca84daaefc0b9e74f49ca0b31c2a1087af8f6e0159d0b92ce4a40cfdc71faefd72f6f973dd9873faa8ad8e52c32bcf6f120d724c47600fbaf60787377a4a676bc34274f1dcb8f3fedcab92446724eeb55fef9fbf0865f4e5fcdbbe57a49bb84671de99ba3ddac9924cbe1c7c4a64f0970ad111b6af730c5f2080cd2048fe79804ed3e284d28f2049555fe48640b400a5f97b4f09aa39ca49809d1db3661d00d92aa71305f6e2c26a2cdf25a4a3de113e99edbf742206e7c3db412fa78f8c1bb07823c0134c031967b8b27681", 0xf2}], 0x5, &(0x7f0000003c00)=[@cred={{0x1c, 0x1, 0x2, {r95, r96, r97}}}, @cred={{0x1c, 0x1, 0x2, {r98, r100, r103}}}, @rights={{0x18, 0x1, 0x1, [r0, r0]}}, @rights={{0x20, 0x1, 0x1, [r104, r0, r105, r106]}}, @cred={{0x1c, 0x1, 0x2, {r107, r109, r112}}}, @rights={{0x18, 0x1, 0x1, [r113, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r114, r116, 0xee01}}}, @rights={{0x24, 0x1, 0x1, [r117, r118, r0, r119, r122]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x110, 0x18000}, {&(0x7f0000003d40)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000003ec0)=[{&(0x7f0000003dc0)="b298c3882ad546fd7d870d1c9f2b3adbe9e0ade0e9c8d8659153a2faa1cf035563c57b1503575d4eea92af4da4b435873141a13ce2999b6a6a37cdb6e2ad0327fffa5f7b593cb363aeb6609b5d4a6aacf6fad3928595f032ab59e562827ac5e6f448115b4e855fdadb27e3640cdd58155d10408969dbc185c5ea57b7b013a4a71fb52e847ef6e0fb3b422a7bde44f5f45eaff6e7c4df2bcb3487e30d3e0fb638a2d4e9f18207f629d35ab6c1c9700a8a722a2fcfb63ec425c577aca62b706a7e29cbb5627b9042fbeeb7950ec46b2f7c1901f186206d0faef8bdaf85775d9292b7c2d059ddb8465f", 0xe8}], 0x1, &(0x7f00000043c0)=[@cred={{0x1c, 0x1, 0x2, {r123, r125, r126}}}, @cred={{0x1c, 0x1, 0x2, {r127, 0xee00, r128}}}, @cred={{0x1c, 0x1, 0x2, {r129, r131, r134}}}, @cred={{0x1c, 0x1, 0x2, {r136, r138, r139}}}, @rights={{0x20, 0x1, 0x1, [r141, r142, r143, r144]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee00, r145}}}], 0xc0, 0x24044000}, {&(0x7f0000004480)=@abs={0x2, 0x0, 0x4e20}, 0x6e, &(0x7f00000055c0)=[{&(0x7f0000004500)="c1abd9572bd3e0df340e49a9723d885da31a57a26be4a0fb11f8e4cbb571f54cb777761475e66b3c4f29e663bce1a024edd45b70f6e6054223d7b12ccecae1de3abd1939b72be4f1597f7dd81e37c5af590a5f5c37e31557a4bea6af0fac916e64fa488841aae6ed462deb80188785f8686bec61fd0700f84f71e58fc576a0230876d774416691602050d9833d21c6add666570e618e5d", 0x97}, {&(0x7f00000045c0)="3ca2615e02e81023cfd7e5c0e8e94cd5aefaf7e491baf39fe581ad33aff7b1555b46f63b55f4711c62622fbf3b004e35d64b139ebbdd1f3052fdcac687a354f8d20f79b50ddaa8d1c9330f53170776b9a189976d91040dee23f660c4d783514242a5fbb8f7135297f5e976b7d6cd33c0776de36a6fec629cfaf7789cf639f01dc139f27a29903f7d81d93d7377d9620499a15db15e466e65674c3ea0ff0070c947d42347d1f9981cbb699d6eb6bb40df4522bf6d177c57f1c6aaf2f4ca2df2055c2cb2fd03f77fae13e3ce4b6bac1c397534800092376b46e9109f30198840e1815406962c845b0678466ba74b8d6019f4818b569898e54ccc39ae6b8bf3c7e6835687757f1057de3e7c6acbbe131b7ed9076ce7fed6e101cb1ca3674945ff964ad27cacde1f895e0fc7b94edba5ae8a0d2f761aa51105cc6a500c289ba8e036663790488011f4b7b1b22f2bbc6df41d94f0ce5816ddcb25719ead68ada358fc3cd891bd590a8239597f6a37674d15a72e3438621f7d16504db1f69c9402a15829eaf62d3e3290af5a8a79df9dfb9712c78025fa97fcf07b32987a0921491d0c9ba48852e275b86c1604d52486bdd9c5c44ac2df4a6315431dedf28ff0b2dae1f96a3ff704d9273149f17ed2d3ff3b3cafce6a3a5aa611d6517fc86e467ca400042aa6764d4aafe25a5ef60b6c69b226443e35a7ba1959b6766e2d70e96f641245c34c6d35d356fe858464935de57344bea28e4d24d91bb63a75607f2262d2c22de9b4fd5663d029890dc789548f72eb17635a01a5478a76bf0cceb9462a16931ad2a6173eae87dc41abb69d89bbf9bab9a45856f656774cc612418c4627f531bff54fd04027009bfd565f9651f97806f633bc22784ca968bb07b3192e18a371ed25708d57919a78b37d71329ce23777a43d89b10b5e62e3ad24510083f1f46a22413632d540cdb9af41ec92119703bf9632121957ef64db6376c9aca7d7001b6ac002baf29dfb0b2c93a5c95d2473514edcd5aee367762228c18e740cc31dfd75a14893cb9a2492af8ef23f48a9803da162dc05bcbbaf162f98fff50bdd33f9fb688507a05235152014dce32c294ea934043164e98cc41ca978782fc04feacf7171a09144a4882e9908c0cb2b3e9b48f6aee94734c2a9b93a283de1119470f43f1df98686004d02bc2bb31a46a6440b15a5293eb023fa5315f017429151a17d114119d8674d34b5c930ddffa061a5cf392bdd4da62229ccb7a0bea8dc5190c3d973e09b4202abb92f74558fbfdca3b0a1643f159e5c5e04c8bfa60cda7d199daf348509c200161496dd4f0e6d770f885af1994c10a0653f585da99a3569943f9727f06b23da29bd5bcdad30f9bd7e2f4fa323223808ed49bc233039ccfe7c9c3c450a13e17417d0ada1a12b70a3d6e57d9a9ce08fbb16562b2a97148965b61ce229b5bf7a7428c61b04bd85b3e4a2f743be47d06bb696530213a4cd96060a481474fb363d11be0d0e274a4b2ffc8b9a9edbacfb38567bd9ad61770747cf3ea0739c243691e3a403183133aa4ac4bbb53375c5b3a0e0b7c471e99b9d89abb989ce61135e11062280d77a837527049660209f8f3eb182046e2b29af00627323d3b8ed2934b0774bb2d97f2a12384e3da726337586e2cc786bc6fe2d9bbad670bd83477c7dc32639a0b07f5c30c7d438d341078a7c603a4cdc27d76a953563a9cf7daac2da74103b6295b8f4fb93ae708a73544a68b8cd43e4c50ee7dc489d2f6c54bf317ab3d281a1c72e55cd1b047621d9c5f715724457c4f5ffa2241d640df926b3cd72205d75c59818bda8ac8c244c4ff4430daede508b3ce4b1655db3ff0db845783a6d66c1c3e6a7dc01f109575925e923df9db334e7ce9c9c570f4cfa013ce76f77955ce92b68a0a1bfb0c80de0034fa1e0f241fad39c17263f887ebdb61db87d6506d6f5d8d94ecdc8c6d855ed8effc5fcebd623cbf94faa44c512d408d1c031d4e239b09d77ebf5db3efdbb1a81a2355ef65a3186db16603ca7a9437cc51fbafc8730cf34967a197442fee18563ac862ca0be794f90c7c2ed8269524a145bdff2ca94f0160d05d60bf7db32e2fb5bf869fc9eddf3035361d04d247149fe54ef8c6a638672591a9da7b8eb4dd0d193d5cfd712d74a606e3a304a35a125555fcfb9158858eda2450d109b2ded68eabf00dd12869cce2342b2f21240ccbc743f6066e7d79cab59ea14ab22dbe34fb1db68b0435baf7ee617e1a9006ea6939e2ffd0454b584e18970c80dfae631779cd8c8fe33acb2155500b52a2567e5ef0ab90e1c551a0715d8599dda232b7600746589e81c9c29f7eb7d1b63ced12169618a35030ea9e431f3449bd94150ac72e37ebb6a2a5e135effeff23dab7d9e2eb7a5d8c6429b5d49b70fc1ab00625f76f28ad35adc3ff5411d3217a320fb88b0e7760a9733c33f51c9143deaf218ca72eaa4999074ce031b3fbc05387e1baeead0248fa9e04850b6722d669a1f8acb987d74dbd259e2ce4c7187b6577d28a9d0184d1198f610b287c9bd9e02058308e32de0dc2ff462647fc40cdb427345fc6b12ac9a75ee4ee93287173d46a182cb4010bfa818342abc62b940c65d485248370fe2561c83c4fc76ac3be4fdad778f805995456f48ab7979e02b94e67108df572b694be95ca9714a2d12a961b649b334e44dc6bdfba5a544f989befa8e23382e46eca0f64fdd5f109fc87f0d6d262a4653846ad3b64290b3ce8f9bab253b52e85a52f551c613897bffa0aea305b85ea27e5986cb073c6ff961de4e4929bd197c2f70f0d930d117ce8febfadd7b75e817afad73f56e578e38a0745802fcc6209b331b787bca256c7b07349844363a36308c0582860311cf2ccdd3690e43620791b737706202291765c68bfcf8565fae0d7c9e7ab2576f5f434f8caa206b57cd1d3e0dd2a6c4e47971849b17d31ea527f8c60b159713cb42ec86e8e78a6a12cbca94ff4c137cbb9d157c57e87f49952219cbe4b22e2e5a0f5de4e76b2f324f9de4df294f5bf8a0991bbeed3b30135f70c9172c475e6ff978958ce005bba18205287444b4ad949850fe2e0e34e1d67172e90aae9de352fe5c452780717f7c13bac9755188be883a231923969c959157b3eec1225129fd7929df7cb4cad30beba8685b8d75dce50f524753ffb971749fbe8de1b8580c7559c9034cab4ec8af9cdf4aa2e5b0829f5288827c3c4d9953a9390419ef86a2dadd846b6afa7243c2d568edd665cbc421605b863b8e7e6971a2d9fa1b8a924ca1f86a3597dd2e1cf4de0f96848736ae7596c029578c769d3935cab8c1d89d4674c800b82e89d496eecc90f81c56b4f5df6482b519ed82061536aa483e70d1a5f64b070f9d33af65a8f2663a67dc7da83ee1e2d91a83e970b33a33cac5bc5843be5c205e289a30af7510ca8376b1a136ac582cffacca26a63d6dc316e71d5ce8d851fa0a3ff56b7c331ea882cc61ca20a84f7509810c7d1ff70b93135ebbc1d16a02b30445b77c0e9d70aedf580d0baed26fc456f22516811dbe208db5214a71828b534cd111f94794adcd047a81afa8ead56968cccbb9bbeed9e333ce0cb866c42f05561217e773d5a59293570f414cb66359830c199e78fc2077e7465c30d301915abd658ad8a7278a1f096a0b63c31eb9c7fa2091bba991ddf5bf43f77ca40504cf619daf8e736359d1fdd33a54686be04407edc6ce0bd025fc1dfd9fdcb807ae914f8883fbc6691cc76280aed2d4ce0eb0ce9a992b05c45600e2d9e28fd5179e243265c4a455c8815871d797621d2837cea4f93f6d4e559c08918e8b48b501ef45b2e7945591b9093758153331d9a3766777612774b412563873677e8ff97bb7ac5af0ec3cb06e94f0733cae16b971041e72f280e7906e0e3ac60ba06b7ba84a055137f7e0b80423e795d16acfdf0ad28a825a05f3d0b90797d8b2186502a7461a91e93e4b35cfa8a2588457cb40a1e84928edafad78ca889454b5a8393fc6df42d538d7eda963a488d275bc3916e253d8adbc1efc4d47e51801c1c317d91de7bd13a56e596a46702798a4f3791bf78e864b9deb49e11c9c5eebed59dd2e45ef4cae015f0a90e03913d283c964fe196235cdde07ec6d694316e3ed13fb74cc394347acc8b520e3d4ed846a0f90046cd8c77bbedb61dd8b92391a4a75ded6e528f0fd2eced65c1be59425e74281281a83a45ea06a9b6bc8645275c8e7d82724ab8504aa108d1ca77891a050e526ceda5d90c6deda5defeaa15eb52f95f2d4169162460c22305ca03891b078add618d4d44ab11c5e9e1e25c739ceb32e52a73004ddc977c68227ef618a63397d380e511c4f9c9e675d424062bc01144628364355ec8ee06abd4be97967ed61c1570baf8a3634fb4e580a6883313ef4bf2ebba236a0aabfb66690fa15e99283716b02ae875089df5f2a484429a4f6a55c5a3e4bfde59863845f1e87af30b5fb2ea693919e7359c89fd706b15820592fb49d6690731f9b57b6af14f8884c81ef50d6192e933363d9687247fdd993307ce7b496083b39652a4d4ec5375d900d549edd4ab72930ddc4fdd9a681170392c5c4fa89d7abd32de19c30058790c6d3249abba736d5791f9ed6155273a85b6a82dfba3e6cfe8ff68b822f25704313364d91b21a0be5365c867a7185f9a9c91f3cc163d8071987314671ef58285c1f4f01e407f61d977b3ff1ec7b957d28d5f1e1c876b4c5fd774089da17cbd731d5f8b02aff9a3a61c7df0fc7fb2c592340738dcc3cff56b4db6e2cdb065d2e4f1903a8c39f388e2cb8fbb0b2861f9891ed9caae8731248c91839c72b94f9f1e782284e709dfb269525d34710fd2aa71b03e65e346d6c73d474ab30b5493bab3a2a951668ca7fba6820dcba5303f6f9108a0e44062af301eba7d9d233d2b9b825713724f503ab258f87d751742f6b6295487d6631cc233a04d8323dce8db9df94ea865b29c314ec0d78b135ce099a489e73b3e6200f88e1791c26e854f6f926602cc57a13e4261634794ed1ed60bbb8a95d5dac2c689843fbe2652a5cd68c6b8eceb162bde97d5bac78279ce2dcb8bc7ad2e736da0c2ba1a39c26507e08230e0fc826d70797501156c4551ae6c9026d36e7058ea2fe152c9ca8d40240249c64ead4b82163e410d4a066f7cccbfa2b24671dcc31fb6bd03c6bf630c132da768123f4261ae3f6c42f9865b6a0246ed45cade9966e77a7e0501324063d055ce6a40f0865a7b5401df7aa086ffa89c0b1bfdd781f5545246db65a13e09220e4fe0ce3a30d7faf09d97a51748638fd7b17e35c1b16937f344ea90a28ea5bb092b71a924b44ab0dc55dc1ad5da0d215d53e1100ee1a3af89053870ba8cf68e4e3012395206204bc3a3e1c15ddf68e5b9bf3d3ba91a8ac2eaaed62509aa49c20b2971848b6b2fb8a7620c274d9a763030357a46e2194755d47c1282fda5ac3cde76448834df782f28242011bc33afc66d17ccb69794a069245044ea14c4fd84a0c3a45806d349740bd0afb63f92e4e73c51e452e0a1079843cec2a5bd2ac69bc23228843b61fb038f28967b8aae81c3dc8589e5614d5ef9097bcc2a6d9ee91b7f0450532a699c16e11e14118f333cd3831b509e4829632e4b596d1d318354b00e6ee00d8e021e2f47db2996e55c393193f7d8ff9804ef6f2c151a2938b3cb2cdf76cfe65856a87317a5be3cede6ffb59db39d21e78a978197a393135598d561b5181783c96058304784abca8e862236cdbdd12ada364692fb03b29c3efaf296114531944f1b6", 0x1000}], 0x2, &(0x7f00000056c0)=[@cred={{0x1c, 0x1, 0x2, {r146, r147}}}, @cred={{0x1c, 0x1, 0x2, {0x0, r149, r152}}}, @rights={{0x18, 0x1, 0x1, [r153, r154]}}], 0x58, 0x4000000}, {&(0x7f0000005740)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000005b80)=[{&(0x7f00000057c0)="9042ffc6a3589262753efd84f44ca70a41fb2dfcdd35040a9df71713809859ec5721c9656cad79eb84eb1f8fae0e4546e2b894562b3dc441d340c1f8148b87d22f9e960fddd60392d22309d51d", 0x4d}, {&(0x7f0000005840)="dccd78743a3b6183f59812d23d647d622756c61c893d05ef1849131c8fcb3d19cf7bc35644c25bec4c25adcfeed17c448f44b42e54a26de7eefeaaed483a37fd1c26fd704ca329c11f0681a4d9b5cdb52def39d62982aef6bc89362adcf3568697843e7745f7d50cb171df4a3154bdfab7d865732ec5c53fafc50a3262959a0e8ca1322751942811983d98d870182190952c579b700a1d5659a7fe99eb8e0ee0edc4749f6ab36cc8727a384f355581ab82fc16ac58bafa9965b7e12230f14983d2abe1bd730ff3fe3e08578e91736289a43616ab20385ae6f7750278491d4f3e730da3f0748445c4fa496c489a8233eaeaff62d7341c7c57347056", 0xfb}, {&(0x7f0000005940)="de2e5d770430db522da5b75a8d6f610da4ec87e373bb42e98faf4e081caa1be3eace8741c9f1b35add79dddbb90da2af145445b8bbfe0c010ffa4c9fdbb26f4d784bbfc5834ac6308cab42492df77386f5fdc32ff331c5c7029241f2ce7c8ac9bd00e132f35c6f8e52faa1938b2956f89a9f0cfa365a96bed504167f4ef87601b491186d68ea634eac68d5f22a04d6f73d30b231bf96e10936b82f2bad61e49200112a510fefdff18d5a3db16c862d56b626f53e6bf3232d0a88cdabafcf3cd568bf2416a7976f55950b0b40", 0xcc}, {&(0x7f0000005a40)="771c9d6407de977697c88e6469a142197d8c9fb9d127bcb25781b14966f59190cfcc107d62e6f5e5bf7cab0e1a00099061abc881c6abe184c7feafa90e02c522e2196f705c3ea8896db5a3e3b5df82bb0818e5e7b4e050f046f32ca7661b9c4274cf42ef50a6359e2d456165fc6a681be8f5f70cda0fe73cd142e23b0e98f03ef620a7ea56d46020cac25ece4b1e4acc9f81d2ca3ca42d6d264bf72a54c50be1082be556a84e", 0xa6}, {&(0x7f0000005b00)="7e6a44b4af1af494126a1ad0517a1df1aa222ac44e3cc9f34644d6cd9bbd8cd1359a677fe0733e0ef45a57b0a10c3a0bcb56beb0cf8617b2472e01642739718de84ae373dc487a84dc4eab34b6b0ebf839bbf9acf5e024facf1f978989d55d359545d0157269bb4086a93f962f302c9fa861cbfd42", 0x75}], 0x5, &(0x7f0000005d80)=[@cred={{0x1c, 0x1, 0x2, {r155, r156, r159}}}, @rights={{0x38, 0x1, 0x1, [r160, 0xffffffffffffffff, r161, r162, r0, r0, r163, r164, r165, r166]}}, @rights={{0x18, 0x1, 0x1, [r0, r0]}}], 0x70, 0x800}], 0x8, 0x800) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r167 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r167) r168 = syz_genetlink_get_family_id$fou(&(0x7f00000001c0)='fou\x00') sendmsg$FOU_CMD_ADD(r167, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x48, r168, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@FOU_ATTR_PEER_PORT={0x8, 0xa, 0x4e22}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @multicast2}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40004) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r169 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$RNDADDENTROPY(r169, 0x40085203, &(0x7f0000000300)={0x20, 0xb5, "15a8a65958028f75b7c36e26bbf1920e06aca351ac536fe3fd3433f51597059cb6380b5d4d0e450576b81518dd874bcc76c7f03785fd29de2857f3338323289105be4e54f15ee9e6bea26f66f3878be5f4a4b3c8e7066ee484b592daca076ea59f2ee53e3005ece96d9053d534d2494e60db0e522914dc8ca0829c42343bc1faabc5457f63c4623291c304fb8a18bca80ebbaf25c9e9a604811de13151154520f1f85a29eb4e98e90d454dbcc4a8645538f6b86943"}) ioctl$BINDER_WRITE_READ(r169, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a7470000000000000000000004eff494471af18c50000000000000000000000000000000000000000000000000000852a747f030000000000000000000000000000000000000000ebd1f82f0000000000000000000000852a68770000000000000000000000000000000000008000c6edf3"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:43 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fgetxattr(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="6f73782e73797366656d6b657972696e676d643573756d00ddac1b9523e19b44a7a5b15ff5410e1242047ce128239c4294f334121e62ca1e4a0d7b741550ca58093d090f01e01a68251c44fa12243145d57d3cb32b48cdc003f85f97896602bc00411bc3ba981e815fe63899db52c24797aa72b6feda3b13bf65bac393d9bb4c9ae9cb9d29a10b70951daca40bcc18732bf07541a58a70c07b878082aff2bf"], &(0x7f0000000080)=""/26, 0x1a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) unlinkat(r1, &(0x7f00000000c0)='./file0\x00', 0x300) select(0x40, &(0x7f0000000000)={0x2, 0x4, 0x9, 0x5, 0x0, 0x8000, 0xc0000000, 0x4}, &(0x7f0000000200)={0x1f, 0x800, 0x3, 0x6, 0x2, 0x100000000, 0x100, 0x3f}, &(0x7f0000000240)={0x80000000, 0x1, 0x7, 0x9, 0xfffffffffffff5e3, 0x56, 0x2}, &(0x7f0000000280)={0x0, 0x2710}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000002c0)=[@sack_perm, @window={0x3, 0x9, 0x401}, @mss={0x2, 0x2}, @mss={0x2, 0x7f}, @mss={0x2, 0x7}, @mss={0x2, 0x5}, @timestamp], 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 03:44:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x3acbb23b38990890) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r3, 0x54a3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0963104000000000000000000000000000000000126348400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005e00000000000000f23f4ce73ab83304222a9f92e0c9689b187b12457220154e"], 0x0, 0x0, 0x0}) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000140)=0x2, 0x4) sched_yield() 03:44:43 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) r3 = syz_open_procfs(r2, &(0x7f0000000180)='status\x00') ioctl$BLKFLSBUF(r3, 0x1261, &(0x7f00000001c0)=0x5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_QUERY_BPF(r4, 0xc008240a, &(0x7f0000000000)={0x5, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x11, 0x800000003, 0x0) bind(r9, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r9, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) r11 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r12) setsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4e21, 0xcf, 0x4e22, 0x3ff, 0xa, 0xc0, 0xa0, 0x1, r10, r12}, {0x8, 0x3460, 0xffffffffffffffff, 0x10001, 0x82f, 0x5, 0x52, 0x3f}, {0x800, 0x7, 0x800, 0x42a2}, 0x8, 0x6e6bbf, 0x0, 0x1, 0x2, 0x2}, {{@in=@multicast2, 0x4d5, 0x33}, 0xc, @in6=@mcast1, 0x0, 0x0, 0x2, 0x0, 0x9, 0xc667, 0xc000}}, 0xe8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:43 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000040)=""/39) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 03:44:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 03:44:43 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fchdir(r4) ioctl$sock_inet6_udp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000000)) r5 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2293.289830] binder: 30979:30981 BC_ACQUIRE_DONE node 13535 has no pending acquire request [ 2293.298932] binder: 30978:30982 got transaction with out-of-order buffer fixup [ 2293.317187] binder: 30978:30982 transaction failed 29201/-22, size 104-24 line 3525 03:44:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f00000000c0)={0x1b79, 0x6, 0x8000}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 03:44:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 2293.326552] binder: 30979:30981 got reply transaction with no transaction stack [ 2293.326562] binder: 30979:30981 transaction failed 29201/-71, size 0-0 line 3046 [ 2293.327427] binder: undelivered TRANSACTION_ERROR: 29201 [ 2293.436990] binder: undelivered TRANSACTION_ERROR: 29201 [ 2293.462355] binder: 30978:31000 got transaction with out-of-order buffer fixup [ 2293.484363] binder: 30978:31000 transaction failed 29201/-22, size 104-24 line 3525 [ 2293.494041] binder: undelivered TRANSACTION_ERROR: 29201 03:44:43 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x503040, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)=0x2) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r4 = fcntl$getown(r3, 0x9) write$FUSE_LK(r2, &(0x7f0000000180)={0x28, 0x0, 0x1, {{0x7fffffff, 0x8c, 0x2, r4}}}, 0x28) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000140)=0x3867) socket$inet(0x2, 0x0, 0x0) 03:44:43 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$FS_IOC_RESVSP(r4, 0x40305828, &(0x7f0000000080)={0x0, 0x2, 0x6, 0x2}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) 03:44:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000000)=0x7fff, 0x4) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:43 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00ec01"], 0x0, 0x0, 0x0}) 03:44:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) [ 2293.617249] binder: 31011:31014 BC_ACQUIRE_DONE node 13546 has no pending acquire request [ 2293.648271] binder: 31011:31014 got reply transaction with no transaction stack 03:44:43 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3b) r2 = socket$inet6(0xa, 0x2, 0x40) sendto$inet6(r2, &(0x7f00000000c0)="ec06b95539448e3a0efea3f8dcf7b5addd273698e2a2f1f9c81c6c5fc13cded4d788befed52a0d9dfe23e01b470edbb103437709b31d87da219b82b61537f6e2bb3bb1b01fdcf1b965af2c672ed47b748c5cc5609bc8eef0f4fb979c7a7dc35ddb1e3ca4d589381c6a71df58c550f6c3b2ff0828991c9e57f5fbed183a6763227727cbe853b4016583793b8abb31aec976f886e2d7ff30a81721e286e82cf9dce033d98f49c5f69c189e2927c416c0b6fcfd1fafc4932e878f5c3c598c709caac49316a1cce50f7146be5ccb67ad31ddcbdc860cc77563eaeaa47a60e07186e0f1530c51f7e417814eb363e998b06712", 0xf0, 0x20000804, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) r3 = syz_open_procfs(r1, &(0x7f0000000080)='\x01\x00+\xdau\au\v\x9f\x80\xc0') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) getxattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="6f73d355814e95d02c33da75077525"], &(0x7f0000000280)=""/8, 0x8) sendfile(r0, r3, &(0x7f0000000040)=0x40100060, 0x4000400000000000) prctl$PR_SET_SECUREBITS(0x1c, 0x30) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x7, @ipv4={[], [], @loopback}, 0x97}, 0x1c) r6 = accept$inet(r5, &(0x7f0000000340)={0x2, 0x0, @dev}, &(0x7f0000000380)=0x10) sendmsg$sock(r3, &(0x7f0000000600)={&(0x7f00000003c0)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x1, 0x4, 0x2, {0xa, 0x4e22, 0x6, @local, 0x18}}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000440)="b6a4dbcbf171dd116bc94e891c67547ece65495cc3ad8467bdc82d6281ea068f6ed62a72ff9fc8e417739e0f6c79a28fac1f273494329f5b75235eed0a91769be6ba827fbb172a95e66d5e6e793da7d2a46e2a8dfeb14706046a9468802bf7f0ea6399edefa2f9bddfb67eb5c12884ba4e99ace96429906e0da560de344a1bffe0770af00325b470374702b0b37fa24dc09a84e5e4ce4b9a41afb82f2984046f4e2c27e1886b6f6a04c245207afd640d26529f4102fd9fb29ae2fa431fc6474d13554fdf42ec2214c6", 0xc9}], 0x1, &(0x7f0000000580)=[@txtime={{0x18, 0x1, 0x3d, 0xff}}, @timestamping={{0x14, 0x1, 0x25, 0x5}}, @mark={{0x14, 0x1, 0x24, 0x7}}, @mark={{0x14}}], 0x60}, 0x4000000) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f00000002c0)={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x12}}, {0x6, @local}, 0x0, {0x2, 0x4e24, @empty}, 'rose0\x00'}) 03:44:43 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x402) syz_open_dev$binderN(&(0x7f0000000180)='/Re:\x00\x00\x02\x00', 0x0, 0x800) init_module(&(0x7f0000000000)='/dev/binder#\x00', 0xd, &(0x7f0000000040)='\x00') mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x4000, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r5 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$PPPIOCATTACH(r5, 0x4004743d, &(0x7f0000000280)=0x3) [ 2293.656889] binder_alloc: 31012: binder_alloc_buf size 126080 failed, no address space 03:44:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) 03:44:43 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2293.656896] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2293.656913] binder: 31012:31016 transaction failed 29201/-28, size 104-24 line 3284 [ 2293.657043] binder: undelivered TRANSACTION_ERROR: 29201 [ 2293.666342] binder_alloc: 31012: binder_alloc_buf size 126080 failed, no address space 03:44:43 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000180)=0x7fffffff, 0x4) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r4, 0x0, 0x484, &(0x7f0000000300)=""/4096, &(0x7f0000000040)=0x1000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_GETFSMAP(r5, 0xc0c0583b, &(0x7f0000001300)=ANY=[@ANYBLOB="000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f72b2855f5a7c82be0dad8b0000000000008000000009000000ff03000000000000080000000000000009000000000000000000000000400200000000000000000000000000000000000000000000000000f81c0000ff0000009407000000000000070000000000000000020000000000000300"/512]) 03:44:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2293.666349] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2293.666368] binder: 31012:31020 transaction failed 29201/-28, size 104-24 line 3284 [ 2293.666657] binder: undelivered TRANSACTION_ERROR: 29201 03:44:43 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xc6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000140)={0x7, 0x7b, 0x2}, 0x7) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 03:44:43 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000080)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xff76) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x11011, r2, 0x0) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x6) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ff7000/0x3000)=nil) mprotect(&(0x7f0000ff8000/0x4000)=nil, 0x4000, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 2293.798084] binder: BINDER_SET_CONTEXT_MGR already set 03:44:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2293.798095] binder: 31029:31039 ioctl 40046207 0 returned -16 [ 2293.921684] binder_alloc: 31049: binder_alloc_buf, no vma [ 2293.921703] binder: 31049:31051 transaction failed 29189/-3, size 104-24 line 3284 [ 2293.923251] binder: undelivered TRANSACTION_ERROR: 29189 [ 2293.944160] binder: release 31050:31053 transaction 13559 out, still active [ 2293.944164] binder: undelivered TRANSACTION_COMPLETE [ 2293.956058] binder: send failed reply for transaction 13559, target dead [ 2294.023075] binder: release 31060:31061 transaction 13562 out, still active [ 2294.023080] binder: undelivered TRANSACTION_COMPLETE [ 2294.027403] binder: send failed reply for transaction 13562, target dead [ 2294.129770] binder: 31011:31014 transaction failed 29201/-71, size 0-0 line 3046 03:44:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:44 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r4, 0x0) r5 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r5, r4, r2) r6 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, r5) keyctl$get_security(0x11, r6, &(0x7f0000000300)=""/136, 0x88) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) 03:44:44 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmsg$sock(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x2, 0x4, 0x4, 0x2, {0xa, 0x4e21, 0x5221, @mcast2, 0x9e58}}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000100)="80378226d5caf15ff30cc7be02b4ae46a9455f695c173444696889b6ba8ac4a31a4139a035e4788584513d64ddd420775dbdf686147ae98b15a55a027b18029bfc02f15e913676ff6c2492cd62d59808ce55770d285d1d38d01d63d28a57a0191b1a5e074eb9360e15e95106232bd72e14735056ced7fbda49213eafa0a75e", 0x7f}, {&(0x7f0000000180)="4b60ec18aeee9fc0c65a70eaf744801a90d4ac709f6e2dcbbbf353b6ffba2a", 0x1f}, {&(0x7f0000000480)="0d444032f6daf60e6697292e75c2a3fadfd8d1aaf5ba3ba688817dc0b68644c4e8c64d0b4ca02bc86148f29d6452a193acb0ea3fefbef437c98b6015f6a5c874f5cd1dbc1bde13a4e02a3487dd365e44337a400b15526267c569f699f0cbf197503d04879a9066b08ca6c06109f5cb5502adb45d484559b0f6af54986e71e1ccd1ac2db875ec69915b3c8ece6840137ead5bf316742251bc27dc29429d766c8d0d072bb1e5cf493544b29c83fa5c3290cb5c5c97a88cb46203403cba2030088a8ddfc28fe4b7546b5a17655272cf4a591b036f32a4286532ae17224da14f637a79e6c5d740c40e5d1c0cbdb19fcdf2eacb248c0ace67b91913ec28680dd163b4b43342d367baa79c7480db6c41a2e291b998ba71960843912b899361b6ba339de3cec04251d108dfefcb108e8529ed62cb15cb7c9014f7e71430e90e836f84c8779dbcd4cb07b488537915ff16ca80c615d0c229fca38fa720000daf62683e5075c0258c61e30b7751ad328d59d70356439b47950101788124cb06c34f5e4b51ea4d98652b4c997a79a2c93221934f5f854b254f609299c7b5e51398c4ceb4d11f5d278e7196e82a6b142c7c51c60013042fa13d5d3ae933c46e321dbb7d82085abdbc50a3704ab617b287e600809965a2c1242bf86d6d0ff61ebb7f93ab70803e9388f384e18d4306cf8e7f0a98d677f46271da7c9bc78a751fa8bab3902b84204123f82e61351ceeacf4f6be84de8b11d16b12f1cb8c32f31499f786a0aa314befa7d05be70f66bd02b7a7d407100274dfa90a638f80a8864eb9a9aed08ad97b79046a3d566e68d20c75692913433038170cea9f86fb083e53343f3459088d0b5602b804f2b2f63e4a2f827105631e29476b1a479c8994f9cf6de9139d9ceb1d91a694352cc9daca16696a15f1f1f702d58d88241f846305d9b8c0d8ea07452ca307412d73367af1e96df0ce2312e84c5f693ce0d4fead9461ad1c48435e515108b63bcdc4eb76da85d03b1286d385b60e1a0496fc2040666b4af558e24c6b11d079991861fec84b84ec23bfa72a1ddb31aafd16d59eb51f2f122cf67626e37f1f1456a9c5d00b3c12a2a217e621f7e07dd9cb84e3c3395d2b671427c70f6b6bd36150c94637e64959660cc6d1f9c535ba224cf8c019be7ddf5059f738818ae839b6eace72ed9db544ff5977a0bb55fe0783d3d2f7708254fb74823b8dc8f8647aeb73a446236f881abf75e217eac225c5c898c04884dd7fd2abe53da5a246ecea89bcec4f7c79600a5df31201006701e80e36a82d14dd0bb324ecda99b96995bea95890d8a7d7dd1ad9cf8a58b01d16eecc04e5bd1b577bfe98d0590d7488a971ecca1fec4c4f5ac6ef07f44b9aa2ec999eb73d46460f41e0481f995ed8bdd34e7446512f7799e32f9e6b89a841d2b6371fda2bb229b4ae5e1cb1f17479497b03c01c93fe0009c94cac64f3f68a2a12205c719193f9957a6f2f5e209aee7bb59cce7c3bce99daebe4116894c12cb12d8fff5abd37552d0404d8fab837523759beaea72e8504208d0c5f5af1cdaf76ed5a14328595fc63bd5dffb2eaa324dc9622ffb23407135e2f48f233061a18d9cacf8ddc3f30791784221146158c4935b2cc952380cfae41e0377a80ed4ea7172696f4ed4c6df803c71ab40bc49ddb7be005534c8d1795e7ea801d4e001ecaf280a1a948df8be0e62b115a0d2892e5bb7319a7d1f697b359a1aa810ad6bc2c9ecf148c3366a981451ec8af03a59037b734922dd4e406201025aa4b5e108b56da9260d79865d5937d739cef765591ed6d75bd784c4e622c1b9d1c4febd4045cc5a9e43fa1f092ac946b7769f4a85147dc33c85c2a367c09d31a4aab42e4f31fa48acfa164795c0fff4635da6a4ae12c3d82a72818bcbc00a1b2f12897a1e2542d6903bbc57ccc3a2350a03955d118b12f9501b1bdf855a13975600016990b9b055a70ed8395f8417089975d1afb168584ad2b1f56237616c270eb2fd7170f517ef0d4188ee49a8d2c21309071b86fd89051dc80c35f390aad47c6732bab80f2da8364d92543fd9aeae25e0359dbc8162e6d6c154d8f02fb6900ea873c2413550a813bb267197b75332c4d90beaf7903198858d17883e222e1507bbcc205a5f7389f42c8d502f9e42bc44a9725f8caf5eb993cb968700dad70974c6b79ce06ae045c42c15e0a69baa71936eda8f9498c053696af5f8d3ce1075a5b7f5d4042f43375d1809a707c8c4bb3626a44a1bcb0f2f3fe16f294f0f6f32fe4a163128bb4e375a28154cae570afffcea2190c1a2ccf31291f4fc47cd6046ffd042c4b5b43c350f2734351f1ea1ba8a5be20b0878750a229ec29522fd32c559bfff1db27c7b313ad86dd8e79a41bc749e5e70f6946aa3c9f7b4614e8ba1b39808b823f68e5c6eb650f05595c9cc80b47795dcfd05d89fc82160e2d565cc932d5920a73f4a1e0fefa48547e081a808c11309dc96e4907d7175f3237c8bd566aa7cd7d0c579029af7d451de57be5e9fb04878160e021d73ef38e56ec97e1ceace1989843c2bc758c428498f351f3d882f25a940cb3c1221e0313b8f6bdc35c519b40c36525e75c1ac3ca15090f8200cf0a5e24ed77f928c6a2a665a1918cb1f6ffc17bd0f7964353cb967bc7276d698f1e5af6f400f929a1eeefd0b7f6000ecc4eba771e68e0d6b471cb0fe17011427bd8f1ad7e9337768cad1caac05ac4046653e8a213d02c1120438e6686622e19612f0549d308654a5a3bc5429a8f1a560cefe187ca6397b0aef764f8134e0c0bbc72d55c9bf0977ac79d23075bfb9612280b5d12696ad6b7f9ea06ac066ec7e5608fef8d20f9784f0c1e506ccb95cb8b6bbce948ac1aec3adcf0a544cdc5f5de87fb1986ece4e7e1052f41a557f0282db06f30330152bba53b1818d2538681c32db03a74605af129e2a290149befbbf3c3092f7fa761be425ed06a2d346cf1efa9e259f03c683e6fb5eb3b4df82cf0d27c8ccd63cae5b0996a8f78a85e85bc50fb8d24b945c5e2307f0c330788759705b6fb9828fca304556c634cf939719e1a45b9f7b4c0aa6e176d63d0594cc3776c9dfb3631ef72c7ad480d478d264ca67867d0988a5fc4c22010363622577c555dfd039317d487ebdaecdc908f280b3e1925ae09eda2f733c8dace472875ea537c08c19f21b8deb4e76c3be074f845163fb8e62c0e9af0ba79e1e61459dbd99b1c815f81cbb5e8ac8bfc92fcdfe570b093d451a3f8b1f3c528d95836b92d88e12e5f127d58eed1aad34715359b02f4b8347529cdff035edcb72752264628af50b499c0baad68023aef232af70e1db56f4804f3a6f8edf069965abe03a2f6f2c25b96775f6547cd91eeedfb0920c9de15ecd7030d2d44ecbdee8cf9e565403f5469329425687c023b6f7204a426597b4d19f8118fa4dcbec52258801b43b7fccef0b5867d5cdaa70789da3779da68cec34777fc1f24a9e89a8d4fee72e81eb3fe9c78284b6981f60716eba7b1fe4ac5e6e57c57fa8717cdb18cc8dbac4786281a0a68e026275683cde839a5dd2899862ccf54fa6e1db4f054419489e5a0cfbd4a7d92a1893fdec702dbbc6f4c9abb09f2fd4b87a955d31a3207c7c1d5966e00c6bd82b5d96e5c49a373203e504a0839939da1346f1849864c72706a1c91969807e03fd23c366ada16d6a12efe2cb5ef95b044884edaa6e051460e7497c3a3e840db04ed3c5312d92a4586ff02d068ebd14956affd4c4a2fae971e2fa06110f10cc65b07360f800091f906a5cb39ecc20382196d0886c26d2b1d1202184016156f1123279036069b0124f3c3ad50afa8eb77d20f76b9c51917bc741585720659a040d34460ea095981051dc797d16edb04fa2a9de2912e642687221eae3a73e1ca9de01480f62b1c221df015d5e5b925435fc45f94e6d2c59a3b4c0afe29ec11f2caca8b2b5d907c9d9d4edc160bed7536b24d2b2be804a1e71211f391a3171167f000de9e7dddbff51fe45851fda1ad19ec6c8ca27c658f117d416767c6345cb59c5e415627f7fd6eb9ad50df15d6add7c0c76be0d7272453f7bcb588da06500b1610c65303c3536c4ed90a547d33547b152da8e5ed46d702049dbdb93059491a305cd408ec1df502f6ac53caa256c92681f029073a6e5db7b94b2cecf4e83c779d43d41b7088fd5d4f48091135f5855d7304c9207d276f325be2f665a442710382ee3274be86570705b77e364e501c457843e172a5d6c6470dff022cd711c245368e50055e936ad4988bc74508b6c1fbc3ae70b95db5f13f7b9d0b588ce28816f9e541bc6e8dd94e7573c5e466f8b05869c6eaafd4452b0aec8cc1c435bfeb12aeda9994adde0cb7d3b9c2f1db68fef7e348fa66b64b8e4cbefb919fd826bbb882cc92b4f8ff33784b231f90004c602b0a96cd5f0a174b3f034393f1aed3212a6a6150abbf9e29ff1067095044e3f94d579db91c271ef65a3310aea0c37df911feca06164137ea4b2242ee08c269ece7bb65cced51726a677260c9e5613a5da965542c5f7115853358e74a59a1e47eedbb2591aec251da446cc3dfccb41e36616161411c325751b5b85be5c7ce8f14bb5a32ec7ebeed35ef253457df47405de2a1807af0f3a567c04eb3cb3b199a15455ea497d6c8ccbe87e69ba4075b1d25d21fea3ea7bff9b615323e4b5c0734cdffe8085cfa8187a595c28af838ebbf98f02cae27d4b92dc73027b423933210c3e63c4bbd2ac3110593daf268fd64bd339bd8f8c8f192d36eac3cd3d07759fd691a7ce2607887be996fc45521497d113f2af596c12aef87b5e88edf599edf2409d378958d39af60863c1103f8ad67564be94e363c37f9e614153f8b61ac427096e57d8b6d827cd148678c8aa9b43c1e1f8846fcbbf3e44fe12315c33fdfbc0e121d71d135038696687df00e70245ff2ef94fd8279957215bd291d76185cff099a4b8e09472e630a5955537614152017a944182f3ad89cb4f02b9c79fffa351066ded2ca87b55f515c200c7b9fbf245511b38832bf085fc52a0dd0efacdafde17a98d7e80abcce2f2b12f728a4ef9f793850ee1b7c1a81d98faa4d41c14788070511340e21ccaa8075d5302ae1fba5f555fa758c511cbd2ee59e1fa13770b325b9f64a48b126a68312e94a482c5d59e1136200bd9fcf06610c0ee2893a88412d6aa9f1e04596701a91a27550a48f5ecb36b8ae122a3a18bb1759f5d4f4d416664d2f31489cf3838833d211d02b39d2fd2819b20f3f6682b049938bab1baa019d4a2a1f135bc60b308fe566a8b5eeb2dd397c7fc17df4a2b09679e4fa5eb50859404732b79ea1b36870f039cc17dbd9f91a9916952089664d567c98417ed77f0dff65a9e41c8c4b061b638c655e603593bacc32ff2af8cae485b50856d440a3a242ccd819e181593a0996d1b0bb61f93442dcf918053d1320e4e46ddcef727fb3359382db993b07b7c8b4dea5200888e6eaa691afff15711140c488fb66fa95bb3ab49e0c6319e97cb6cb39c4a9938ed8f7d8e189ef711f5d98442895a5349227e1fc6a5cb82057abf7cf99dac12548da1d975818b4fec4374bb95698e3d6a021b173036c3cee4c1d4ff14b5ed1599249012527fa392fc6f1346fa6e24784373b18a4fb1288c7241c1f0de9acf498bc41c840c0e03e4b4dc0191dc4c0479412bbb1b2110dfa2d5429eca77cdda7c60b54438e7d6fee9788c87eaf7c9a78594b70df982484189c5aaeb5e20741f6baf69e96456264d801dc2d2a3127cc441a6f47b02b9e6703b08f336175c4", 0x1000}, {&(0x7f0000001480)="339337404f52ae54961663270de90dbb6a9380d1e6414769486d76385a81f2108a28f84dc2bdb335eff7e3642dde9f5518eec4bc7118645e66ce324c3f27ba8a50a66ec2e75d14c3df138a86bbe69ea6750971cec1ec45bea04b6f906dcc8544adcb77d017e77639f9e65644105a224a2d4deb52a679e45e7e3a0d7be3389389cbf61c26005588fa1c31bb6f9383ce847e4b404c6ed921e0b2d9db7eb8d33fa0664b9e19629ae28e28302a0197233536c527eab9200677ae66df628e6d6850a560497360c43c4713e86c82e27b70b1bd2c588374d71a63721fbb9b9080a7d44a57748a91a864ea9a4ca442408e22ecf75840c9b559bd2be3316b1290dadcbaf6f8a9c330ec1b5ca56025ac466f232d838e73da6af8edf362bc07079cf424c4e7b4842c966606caadb69eea0e79d959711d898da131df4aff3c0b5b6fc98c3ed5e8d2bbf7bc9b112f43eb843aa314685e2c937347dcc8df6efde9aa5c37774798dab8e56be7c72a59de852fdc6d5d3f04f8e25efaabb0237ef0c29a35e93063aa3017f47c01a58f5670bffe96764a33294405aaba33646e7177d3fdf5333c175d5d762422d55e4a403e4b1e04145d07d2c8484708751abb393a1fffc4dc59497d10e3be43d2d4043ce6b298b926513ff0c711bd77cc012b9330385ece404cc944072e7eab6f11492963542b4172c72c0c86701886a4302b0fb66cb22ced83bba83820808996970978a44b89d6512171cdb2a95bd53de748b0cf4dcc282317e939d8d10158d9e7847b2a3bb683376d7e1057941d511b7fa3255c6b81f1506f944f0fb3cfef0609e1272c663d823b0ea6ad1d99fd595fbf4ca062a56149b31e499cf164d4c2998a1c75846111b7464432b12b5a89ccac2e3072c754bd8a5e5f6dca2cf02f21b85fe61376d326c81389867b99f5d366956604f525a20b3ebe31d483d0b2c8921848274e85025ab8dbd2e28c66ce45e60e1b1ceb8caddb8bd099a2b59d3f185ff0ec53b51f9063101ffea476cafb3664bcb7338377f42d7cf1badb0ae6e338bdcc54fb48c5eca7f1510fd14890477bed8490f1fc023fd3e315b268935724897a2186bf5340e16d494f22b981cf23daa18f0d466f5707d9f73fa1c7d11726091f1285fa311d512f4799d5d416925b46d9723c59a437c5cb372b0bb7d584e225c5b60619f0c99eac0f143c66ec90d96828ad31ed13923ef7175ef6059f56e1caea75bb65adc60febd16ce1a2d70fccceccb08dedd97d8cfe05dc0b2be73658f1f0d376dbe711b1633763b7d08b54ba926101025e221ed143f055515f6f4e55ed9001a69547e1aaddae52278f011644faa45bf7b62537305e912f226abd444c392cad3875fb70bb8a49e9109e9a97fb3ac40f136a4477bac54c4082a9d48dbf78380a4b0ea442758aa4c625e41f10919e6b213bc6731bc3e1db2d696c2ebfb469504bcfd12f472143e7411c8431db9e2dff95dcc0fa7340a649a3999fca658e66ac76944a2d22f0c000497e928fe3d49ed6213e192b697b206f946319db451107b5eabc66bdf862073dff58183e469d68caf6e215d05c7ccb9992d0e59f0d1062fec0b7aa925e1c154839d0c3b848b2b708d2bd6c34fa92370ee8561a7aa81124a8b334091814340f35725a1b837b53aa0d6f779b375292a3b3a6f807e03e23aa986be2298a895c537ffefcff7c094cae4c4f4d47f8ec42f390cc9cc38165ea07932f776d3b8749e7a4d562d39618ce18e65addab3c502e46e8a956dacb8ac71df223f627e1189e83d8d6c7fe43ca61250d9f0e4133474eb348d59ba8b5d2d823b7b4498a4c75757bbcae10f5d2fd049a786b68ba5ddd23ac1481e3d12270f4fd1eece892e08bd650c548470f69c59cf32364a918c1214f6db2bb248979731b916a2b1d86de17116c727e65aba923c0fe8c46dbb869fccc461cf067eb6f62cf188951b63656b1cac61bbb4c51b4c2e7b2f20c07270299371354ea00a1dbde52d1c98dcdef898629dad1e3bd6cacd6eeea97e40dd940dee06b3b412a30a065a1196013896765d6ffa2b7f00de497b9a74c58ca59f5bcc88073b275049b555dd3362307b4fb0d07d8135f726f73d24e34b7b7211c51eac7854ec4af00490aef0abeec5c36c5bdedb365a9a079e22f861c291ef5811945b25c8ed92a35364c98b7f126b4355622de24fc066f659cbff9cc7d7eaf6a6ec27cd306abdf19cd391e373148b0e1632b19676c9524207e691eabb80d32572d0a9a51239148f11c9c293ed4fd6e724e5a37acf434d79f44990a1187b3a6f190a1a2f8ed99dbeb946a5e8d10495b180bff8a3fb488397598c70d90cfad6611b1a996571369b45b16b74328942887573449f35a375cd37d9084af7c28f308a6f85904a6996f34fd99b1bedda4d4534bcad2a2e61e6a935968763dcd6c10422959c4e1a1993588d5adf1a81ca60d0f74eb53d9ddc9ac8239bce40715db09e173e9f5a03fe6fcb68de91be373dc6aec2a35661fd7bac01ecb83c55e99172e63f86d184f91670ca2a75a215230b595001f0ca2a106db8dd529b13f9846034074fc2d4364d1b5c9a232e702aa0060acf61ca6f60b6378dc0db2afe608371d8c255c1db35a5f4f15ecffeb09313b9ddb04593845a81e29f9584635e6fd4e4c730cb0a695a9ebf4cad0805417722ec93bfc303d05171eb59baad0bd926ff8057cb11675e8223754366b0b9709bb0baebb96f8f13c7fe71d5cb0c3c5dc53364bf8d29f185599610cf3815cf603a041e753108e85106a711918d5e0a6bd72bc69eab00bb4c69ee9030ed27fc8cb465657bdc6787f0a8ea7bc5481da896fd95a0fb3143776848bec32b4ad23149b36d9df69d6d0fd6f1f7b11caba223abf0ace0ac077c56a13468a13fcea4f6be96777fa2bb7cb5e4317f249571a863e14c89f897feef5dcd52215b85191707f0f13cf6a0bf5700a351b783128381605363661b882c948076e7b592828dc57bd9ef1c6237ac2ea190b67c009f08fcf2e71265a59935d1d9feaa237f7542f8e93cd9eef7400a862d284baa6f164306d3f4ee3efad78a66bf2bad91ec994b5780adccaa140b65d15428f508fcd7956ea74b5b47318e012c3038c8da378654ecc60ee1b2834ba6a20fa50018d95e492c5f6001528f48d45a0302709580af4036a4b044a8206c502bb0b3f0652713c846b46d65b1603bdce77221662a21170b09891cc986d82970a48806adec24905313da8c4185fcce710cf290116b8eb45c753d4f89daea25e0c42970dfa64f5a65653c6a9b6d3883c54108f3fe4b027d12cc778e7316fac98f4d949b5b3ebc23a8a4e558724eed94c7fdf65ab750275e7b52232e9a912cba4acffae2646361a46f4601d1b3708f587732f03699ccecdab97eaf081a1dbef59b26abf40f17dc4cc7de1cd2b14a230e9fdd6a63755706f9497176fe94f449ca3944d61fd1e51fad747645e1214e82e66137bc89ceea0a5ba7941f3a6f0524e1d394b09abaab79dd0ab83b35e3c679b406b10b6a43bf6576664e7dc682fde64f1be83a64746bef4b5c5c1fcbbfd4fffb8db78a42e765b89dd471b7501e10ad29ab6bfb4a1fd7ffec1337574e403e4655537239e19cbebb5cb6227414905ffb3dd7596e094732fd1c0256e1046b406995369c00936f7fd73c7251e1e0cff0e914fb5d41b1ee7a105a8abb63752414123c1cf6b5ed4a2e5a06f5e9fe98b600358af1d7c4e852686cc2f0aefe13cb7b4d343691712f5b1593205965f4a84933134ac52d1731a5be525e732d6feb9212b5bde4f8f3fe256a9ce563dfcf1e1fb7fad2559070cc1af8799a8aa9c4ea64a07c666ec9cbbdd57467ad72f04034fd93862f0512c86305cf7903589a8b219004ae6ac3ad836abe2a20bcc5e3e50524db16844a33d95704a2d5b87d3a435c058dc560b5cb03d7f660f52a92dcf9ec65c3e065dcd1d07f5bd43d4dfc7bcd12a74faebe55db94c414475e44c8e93638f0c379fd0753273a0a660d0489158285671f98df97da5bde9ed7e23d42a70735bc9bacc9c0f74000f886839f7326cf57a2303cb5fc7d7ea7dc0f811b5413c83d0bfc4d82e0950d53d97ecebd1ad076301eb2dea687f477e653e11cc9482dfe77eeb5a12e08500250d59a60089585c0901581b6e88bce11157ca82b652afabbd3029cec34fb89844f3ce18e459a4928315cfd4cb2d04bfb281c3246e4ecbdd85f7b916ab73659ac30113718d6e384c203b58cebfd620549622fe29a3281f7a2954f5f0a39916fa192729a76f89ae2c6a64f47d9b651a4975ebe1bac2f29f438e8505f580eb58beae5cd160e79a0e8ce2b2ae8aa519d896baf69563fe4d20bb62c27cc31725306765f6f9e24590cf42f1a0f7a8780ae12bd6af96fec734306ec05735d5ea4b7c23ed04a7e133e996272c71aac972a814b3a2766a12468113a86dd785f59e811f7b79e8fdbeba452ab62186b525191051a869a0294db74df8ee5069019e0a60fe5fdcf1940fd2f20293269b8584ad7ba18f361c0acd6d26a77769090fe96a245dd8fff9f9d02b6209e7fdff714c8f93bb176ce7d86e8742f98e1ee4192884e9aa5344d9088f53793dac193dac8d5a158a7890755b467623ce82d1b36d8c7b11a8936ff1082411d5fe1d334b7f50cef32855dc70d0f8fdac859f0d65e3a2a3f46c260a25727a636d8eedead98ccc5b6c88149b05a24b38169e11dbbceb117bf7465ec616ee269887f5d3d4630c636f52fe6613489904aea4cf1f943f515fec1b48769c20dcf1859ad9662e19338be047fcbaa25313fa8b60b834ee88afb1263fc61ca860ba3ff10d3ee4d2e1d170dafc3a6bbdbe5de20a49d98e452ebe55f68f42c5481001f99548a52145c1628e978806bc48c96fb8e4fc6375eeef565221bcf0a19ebf8544c4a0929df28c0dda4931fc4855c0f10a856c9e8cb7bcc3497a99e3905404d3c43f35495d9009120490033028b882ebd423d658252b0598be6de015b085e91b5bcfcf80d78329cfdc1537f3b9eb3a74bf77c080bb4d5c1943a0878b6d48aa88b451a23f09b5dd3aafcfa8b41fa8ce49e1c92e4a14e5a3f0383fc0074b16af772fba7063bf4c348aaae89b4cdc81c440914eb7011f28c954b0fc864c188d3cef088d5dd0398489bcecc40765bd617edb9fe325de67eb340eb4773906aa1674b4fb9599ec9be79d1355caffd680123ec3b88c12c9a1a74fa5e9950a63a062b6a0a372d98bcb2e3dd6365fd7ba1875de0ec82ec5b666787a974dd914abf3c0f0aba3a17a248fe699b9c9fa3570931809d1ccc5d748ff747782ab5c69ad7630527eac4fb022c0136de2dd59cc414d317e518b1138249ac691a81d658f630c1a4d92bdc626697ec1b18a453a0e6f4ccc8fb789817747e9e0921339007210f3b2e40a9f2180a77dbabfa9a9d75b9ef854211910f74b315eedce05be987afbf9f8b05d9d5a06db645291304a4dca3897c071f6ed5388f23472bac106bc902fbccd8ae951674cd5356aa81a23a324dc28885e34edb413fcde9f682b5fe1312e6fe2d4f83e0c7212c84178006a21ff4da2b0b8c0ed1233abc857d2af8e4d105e9c9700645c4082e59d04b3b2143b937177e8fcbb4f4742f9200a809cc352a84e573951d09463072ce580ac067895d5ce4e47d4eb36035aae1217964ae009c05219f3d249c3da04bc1be145e85ca796d56a348e3589f5293f68eed2c2d86c9c91895d3377e6d4b759695c282040a56b4bacd68a0576ba299b586e1704ab022baf0e0c52d37b2a13143976ed6c5c6bfdba65b3a4ef900cbf0d5f3a7e", 0x1000}, {&(0x7f0000000240)="bbecf2fc28e6594540a8c16700d396c2c9a3b47ce3858174b22c0769ea509e2b637abe81dcccc5bdd360755e4196d63eaf491af642496012e708239284ecbaaa2f92", 0x42}, {&(0x7f00000001c0)="128690f41cb1bbda18fb079651d63d2c", 0x10}, {&(0x7f00000002c0)="5687f86b31b0402b284b635127e87a5d76f2f8fde27c972a9aece061d792b21442a10e675863ae9b88acffb3d70449ac187c7ea9c76c61cbb765b0d514f1b4b9416f171a8f607db19b80e5c3fcd080cff0f595af2bec14dfdf416558b78bd5d5a3a5636a872f7d670a363821", 0x6c}], 0x7}, 0x6632dcf4aae9ba2b) fchdir(r3) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fcntl$dupfd(r5, 0x0, r2) r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x4001ff) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$cgroup_type(r2, &(0x7f0000000000)='threaded\x00', 0x9) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:44 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x1ada42, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000440)) r3 = open(&(0x7f0000000080)='./file0\x00', 0x200000, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000340)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @broadcast, @empty}, &(0x7f0000000240)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000540)={{{@in6=@ipv4={[], [], @remote}, @in6=@empty}}, {{@in=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000800)={@loopback, @dev, 0x0}, &(0x7f0000000840)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000001240)={'team0\x00', 0x0}) accept$packet(r2, &(0x7f0000001340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f00000014c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001500)=0x14) accept(r2, &(0x7f00000015c0)=@xdp, &(0x7f0000001640)=0x80) getpeername$packet(r2, &(0x7f0000001840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x0) sendmsg$TEAM_CMD_NOOP(r3, &(0x7f0000002040)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20080000}, 0xc, &(0x7f0000002000)={&(0x7f00000018c0)={0x5a8, r4, 0x409, 0x70bd27, 0x25dfdbff, {}, [{{0x8}, {0xb4, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x3efd}}}]}}, {{0x8, 0x1, r6}, {0x44, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8}}, {0x8}}}]}}, {{0x8}, {0xf8, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}]}}, {{0x8}, {0x70, 0x2, [{0x34, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x4}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r8}, {0x84, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00\a\x00\x01\x00\x00\x00\x1f\x02\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe3\x00'}, {0x8}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x184, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x23e}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x80, 0xc0, 0x3, 0x6}, {0x0, 0x7, 0x0, 0x80000001}, {0x8001, 0x1, 0x80}, {0x1f, 0x0, 0x0, 0xa0bd}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x768}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}]}}, {{0x8}, {0xf4, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0xdd4d}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r10}}}]}}]}, 0x5a8}, 0x1, 0x0, 0x0, 0x2001004}, 0x4000000) getpeername$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) r12 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r12) getsockopt$inet6_IPV6_IPSEC_POLICY(r12, 0x29, 0x22, &(0x7f0000000300)={{{@in=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@mcast2}}, &(0x7f0000000240)=0xe8) r14 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r14, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r15 = socket$nl_route(0x10, 0x3, 0x0) r16 = socket(0x11, 0x800000003, 0x0) bind(r16, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r16, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r17, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000a40)={'syzkaller1\x00', r17}) r19 = socket$nl_route(0x10, 0x3, 0x0) r20 = socket(0x11, 0x800000003, 0x0) bind(r20, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r20, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r19, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r21, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000d00)={{{@in, @in6=@ipv4={[], [], @dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@dev}}, &(0x7f0000000e00)=0xe8) r23 = socket$nl_route(0x10, 0x3, 0x0) r24 = socket(0x11, 0x800000003, 0x0) bind(r24, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r24, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r23, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r25, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) r26 = socket$nl_route(0x10, 0x3, 0x0) r27 = socket(0x11, 0x800000003, 0x0) bind(r27, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r27, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r26, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r28, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000e40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000e80)=0x14) r30 = socket$nl_route(0x10, 0x3, 0x0) r31 = socket(0x11, 0x800000003, 0x0) bind(r31, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r31, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r30, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r32, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) r33 = socket$nl_route(0x10, 0x3, 0x0) r34 = socket(0x11, 0x800000003, 0x0) bind(r34, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r34, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r33, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r35, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) r36 = socket$nl_route(0x10, 0x3, 0x0) r37 = socket(0x11, 0x800000003, 0x0) bind(r37, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r37, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r36, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r38, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) r39 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r39, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_IP_XFRM_POLICY(r39, 0x0, 0x11, &(0x7f0000000ec0)={{{@in6=@remote, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@loopback}}, &(0x7f0000000fc0)=0xe8) r41 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r41, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_IP_IPSEC_POLICY(r41, 0x0, 0x10, &(0x7f0000001000)={{{@in=@local, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@mcast2}}, &(0x7f0000001100)=0xe8) r43 = socket$nl_route(0x10, 0x3, 0x0) r44 = socket(0x11, 0x800000003, 0x0) bind(r44, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r44, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r43, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r45, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f000000a200)=[{{&(0x7f0000001840)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000001d40)=[{&(0x7f00000018c0)}, {&(0x7f0000001900)=""/229, 0xe5}, {&(0x7f0000001a00)=""/240, 0xf0}, {&(0x7f0000001b00)=""/203, 0xcb}, {&(0x7f0000001c00)=""/202, 0xca}, {&(0x7f0000001d00)=""/54, 0x36}], 0x6, &(0x7f0000001dc0)=""/60, 0x3c}, 0x81}, {{&(0x7f0000001e00)=@nfc_llcp, 0x80, &(0x7f0000003f80)=[{&(0x7f0000001e80)=""/206, 0xce}, {&(0x7f0000001f80)=""/4096, 0x1000}, {&(0x7f0000002f80)=""/4096, 0x1000}], 0x3}, 0x2}, {{&(0x7f0000003fc0)=@ethernet={0x0, @link_local}, 0x80, &(0x7f00000053c0)=[{&(0x7f0000004040)=""/118, 0x76}, {&(0x7f00000040c0)=""/172, 0xac}, {&(0x7f0000004180)=""/153, 0x99}, {&(0x7f0000004240)=""/4096, 0x1000}, {&(0x7f0000005240)=""/197, 0xc5}, {&(0x7f0000005340)=""/121, 0x79}], 0x6, &(0x7f0000005440)=""/232, 0xe8}, 0x91}, {{&(0x7f0000005540)=@l2, 0x80, &(0x7f0000006640)=[{&(0x7f00000055c0)=""/4096, 0x1000}, {&(0x7f00000065c0)=""/67, 0x43}], 0x2, &(0x7f0000006680)=""/85, 0x55}, 0x7}, {{&(0x7f0000006700)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000007b40)=[{&(0x7f0000006780)=""/255, 0xff}, {&(0x7f0000006880)=""/100, 0x64}, {&(0x7f0000006900)}, {&(0x7f0000006940)=""/111, 0x6f}, {&(0x7f00000069c0)=""/42, 0x2a}, {&(0x7f0000006a00)=""/4096, 0x1000}, {&(0x7f0000007a00)=""/3, 0x3}, {&(0x7f0000007a40)=""/162, 0xa2}, {&(0x7f0000007b00)=""/19, 0x13}], 0x9, &(0x7f0000007c00)=""/233, 0xe9}, 0x22}, {{&(0x7f0000007d00)=@alg, 0x80, &(0x7f0000008fc0)=[{&(0x7f0000007d80)=""/166, 0xa6}, {&(0x7f0000007e40)=""/4096, 0x1000}, {&(0x7f0000008e40)=""/241, 0xf1}, {&(0x7f0000008f40)=""/1, 0x1}, {&(0x7f0000008f80)=""/1, 0x1}], 0x5}, 0xff000}, {{&(0x7f0000009040)=@l2, 0x80, &(0x7f000000a0c0)=[{&(0x7f00000090c0)=""/4096, 0x1000}], 0x1, &(0x7f000000a100)=""/235, 0xeb}, 0x20}], 0x7, 0x20000000, &(0x7f000000a3c0)={0x0, 0x1c9c380}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f000000b640)={@loopback, 0x0}, &(0x7f000000b680)=0x14) r48 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r48) accept4$packet(r48, &(0x7f000000b6c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f000000b700)=0x14, 0x80800) r50 = socket$nl_route(0x10, 0x3, 0x0) r51 = socket(0x11, 0x800000003, 0x0) bind(r51, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r51, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r50, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r52, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) r53 = socket$nl_route(0x10, 0x3, 0x0) r54 = socket(0x11, 0x800000003, 0x0) bind(r54, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r54, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r53, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r55, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f000000df80)=[{{0x0, 0x0, &(0x7f000000bb40)=[{&(0x7f000000b740)=""/203, 0xcb}, {&(0x7f000000b840)=""/158, 0x9e}, {&(0x7f000000b900)=""/95, 0x5f}, {&(0x7f000000b980)=""/208, 0xd0}, {&(0x7f000000ba80)=""/165, 0xa5}], 0x5}, 0x9}, {{&(0x7f000000bbc0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000de80)=[{&(0x7f000000bc40)=""/152, 0x98}, {&(0x7f000000bd00)=""/96, 0x60}, {&(0x7f000000bd80)=""/70, 0x46}, {&(0x7f000000be00)=""/4096, 0x1000}, {&(0x7f000000ce00)=""/4096, 0x1000}, {&(0x7f000000de00)=""/114, 0x72}], 0x6, &(0x7f000000df00)=""/77, 0x4d}, 0xfff}], 0x2, 0x10000, &(0x7f000000e000)) r57 = socket$nl_route(0x10, 0x3, 0x0) r58 = socket(0x11, 0x800000003, 0x0) bind(r58, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r58, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r57, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r59, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) r60 = socket$nl_route(0x10, 0x3, 0x0) r61 = socket(0x11, 0x800000003, 0x0) bind(r61, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r61, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r60, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r62, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) accept$packet(0xffffffffffffffff, &(0x7f000000e1c0)={0x11, 0x0, 0x0}, &(0x7f000000e200)=0x14) r64 = socket$nl_route(0x10, 0x3, 0x0) r65 = socket(0x11, 0x800000003, 0x0) bind(r65, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r65, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r64, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r66, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f000000e2c0)={0x0, @multicast2}, &(0x7f000000e300)=0xc) r68 = socket$nl_route(0x10, 0x3, 0x0) r69 = socket(0x11, 0x800000003, 0x0) bind(r69, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r69, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r68, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r70, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f000000ed80)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xd638}, 0xc, &(0x7f000000ed40)={&(0x7f000000e340)={0x9d4, r4, 0x2, 0x70bd26, 0x25dfdbff, {}, [{{0x8, 0x1, r11}, {0x7c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x62}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r13}}, {0x8}}}]}}, {{0x8, 0x1, r18}, {0x240, 0x2, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x80}}, {0x8, 0x6, r21}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r22}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xf45a}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r25}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r28}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r29}}}, {0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x3ff, 0x80, 0x1, 0x2}, {0x7ff, 0x8, 0x1, 0x20}, {0x6, 0x2, 0xfb, 0xf7e}, {0x2, 0xea, 0x0, 0x8}]}}}]}}, {{0x8, 0x1, r32}, {0xf8, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r35}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xacc}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r38}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x87a}}}]}}, {{0x8, 0x1, r40}, {0x228, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r42}}, {0x8}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r45}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7ff}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r46}}, {0x8}}}]}}, {{0x8, 0x1, r47}, {0x178, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r49}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r52}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r55}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r56}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r59}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r62}}}]}}, {{0x8, 0x1, r63}, {0xb4, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}, {{0x8, 0x1, r66}, {0x13c, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r67}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x47}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}, {0x8}}}]}}, {{0x8, 0x1, r70}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}]}}]}, 0x9d4}, 0x1, 0x0, 0x0, 0x1041}, 0x400c4) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r71 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r73 = dup(r72) ioctl$PERF_EVENT_IOC_ENABLE(r73, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r71, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2294.153555] binder: undelivered TRANSACTION_ERROR: 29201 03:44:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000040)=""/39) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 2294.200017] binder: release 31071:31073 transaction 13564 out, still active [ 2294.209583] binder: undelivered TRANSACTION_COMPLETE 03:44:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fchdir(r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0}) 03:44:44 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000300)={'filter\x00', 0x0, 0x0, 0x0, [], 0x8, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, 0xf8) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000480)={'broute\x00', 0x0, 0x4, 0x70, [], 0x1, &(0x7f0000000180)=[{}], &(0x7f0000000400)=""/112}, &(0x7f00000001c0)=0x78) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 2294.226478] binder: 31070:31075 BC_ACQUIRE_DONE node 13566 has no pending acquire request 03:44:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) [ 2294.226488] binder: 31070:31075 got reply transaction with no transaction stack [ 2294.226497] binder: 31070:31075 transaction failed 29201/-71, size 0-0 line 3046 [ 2294.316215] binder: BINDER_SET_CONTEXT_MGR already set [ 2294.316223] binder: 31084:31089 ioctl 40046207 0 returned -16 [ 2294.325189] binder_alloc: 31071: binder_alloc_buf, no vma [ 2294.325211] binder: 31084:31089 transaction failed 29189/-3, size 104-24 line 3284 [ 2294.339077] binder: BINDER_SET_CONTEXT_MGR already set [ 2294.339086] binder: 31090:31094 ioctl 40046207 0 returned -16 [ 2294.341058] binder_alloc: 31067: binder_alloc_buf, no vma [ 2294.341087] binder: 31090:31094 transaction failed 29189/-3, size 104-24 line 3284 [ 2294.347994] binder: BINDER_SET_CONTEXT_MGR already set [ 2294.348001] binder: 31088:31091 ioctl 40046207 0 returned -16 [ 2294.350647] binder: 31088:31091 unknown command 4 [ 2294.350655] binder: 31088:31091 ioctl c0306201 20000280 returned -22 [ 2294.356367] binder: BINDER_SET_CONTEXT_MGR already set [ 2294.356374] binder: 31090:31095 ioctl 40046207 0 returned -16 [ 2294.357199] binder_alloc: 31067: binder_alloc_buf, no vma [ 2294.357218] binder: 31090:31095 transaction failed 29189/-3, size 104-24 line 3284 [ 2294.597768] binder: undelivered TRANSACTION_ERROR: 29189 [ 2294.608451] binder: undelivered TRANSACTION_ERROR: 29189 [ 2294.615306] binder: undelivered TRANSACTION_ERROR: 29189 [ 2294.625038] binder: send failed reply for transaction 13564, target dead 03:44:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x11, 0x800000003, 0x0) bind(r5, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r5, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) sendmsg(r3, &(0x7f00000001c0)={&(0x7f00000000c0)=@can={0x1d, r6}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000140)="e9b7ed0cee02c082501faf8481ff1fa6193bb40bd36db3ceae9e01a4f1f0adfa904272629c7608797d8e90c2208b2a3aca8dc07e2fdd3df7696ef0223f", 0x3d}], 0x1, &(0x7f0000000380)=[{0xd8, 0x114, 0x9, "898691b139d921cae0a0381d8938cec03d37e0919e4f06ba4be0006e2e59381cce1460d1b4aa1e54cafac7e76cacb96d1f005089a10b8cefda65430b3a4eb487461318f3d94037ce9417ed7f8f4badadcaf8e6dc9f605c89dae3d91216c86ff2cf375f9b395ff01bf8ab6a1ae3e0a43f77ca5a5280ea10c73bd2f98867a631f6f243072f3038f63960ba492a183cb60d08348d804cf140e49dab67921008ad174eebfc98841d0ff49921a050a5eed9782fc5c6ba5409ec85a07bca96a3db8bde15"}, {0x58, 0x10b, 0x400, "31cb078b918ea1543a1f9dde9a5464216c665e87eea8e92a21ba25a3b3fe42cc77197f50e4dde567fbf0b3480e045be947994abe727205c8bd260e184d13ce70413f9895ee511b"}, {0x28, 0xf3afd9571d0e3431, 0x8, "2b5517746992ea3a029413566df345ed127c"}, {0x90, 0x0, 0x4, "8965e13cd03efa9d69d7f4c91fc80b58b046e4d20cedf04cf1ad6ff5a5d8d80c54e55caed97a82983bf3f78aacc327c0215a08e9beabea5561f83f1ddffce3859f91253c5f67445549fcb226bb6026d2ebff021889f2186b5db6b36f71d85315b9cff05da4cc111df2f8160bdc1cc7e24dca2fdbf3c169b047"}, {0x68, 0xb0f935a6492f2f6c, 0x1, "177855c2bc3ef2205d71f498e27ae2b4ec7892762179c44cb14fac9a0b3266fe4ad68bb1abae27a8cf703905a4ea4e83ffcff6d6df4b2ab2b4308182b6396fdcd4d3112c50c3ca639b5d4b230003c44452540142b17513"}, {0x28, 0x118, 0x5, "ee71c1ff91ec232a23bc62005c9cb61c45c56efad55d9d"}, {0x18, 0x0, 0x2, "768a635d3af8d980"}], 0x290}, 0x3b065fd21e1a3430) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:44 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fsetxattr$security_smack_entry(r1, &(0x7f0000000100)='security.SMACK64IPIN\x00', &(0x7f0000000140)='/dev/binder#\x00', 0xd, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x802) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0xe664eb06d3a0f8bd, 0x0) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) recvfrom$packet(r3, &(0x7f00000003c0)=""/4096, 0x1000, 0x40000100, 0x0, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) fchown(0xffffffffffffffff, r4, r6) ioctl$sock_proto_private(0xffffffffffffffff, 0x89e2, &(0x7f00000013c0)="0ce6940b36d50c7d414fd9c6ed75941a9f6596be9ced801008f48a6c5cc938c25dedd97e043dff43f432adaf514b1a7eb94a8eeb444a28ba98c4a9845e75186e7654a77f1204c927a769a25fe98a95f34b194f547046fcc419318eddcf5bf09500a561f97323034f690c1ee0d1e406bbe1f069") ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4f, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1163d0484000000000000000000000000000000000000000000000000000000000000000005800ab000000000018000000000000dc46bc", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r3, @ANYBLOB="000000000000000000000000852a7470030000000000000000000000000000000000000001000000000000000000000000000000852a687700"/76], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00003745004000000002000000"], @ANYBLOB="4004000000000000"], 0x0, 0x0, 0x0}) 03:44:44 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") flock(0xffffffffffffffff, 0x2) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000100)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x240000, 0xc) ioctl$sock_inet_SIOCGIFBRDADDR(r2, 0x8919, &(0x7f00000001c0)={'dummy0\x00', {0x2, 0x4e23, @empty}}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:44 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000080)={0xf, 0x1f, 0x1, 0x5}, 0xf) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) r7 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r8 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r8) r9 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r9) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000880)=0x0) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r11, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_IP_XFRM_POLICY(r11, 0x0, 0x11, &(0x7f00000008c0)={{{@in=@multicast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@multicast1}}, &(0x7f00000009c0)=0xe8) r13 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r13, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r14 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r14, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r13, 0x400454ce, r15) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) r17 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r17, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r18) fstat(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r20 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r20, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r21 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r21, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") pipe(&(0x7f0000000a80)={0xffffffffffffffff}) r23 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r23, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r24 = gettid() ptrace$setopts(0x4206, r24, 0x0, 0x0) tkill(r24, 0x3b) ptrace$setregs(0xd, r24, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r24, 0x0, 0x0) r25 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r25, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r26 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r26, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r25, 0x400454ce, r27) r28 = gettid() ptrace$setopts(0x4206, r28, 0x0, 0x0) tkill(r28, 0x3b) ptrace$setregs(0xd, r28, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r28, 0x0, 0x0) r29 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r29, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fstat(r29, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0}) r31 = getegid() r32 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r32, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r33) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r35 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r35, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r36 = openat$cgroup_procs(r35, &(0x7f0000000c00)='tasks\x00', 0x2, 0x0) r37 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r37, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getpeername(r37, &(0x7f0000000c40)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, &(0x7f0000000cc0)=0x80) r39 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r39) ioctl$TIOCGSID(r39, 0x5429, &(0x7f0000000d00)=0x0) r41 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r41, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r42) r43 = getegid() r44 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r44, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_SIOCGPGRP(r44, 0x8904, &(0x7f0000000d40)=0x0) lstat(&(0x7f0000000d80)='./file0\x00', &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0}) r47 = getegid() ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000e40)=0x0) r49 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r49, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r50) r51 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r51, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r52 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r52, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r51, 0x400454ce, r53) r54 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r54, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r55 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r55, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r56 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r56, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r57 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r57, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r58 = dup(r57) r59 = gettid() ptrace$setopts(0x4206, r59, 0x0, 0x0) tkill(r59, 0x3b) ptrace$setregs(0xd, r59, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r59, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f0000001180)={{{@in=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@loopback}}, &(0x7f0000001280)=0xe8) lstat(&(0x7f00000012c0)='./file0\x00', &(0x7f0000001300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r62 = dup2(r3, r4) r63 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r63, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r64 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r64, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getpeername(r4, &(0x7f0000001380)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000001400)=0x80) r66 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r66) r67 = openat$cgroup_int(r66, &(0x7f0000001440)='cpuset.memory_migrate\x00', 0x2, 0x0) r68 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r68, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r69 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r69, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r70 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r70, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r71 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r71, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r72 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r72, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r73 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r73, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r74 = signalfd(r73, &(0x7f0000003c80)={0xc33}, 0x8) r75 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r75, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r76 = gettid() ptrace$setopts(0x4206, r76, 0x0, 0x0) tkill(r76, 0x3b) ptrace$setregs(0xd, r76, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r76, 0x0, 0x0) lstat(&(0x7f0000003cc0)='./file0\x00', &(0x7f0000003d00)={0x0, 0x0, 0x0, 0x0, 0x0}) r78 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r78, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r79 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r79, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r78, 0x400454ce, r80) r81 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r81, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r82 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r82, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r81, 0x400454ce, r83) getgroups(0x3, &(0x7f0000003d80)=[0x0, r80, r83]) r85 = gettid() ptrace$setopts(0x4206, r85, 0x0, 0x0) tkill(r85, 0x3b) ptrace$setregs(0xd, r85, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r85, 0x0, 0x0) r86 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r86, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r87) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000003dc0)={0x0, 0x0, 0x0}, &(0x7f0000003e00)=0xc) r89 = gettid() ptrace$setopts(0x4206, r89, 0x0, 0x0) tkill(r89, 0x3b) ptrace$setregs(0xd, r89, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r89, 0x0, 0x0) r90 = getuid() stat(&(0x7f0000004040)='./file0\x00', &(0x7f0000004080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r92 = gettid() ptrace$setopts(0x4206, r92, 0x0, 0x0) tkill(r92, 0x3b) ptrace$setregs(0xd, r92, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r92, 0x0, 0x0) r93 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r93, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r94) r95 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r95, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r96 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r96, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r95, 0x400454ce, r97) getgroups(0x4, &(0x7f0000004100)=[0xee01, 0x0, r97, 0xffffffffffffffff]) r99 = gettid() r100 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r100, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r101) r102 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r102, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r103) fstat(0xffffffffffffffff, &(0x7f0000004140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r9, &(0x7f0000004280)=[{&(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000800)=[{&(0x7f0000000240)="83313418bee053ebbbb187798b46715ddf325f59166244e97270fc561650339d4afdd54d28f9936ce324e68eaa48f689199ea3feb8ad216a867e6d789659137848bd876b5b68c91847246669b9f03bbcc490a2e0bb9a8907ab79ccb5d53b516301079ddff17aea13e3459e2c27a1a71b5d44491db95b6afd077e8e168751e3b375a57f0cdc8d90819204d06010", 0x8d}, {&(0x7f0000000480)="09327b35566d131388367e01e362102d364d66a97d3ef50dfe14cb0d76387018f2210cd026642104e4f78fccf7a5b03b84eca8b707be74555d0d93b2401cbc6dcd53687f71ea60fca7181bdeb0c61ee0e6066383d02845c68e6f612292341c1560ccbfa555d2f5d050b01157f0e2", 0x6e}, {&(0x7f0000000300)="488226e75d15b6223bf03fd473aab931a28f1516740d26f06a5b9fc74ccc5cfb73b4ac", 0x23}, {&(0x7f0000000500)="58c1b6fbbdea324aae786c5c9bbb1b95fdff330c77eae41edc014c69600310429510205b3c0c82c4a98b305be2a766723eb932b7fc2bc58f8afc365a99b5353154137780ff357b34a6715fdb94cee595d15ea777d60b50fe6f49e26a6417b3e6f008b0df91ec39526b31fc66a2ffbc38e3514668", 0x74}, {&(0x7f0000000580)="4bf54796696c1d7963", 0x9}, {&(0x7f00000005c0)="4e783d8b675d3bbd025a9408b1da2ed3bc09fd91965046dd6dfe3cf01bb780afff1a627b85fd856c6ca2ccb140414bdba65a252165f9ad72a25529400679d8990ef677c5367dd7f1de7f19c4b81cf562ac4cd6e6740aeac05eef1bc357bf1f3a04f2ff6b375fb2f9cd4fccdd1201329c38332c05efd9583fa459dd99c29f70c4cfea767a3ebd2c1e22103d996e929ae376c9f3285dad9897edfb40ceb57e4f1e91a85b0bbcb9efee5f0923ad80476fe79ccb2dc70f48dbbf481ac2fa512df041ab42439c236ebc5c8f70fbf91ea4c510ce975069187fa346", 0xd8}, {&(0x7f00000006c0)="615278f64536221f01d9170dede02212391d6d6f752875eb00b19b29b968c10ac9d57f07b8b0225972c50f86ea762407a6800fc52a8d23b38eef6865d99cf3d57f1c9420ccffe4aaa5acf49490fa2659a6ed22360fc6876b452ffaa20578482f5d32d3461c3bb78ad18f6f2c29a7f8c33d538faf569af15988f36ccb3d9b5cbe0ed2b731c06f238446fe662bf6", 0x8d}, {&(0x7f0000000780)="3dc83cb6af07fc98b0a6bc4c5bb0d40d4032700fc64f794fe973bd2cc0be16433e9669b78ca27fb1945a25c38fa1f2398260fc02fc0509fd0f3dbd79583d42ce369f052e6076818ba4c4e002711546663963a383", 0x54}], 0x8, &(0x7f0000000e80)=[@cred={{0x1c, 0x1, 0x2, {r10, r12, r15}}}, @cred={{0x1c, 0x1, 0x2, {r16, r18, r19}}}, @rights={{0x38, 0x1, 0x1, [r3, 0xffffffffffffffff, r20, r21, r22, r23, 0xffffffffffffffff, r3, r1, r2]}}, @cred={{0x1c, 0x1, 0x2, {r24, 0x0, r27}}}, @cred={{0x1c, 0x1, 0x2, {r28, r30, r31}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r33, r34}}}, @rights={{0x20, 0x1, 0x1, [r36, r38, r5, r1]}}, @cred={{0x1c, 0x1, 0x2, {r40, r42, r43}}}, @cred={{0x1c, 0x1, 0x2, {r45, r46, r47}}}, @cred={{0x1c, 0x1, 0x2, {r48, r50, r53}}}], 0x158, 0x40000}, {&(0x7f0000001000)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000001140)=[{&(0x7f0000001080)="509685922ccc4f90c4b8d3cc364a9dcf10ada1c676afa4f90ed69ca89d74d06d49ec713aa9473e52ca266831c3289abafd4a7da75eb91184c3d2a0b349759e0a061d7b6f0e9c4824edbaa3910b5dd127837c1eced8f0d89ebdeb7c500dda88cfcb24d7dd934e751a3e71a3c7aacbeff2fd5c05270f011a86dbdc179f5858401873adc2d75470037ea13b111dd1f80db0c8219ed2145f757d81667dd597c3", 0x9e}], 0x1, &(0x7f0000001480)=[@rights={{0x24, 0x1, 0x1, [r54, r55, 0xffffffffffffffff, 0xffffffffffffffff, r1]}}, @rights={{0x18, 0x1, 0x1, [r56, r58]}}, @cred={{0x1c, 0x1, 0x2, {r59, r60, r61}}}, @rights={{0x34, 0x1, 0x1, [r62, r63, r64, r1, r65, r67, r68, r4, r69]}}, @rights={{0x1c, 0x1, 0x1, [r6, r70, r71]}}, @rights={{0x14, 0x1, 0x1, [r72]}}], 0xd0, 0x10}, {&(0x7f0000001580)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002780)=[{&(0x7f0000001600)="79dd0594e4ce5070aaa55ff381f937a595bb1773e4e61cf776ca4568af318179bdb87792f68d0c92e44be0c4b72b0bb97eb7485fd0d51c3a064c301a9d5027fdb08dc584a99ee16605393744647a2e78102e71ffa94130abe61fcf78ccc0c441db12b65f47374918ec1a462e90d63f5eb191021546ae3ff8800ff89502cca448bee65e7af69d7a6948886c15a7c125443201336b1c197a9884e79383b4e588c865a61bdd04c73af7c994c3555d5a50ccc02c61783d9bd31fb9582fc5bd93c5ea71a3bbcd46c436ac3af1c78e4179cb13b1b9f60fa76214f137c681810b60ceb72518dc4070165a3ea1012da7", 0xec}, {&(0x7f0000001700)="87c3d36691f726826b5a09fc9ac0b4a80e76f2fc83fdbaa5fee7ad949f40806d2f9985fee9a87bd5a8672be325e8a272755972193ef67f99ddd4f092dd1428935d65b0aaa372d13208855f4ae3de7233f77635e17f11935c811179f6a9758f30484b8c7c96dc6f", 0x67}, {&(0x7f0000001780)="acb7532409f5f158a09342c88f642f0445ad1793cdf37b62c11bda123d1e65adcfbbe6e15472826ace9e1b59c37fbfd335255c63adcec221b0aa9a2129c03b9a5f0d2d11288d30d9c81b4cf287d8b0459e248e9d8e8d322bfa6ef7a5b20fa5151a48535a90228631b86402f3e3003fb64ac3b1d08ab6576d34a6a0a0dcffadb9b39bdd8a7d8a77ab79a4cf7a69c255c6aa8a9798e97f8bca1bef9e2afdde00c78fb1ea02f8a4bf31c63787c806cd516d46cc70569d6aae327a0bd6f7a06853293dba6cb10faa65a0c90b1d578f21972b9e5cffbaadb6deb53a7466520d13226d33767b80161535388f7d3fc81bbeb1dd8cc4a52f7066c3677919d68afb6007f57c2c7a6ca27ba925502061642cdfb6527da0384c5caf8bac6f137828e486dbfa4aae5c491446b134da5311671fcf02b08e947211ed0ef03ab32d6ff076fd850c034fc3ac8aab7e50e7345438028fc675d2a371a840a19d5e4bc7c48d2233bfd01516f14f62d06944e25ab52eefcafcbf5b48d92a99efd41834ceaab032db814eafdfc57e75d2753eccaf9c3e1a45473526c9429eb0c1bc79dee5c0e9f402473c5a2e3f7d21b2e532e5f8f36664f4a7948be50f4552c565ec923f74229b2587aa9c0c89031b88dc52ee48519b2d4da345f1cbfbe67c235b1f96d9b27f6c81585dac1f67608864dcf6927ae57dad4bb4239bdb52d6e89ed8099f2174664a8718bbd9268559d77edcb563fc179130f947b5891b6dfbd9d2152f243ac9dc3ad547e235a288dabfd108fec6ae0af7c2c25bcb8d27c385dc72ab61de7ec6e299275461fa7172e445e484261b323f024df70ffe02adc453dcd3f70bcc7d11c344afad722c25c87b9e31f93ef28d9054f25237057d2caabe42de332b60bc6cf34d5478cb7a422a2e9d1c59a2b64f286d2ff2afb6740b43734c38f425e966d0c5ff56dfa74253da6b2ce09b84942bd748c1a547e661e8ccce0b53dddfa0dc9da675090ac1dddf3f9f67d9f71e5195325723dbdcd16d4edc13b973f511f88fe82d9adb0657e0cf567970f3ced5c366531c42c14703e843b851e0142ef7e530a5e25cad1244d585dd4b7aa8cf9f4126e97b349cf55e874a7c23c486b157c03af4b7fa8323856ff6cc7ca53f73df3a419258fed200e63e355d35919d8743722c00170be42f8e4208a8da9a12ab3bdf1e46e2a14b05e1269fa0e34a094cfe3ff2bc3a6355ec8b2b7d1a67cf86f8472b2de23da3fa012a126572242a29de68516ab674dacd4d82b4da76bf05f3120d7e71248cc34f04075fec54173c8e560cd025409e6bb5feb30638b8ce1ecb88db5a3d9ed355c5cbb14ab3fb1a0cca3fe74c59b9fa7b80755dfc52372f9e7598bf39560b8c7171c8660ab609d98e3cf12becfb466533a4298bb132cd52e62eb1c1c094ce0372e2112c20236e063b2d6dacba844f481e89fea13127c1d903c54614efd9960ad603429e29e4cb3011e09562dfb54984a0bc46926b104d98aba1d8a0a012d521049ec914516bdc489f015f09b8edc1fed9562fac05a695e59a6d9419be57aaae63bf08cb6995df9178731c4a5c5485916ab907df07acf9786127beaffb5783ed34ab0a76a79879f33ae5b61d82f50a1d12ebdd36cd9b4031f63227a4175c6278373599dba9775f5232b155f18b4554beb418b1ff78d2d19afbc1b4723f10288e957ab40160cb8b95a115d654596b01e3820238f8d6132f994c05093275dcadab4db386f38aa7117a0dd1a0f87ca64958e1ea3d43a835e4a6f5e8dfa77b14697657e35b9e97f4a5198ada549a28915ace5952895380fa8e9be7d6b101d892cc11ee666f5f89fdf6cc2de0a5e7f18d7f0c14e0c5207d6984330908fee6f7120d6c5f7d8eb3e04724070ca1b2d130894070fd0bf5a9e3a8e44c3c6ed622700b0903c0205a18f0bef876fac9647a496339065b7604dd5147e05a3948135d7145cfb92e5f188e2984cfbeff137f7feaef0e7d7057317a6c74151f33adc4f05f154d08ef12d11c6b2ad1d1cf7d7599d117736d5d67c3dbe35152f965deec340fd227f509b9f9d89f19b51ca347bff464fc4b8be38206e07e7a335b1b9a5d02823ba9a4de832c4b5d493859c22b6e5b9c2b5187799b353acd0067176d20de1f6aa0330ca8e5f19c30fd4c21344bf4afccbcb3d42b569662d64fc2c4e512b5afd8c664b0942503d4077b159b6527befe5a918c489264c36cb2c12d9441c5a0de3efc1af07ddc46d0d78642136ffa34ebe23d77411189093fe6ae990b36bd637365fe8cb3520e3815cc51af1f7aaa1b90a7c053278cbec18b3fb198fb3b41dd5453e06d0f0a9e142ec21c77f13acfaaf213baca707674f1839f771d7b60d7b31f92c011121b396c82e548bdb52092b77ddd2013275f1ebed7c3010f6b3e639733f17cc5d72d65322d70c2e2ca6c82294989956392af109901849992174362f7bb4be7e97f37edf8ae78f86e6d40d1b7e0f78c58bb8fbbbaf9e69d7a2e8bead086b7ffa389bd1376deb12c5399c8c3116a64bf5ee7255ae4696f019848e2e9be33c0f54a484fe057f72d61e464d9bc660f1bd9aae6b2cc1edae7361462a16e5933db083cdafc18574e13c43b3a66e1bd1c858755fbdabb20ef05bb2d38fb4ea2af004bb3cf246d27a0348cc823e68b588b04c0cce605dc62b80f5bec96f62cabf32274d2418dfc1d4b89367ec5dce028cfe1d3ec81f0cfbe9197474f80f939b5a10420272aed0428d2cbc47e291d12a8e3a8d2300f1e10e3502bca95fa23f6b52788e723d348b937af95bb770a34a3dde1972a83214d31438374511d1c127fdf9a8f584f91f1c89fc2865457912ac2e1e2ab596559d7686865228e17a11a05c216f5459548ce61d82624b86e49ac0184a29d2b6c01f081ef5a300326b878b4f8213c8cb568a11e328383241e3b90a2dd222f0b812dcb56c0d67260bc00fe37bee84ac47d886adf177b23208fd78d10caf65e2d90b6763152244e7adba95a440127bcb994fee1cc5750ed51dd6184f0fe6f6bb31fdf25bbcffdeff750ad369b3a30526870610c09b0693325f652beb42a0684afbd64a55168d00cb6cabf8b7cbf66ccfcc46a5e379f9518da5abf7b2e2497df7b6139b4f6430f8065d0b4e680850ee23586831d5626afa1daea10a43e865ce8dc0eaf910a4577602db6b24b12f731c1053a8dc0615f05a0ec4357ecbc72f25559c8c506e34c3f39a3d0b868dee274a2bc6c819344eb4eaddf433734d282a036086cf4678d389b273423adac4435751e63029a6622ae5f1d13ce933ba1fe81b69f1e64793a20b71d153b619d885d280a188bb81bc30438cee1cefdd2b517b675a3800d4425d9fe199d4e1bc25e9681f502b64dcaec100451a214a36c6cae65e61ba1b958c635c652859abf4b4223bf64b6fc6fbf7db3fc5fd35b2a6a9cab550afc4f232d2ae398a0488798c117e7050fc18ab97dfda07c9448f130a1489945ee21f89f257f27a5514512560e1ddd24e3924b86a6dc96779b4989b63f3f0b89cfaf1b8c5f7f0f360b8e71e13c4f32a9d1ba1e9cabaf55ceaddef3939373e1d904ae862a5d7ef3f74cef6d3c90a15e76137d84b6c92fb61803b8ccedcb11c28b47d3cb8b927794161843da672de9fa0a875adcb4ae9e3ccd569f3e58508a25cca0a2854fcba9a623b13a2fe1131a3c8dd90531102d18fda60c74a666247f6a08826f726320832827c7e583e80294cc0cfb0aec4f6e1c4bfdb688e7fb1c460034ac6203a6cfb9474108775b8c58658deaf29b8342d88b4ab9eb70c02a61286553cae5e3c7c57f54255d1cd359612885f61a8884b90245a507b8302015a88b0d45329f7800ebcf22eef76ff14c75a27056fe8320d96b7dcf14f72ea797460d8c49d80271714176da866fecf6bf527a705df24010279510e9425b02e12f956656b6598e1fc4ee147f6285789e7e1052daadd5c819e562fc140bd1a7afe86bb5393df275b638ac0c3e377dd46cb36e5020a4c0cd56e9e1b82636f003547ea6b446e2e796096ebff3159cfb0d51896a47bbe7d1da2f45b12baf4610f4911b9e850d91e7a2ca38f47a573749dc2d0f4407f30dc5eff106a70bd1d6070a1db7bb8434031568ff53dca7b77231da35944052bc1f97affc69c87e186454d70b962e56e6438a1000fc7df84367ce27d25eb3be516f6b569dfe8bcab823072b1aa50f79dffb9a9a95c8dedb44bea4074be2733e0d0348e8ec42ecfbd473900b125eb8240857719f3d799fa144219991eef2da69ccf0ffd47130eef5733959ca16605cfdd07a5a41633e5179a9898be39aa3467d6c6578e3479cc18e9013aa76a840c7a997c8cfce673e6489a26651e4fdbd0648da1cd03dfc5d154384d980078aacf27adaf053db59b668f0ee32c461e490cdd85e179d0532b51d14c1c27beea0e5fd4c20bf9658058cc4a522fc367d3122bdfcfb210e6b589367aa925bef15caf82106923be0907a837d3b22e91ae1714ba1b58fbc5df21dadf119740d116f33851e661e5cc11dffc8136fa1ca9f84b81eb06ae3c049bb212e157a9e4fdc748df6de1dc7d4dfdeb9be81b4f27f098a141c3adb86db0686e904e42ad8fb478c0368297473ba654b8fbcfb343ddcebeb986ac3450ffaf3f5e21505e95a30925abc4f1b3fbd97d6e39c37af431ad0562d247889e2f3ea02defb6583f78061baabf8422f54c39f04f0e3326be47d87829cc21ee237ff964cf0a7d3bc349d9994f87c43cb9292b21f41ae3ed3efc9f4c677c6dc2762d7cd306402efc752334a34a69179f7248fb7a5bcca21ca9c77473a196db037d7faf688af3e6789d9b0f4a3e5669cd7f73aee96c5a405a0a5e1102f5bc8384841ab5208377a5c3ca47112ed6e5f17ffe79777526760dca107b6701a63f99ecdda4df037f063b1f3c2b5b2be31a056a3befcca6213f415a86db1e82c0984d2fed22b8cc3d0e560ca528afa892642cfa16fdf9c4306d9c6ab9c9c09d67c2043bbe6930a6961b5583a149891b3f681c6c1a989990bf4f25f0e4851285764b96f0e6cae29ed73e22702686621fc70d333f169dd8d8598a7d941c8b62569068d6c813c570b88f132d02e40580e9395fa7b43eb8e7135896947740156372b82eb56ad9783928791729d33472823bedcd722d9f7dc320e94a2546970dbbe2dce4ad7f76389079bec588caf5ab021bde359345acfa0cac4f0eea2f12b3f02d8a0a36ce4b2140a2b9223b949257f6117ba08bbb22331ff2d62ede24d2bd63674d1ff2df05efe357c851d7df162c9315fbb49f6eaee99e3483c7d275616beeb2fef535e539fdf0a36bba75bbf3bc9a0fef601a5d9900d0b1c3e54629cec3ca5dcfb71e385312b3c8e61b3cadf20aaae7909023fa9d94255286829c8c7dcde37166c153231a46ad2552d2207daad972d9de55b978dd5408e07a73164dbf4e76fac118d0e0f7844e3136e9d8c0319c4fdb16c6fb7e0f4f6bc5617ad2e056b1c44f92b00bdc052e68266179f6e31ce31e891e7d206956a2e597523c922e14d187f51e2556104cce1df1109fa264be9d296692611792cba038ef87e1ec4702de233bd80023c6b5a65ecbb6cc3aad78fc5d3fb54e46eff7764344cdad1f7a8121945d8dd962f1d8af062633052b53481760add054bf6527f15a3f147a6e71a68aa044acc6b80cee5e4229386a40600060a62d0968c2b568e8d76d0dbc04701a14cf9fcc62f4ae684e21642979a91070dff29143c1371ca1ca87da4ee3d54d19590c41272a7cf19f7c97a468b191d8b7c8e9d69b7c2b8f12d6fcde54942cb748c95c4", 0x1000}], 0x3, 0x0, 0x0, 0x4000}, {&(0x7f00000027c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003bc0)=[{&(0x7f0000002840)="4828a0239a79d1b02a9d74ff601e0b70e7429dfcd03b7bf2c16749ecf1765877adb782f7884c4a57e07344941ccd584bcb8a476f", 0x34}, {&(0x7f0000002880)="1647cbe25a6677b8e33bef010e3b9cf79293b683c58b7f2b4f4c04c83b75c8b7fb4528facb", 0x25}, {&(0x7f00000028c0)="b337ac2dc6f056e6ab92058309ecc6be78043ed136d822b0006f27fabcfff60684bb2510", 0x24}, {&(0x7f0000002900)}, {&(0x7f0000002940)="5adb87b08f49d35642cb8968e8a400c6506fb0a912812995324009e303740271de6b98b909f395096d800363b30582e16d18841078307ae8bcdd4473fb136903cfc8", 0x42}, {&(0x7f00000029c0)="c16c2eb79bc6ef7f5b6992beb3db12b6c3b370344a68bd8cbc151658d138a6888da502073e2d93ba37c691ea77c47e42b34fa4e8f30ccb6c07d2665fa92ba3e99db71469d24f9ca37c115a04e0c928c948d437c420d5133c50ae2365d11c421f9860515a4eaf946ea8e2e5b6b3d29bc3ffbc27c071b71c267c3326bf0fc56dd51445e755b3ffc0a80cae7388ad401ca32d5954b7210d35a1c875bc970e7c32b21493e506dd1558d829ed40fd34dd7f0f8fe05952565188bb7812053c08d9cd09f02cd0a4f7a7a9caeba10afc5d69802fad0e448324fe47e8eae16c20b55b6b15d52c0025f7130438e7e202e8429fe494daeb3e1c87c6dc4149359f6c5e7be741cbe5af6933e82179460abb83e56b436ca9a8879761a011bcebdc3777a2d56e995acab4773eac395319e86ca4e547088149d4a6a353372a5ae981ad16cc8d0715dd4456b2e71d21077f799c830727cf9126f289a9fa97620e4b4b2a51ce5a10b3e36560b452be3ecaff09a050d59f028c6164d5def013e5b626014c9d17b73088cbfb728eafe24d0b08abb115d497af5a0a5d6e88784d789258364be7870d5e2814159bf2b4f148b09489dd068400f38b29c24a67fd6662a32f0a60849151abd75b5b6ba1c26b40add2c0dde7966f5086ec2b1cd2b33344a15d7e578dc2e9e9ab7ffa120dbe9ac7ffe4300966eb50d18fc90dd82eece76aebe379e886f12f66a30cde2910535fe98c41b95c9a295e71edc6860bbfa9d7c148578964970b96fb8d40ffea5221ca89b6bcb12da6274ce7efc2f0fcf48022afad568ac6d73d9f51fc17534227a6b6ea2fdccbefc69add06378fc50134f65b183571834965d52c2991fe55aa2570ea17be77dd09de2ce010d3665399aa1d0f4bfbdf156171887b278f31636b130b84cd1d7cb7ebc36296fae4d870e4669b7a4f55dd6f0a5a4177804d121ec640d815f1f4a3b23a2cb1afd7a6fd4bd9bcc8c72e985fb7efaf22c61f8beb7b1d991692d40b8515c014562d14aa93821bdc58de92bde1f87fedad044565cbd481cfd173db5050d00604cddf8d1704d4b2331af33b9075a0c717e31d03e623ae13b54444c093d823761d63713ff58466308061dc1b629f47f66573f667621a962b036752a1ace96186c1018bc5a99b84820f5168b2739728d2e2029262bd1bc316f308845a97905972097722332be7556fc9ee82f734647c384e41821ed11d3e2e341c17d45e3f2d072ed11999d33a86ec0cc682a6039baf54acb39a796b9d1acad856566364e44cba47b891fd7163d807be4a35deb79e2aceb85069abd7292f22cb83bc81cfce7af212811109a73f9bc8c1d83a243c40ce040886c263ba0c5d002b7a07922da1ff08c54e245280f0c0590dacfc48fa0cd1b3d8cc87b6e0a60611cbbfa6ea9a68920e54845d5f4fc2395cf91d4a0534869bb88e122b07a12da0c6662562a4d01952a64b18d6a82da86e15111ba6e8ef9e39a8086e0e489a50ef08f3eca189ed227d2e8dd5c47d548e3768de36abf4fe2b41ef48aaeb3745a3ae9141a9186897a3a18fbd33d3222bcaf4f102db72703e1079df6438ddc5400a1165c329d80f39eec11661adb370e55729fed70cde602ce7a3c413c4cca6d9d224d80dd64f3863b5c8567cf99b8a3c5c9a0f4afb0604baeeaa23f7e6098e15c4a6ffae753564bb838ef0689656a13b9d2b6318269bf1f25217e0c83faba208fceac138abf0f99b194aac31e99795ca0da6071d3bc50271420270914076b384e45bd464917a19c5b1f895156ec66c8e508a6cac450efbc80a73ed4fcc05aa716e897a340f0e3ea8e7c1c8693eead204ec065d8f2e53fa04880901c912376294a8c5082ca4efb16e055e4dff3583b9dc1d6ccc61d17f5f6be6a26adb921a2a48280f063a5212fb44ce3246bc2838023c1955e2ac35e4a8dd376bb973db36ba46dadea935479b064862879643d577d24aa63b92c69f443aaf80e5268a5814158b7b822c652aad8b498d6d64c69e8a75425e55342a7689c2cf8c87ab580f5b58a500738d17cf569d941460b49a191935766a3470ee316d6ac937bbdc32eab528be7acb60802ffbfa301f5a46b1e1d87edc8ee9f687ba52f3944b6ef75fcb630333e5d87f5e739f2ae6bdfc4929233ee7175cec1a1f9a7032b7f07fb1e67e1a9e95be7256f068c7ddca43fc866f60d5acea0d364b536f334b7f76ebc94e2ba1a4de62ed32d896c0809c0490ce4fed65b8525402d3b428edeabe40b8371a87eb645fe22e378b07bc19c8fef4f6ef38f169ed8185092384574782e086c058e82fd930dce0bc070edab4c230deb7d14a846362b4f0efc5dc2f8ba5820a8f05511e122339af2e7e6829325c2caf72fc4fd569a3c2e46163111fabb68a7cb60fb1d6cf19f0ef97dd42de2066711b45de2c3287239af275698a3f94ae0df3c5ed77df593f88d0f799c640a7598b4e1c89e65b9a7fe878a36c5e8f27e2d3e46d0b7e88b2510167f6cdd6f3b5a95ca1eaf0fa559f60cef4227a64785a1891e1f42f33b253abbd5c9a8f54ff2cb546e1e8473d20563bc1218b7c8b5aba30e223c5c51b03dda9d4ce6ff74368cf64ca221cb3e6c16cb284690a6e9e9832c39e75220fc5a1e99dae2867652f41b29bb7d5cda6e1f37ab4ea4fdb7d990384243bec43c2f5e362d876fcba1832c3002e43a8f0fe43bb34c6363a6fea5a09de3dcb31a7c908ac180c28bc1c93b58e9d9003d00ac5880bfb2f90051000fdc89518ff978b0516791d91b3c81eb3760c637ae8d039de47b412e86ed29cccc2ebbc57d22a8f2015e67861014328bd049188f635a4379b644a29007b1a9797de01f0283eb2d9749efbe6160214dece19ead9b54f38aa0c95f3ca10a735916d5699c3413008fafa4b53fba0d35b0bf2d0010c6e79467b0d496928bedf2e4acbfcbfc963702313d3fd65ded00721a2ba78868ad98a29d4a79e99e06b92cb562a4937fc1ad3c182e816e9f5518b03c77e0dc87ff0c0e89e464eadb84689c84701d561f9a31b69bb4cc07f893827403f434477cec720c15ba498a2cd700fc24f294b7d42771a0df71ca0e79996b3691205aadba5e2cd9a81952ec1ff6d0ffc7145809f4dde483bea91b0ec6bde5ec79117bc1790930cf587c4f680679f17bceca20abd8f4301a929220e21e4efc82bdaaaa677aeec3689fbd9a579492c52f10904ed90360a01c5a989b9766d62afa99900c1105e1cd7b1ae284a079fa8fa6378f0eec5a1643206485ce2640dbb003e13d44b7600345d75e6262cd377959249c5963165b01a623e33f3eca2a9b08ed7c7110ca31954b28dadfa2e97e5c749ab8d014a9f685ebef834532f50ebe2d289992c1effe059bcbdb27d3eb649c345ad7e2cf667e011d1b418d2f8a25876a224589c010116408403b1f96c17ba4a5ab3bdcb9efea7b0eae68776a8754ca23e7fb993921ae20d9a36c0ddde0c9a1e00bed7b09ddc9e4457f0a94736185eae967761a087333b05b315e1cb842aa1552d39442b1b413bcc7f4fb87ca75958dd9cd1d41e650bebd2ecf2a86ddd43e71b29371535b385b4791dde530486bd8672e96f85bf938a203ada0b8b3194b5a6fd68bfaa96c856285db463b7c5a2679952701917eefc51408a356ce59011f44d7b8e9c0bd5bf07ced25eed96fc0da43578d9ba06c927b95be6be99d9983d16a324ca266fa612fccb58078b024bf614ade7db2879a7eb2455b8976804c946fa61931863f6efc6e1411161b6b8fed13a561c1f51a04f2e03d659574dc2623b206038a4edf0545cca65876398d7ae5e4be7c16bfc6e355128d832d9bf8d251088e1de6e94aa02ca8f35b5cf1c1fd7c6d45e2522c83ce5781dcd5f2df636f7f4ef5ee877de79370281d7566e6f62a24b0e63c9966d7d89a2e9085c8ddbf4501f75c968a0ebfb1f9ca88205e0e30f485577d99a843b3cc010586782149f7382c5862b956e5bb5065ee0686975c59c3b1eff9304c5f9d767ae58e934533b27ad450907b10e5dbc22ab8b9541335e8ef3b1f6e416a66847b24c6df3055b5ac63b7556d1876ae3bff35a5ec45cab6722930fab7852ce642630b67019a309b5b44d5395bca84b5318676d8d8888bee0c5e72e53b561d22b384266c6159e8648dde4d148d0e965e4e8d2b4de1d38978a40af04e4d1ef0f6cfffdf8761f1815109205454312316cf9fdb8d5b987972a0e13bd75fc6bb46807c1c802abe9f173819a5d8d1097a3d3a0f4334d592e9e1445c82f994d66010dcf7b7a3918c15b5a1f68ceb90558bd7c53381b884a9af34314519cc66b1708e7597e8e397eb51c3ca0c0ed55ef95da595cecda9caf9dbf72bde7aa9a2434c20cd0fc3c3a9ae61c7e56912166c055c03e0a24f2a8ea2569840cb8cf079ee7a383e27c222d965e8134dccc6c3698110d4ebc9dfa3701e711e3af5e4df9fbc9bbf6f0a2527e7a989f683799b748b5a9e11278faee86dfcecd06c07a57b4ede82dc1624215b9ad17bdf4a470d6dc7ccf43fedd01f8493498748c1c44ea8906c1a9a36cae0f8c0fc4dcd271227ec5a8099c157e1211fac4ce26a4185b881af32bee59e6a1e9dd2a721f002fd859b7d68f83185ff688a943bc4aa72b7f6b97e32cb7f573ef233623b285ebd6a70450fa850aeffd24d8449fa024f431cdc719a1c7c4baea888a44617c74b3d03a6225a84a869d915c491d6f3485395b7787c1b315b8a2964165f7690ecab5a9b5db9af90daba08607febe11f0548be1f9dc2fca89eb2ebb94c7dcb147b244795dd744d006878f7e0218cab09c3e65432521e3103396488b7cad539f83fbb1573124d324913716abf60133e7e30e640472b7b6dbba6fdaeadfa9476f1421092d6ec061bc9ef78b7d84eda14eef4b1c839721ccc09376ac45904e653d3af4ce5357b9415a8e2b8d635f086e506c7043f40431293efbd7003bafc9821367d8dc5865af1ed79b7642714e0e7665b330ffc51707ad6d3861af50a15c4ebfe24293840f51b368cd929bdd46a301545c4a102c86ace921ea9577eefb1d4e63b7b5358637130a2bd234beb8a35e44cbf8a782c68eaf5e905cb28d5e595ef40660a706d3b905975957e95897c98ebe250822107ed84f2800fa1a7b1c004016806d4b73f4afb2e28887063f66d71c1176a58ac7961623425cd8eee10e0d3c9780ccd8df26317a1079eb8df33565195df05ef5b99801cc4908e69e0712e8319b19036265f526d9770c9cf879ffdd88946cd9992dc1fd755e486021da079fb284ffd02327e8efcebadecde132493fc84f4d4f1da32da050b50a16851c2fb6dd8206efd4a7ddab4ce7d31f0d50fb2a35a851e16e9956b01a9c07045cd9848608bb8e22a7d56f9cf3837db1363fb048eb91e6336e5fd76f9858751170fe4aedd2b3c5302ebb33aa4b54f2beff148a00f5e11c8a5bce910f510636192c1b5fa18089b6ebf8d75a204686ed14741183e603a1b15108d2863e51e9c4104d5d48ba00b171abf4f9b8822849ae0be9179ff445e0b7a4617d41bbc854aa4c42f1c7f11b7e8eea595b01f83bcc8de2757f3d582aabcb05053457adf22e26318d23349a5d836cbb149f6e739bc556b487240f10a6428b6e8f435ed256a401f7cab40dc7b939db1f1e128a99414665d0f0a0dc206a62203e36664c09d2dfee75166caff79367d2490174d451747546422c301230eac5661554d91a946228a142faf830a571a5bc72eb9c071711d73afe90da5e712757aad93e2a6c9168b416f45d7bd0feae29cbda01c1b791b0f3e6a09ed45e525b2220367422c065d38a4fc9be", 0x1000}, {&(0x7f00000039c0)="830949f466b433402e28a1ac5b9d6a6d18e63ce7eabdee61ceb3bf4fc3c5b3e035c283f3e58ce2d7f2b9b657ac2ba3ecbb550ebbbc207f646b4a344382d812bc43a9976ddae8b554c6f426df0afa952636e776", 0x53}, {&(0x7f0000003a40)="e9b156cc28406fd4d99b4d310b720cd8ee5c444c860f8a24edc358838b8fcb", 0x1f}, {&(0x7f0000003a80)="9c9cc0702fa324502726afd7e184f311b5de2b0737318b2ad830de65e7b428aedc9e1f53b1fead19b7eb2ff91d5c97c71a4cca7b684cd2c85484c6c8029976a09a7c5ce4493f1943cb04c8c97a4a00f40c6ec49abbfad5b839de7e56a0ad997d765a375cd8977a10f62728cd0127193b4b4782f827a7bb984efc78e97e2f610847ba096bbdce8a3cd56212f5dd51ce0d4ca6a95d1aba66f8fcd4ebb88ebd644edc352dfe86e0247228a708e3bc595ae2e54c65f58f740d9e721cf6f153", 0xbd}, {&(0x7f0000003b40)="3067cb2755f618759f81853c77efcacbb95d0833570dd8089e5f33f33b6bf7065bfc0e52fb6a9b15afecd26f0dc7402f3844e19d51f3bbdd3cfe83134592174045085dd46cd2dfed75ca2f7f888315a1074ba7aa87ce986930dfcb1155233fbb655f2b6df8fe22a7a8661a37c0e8ac647b698095d3ee56d8c482", 0x7a}], 0xa, &(0x7f0000003e40)=[@rights={{0x18, 0x1, 0x1, [r0, r3]}}, @rights={{0x18, 0x1, 0x1, [r74, r75]}}, @cred={{0x1c, 0x1, 0x2, {r76, r77, r84}}}, @cred={{0x1c, 0x1, 0x2, {r85, r87, r88}}}], 0x70, 0x8840}, {&(0x7f0000003ec0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000004000)=[{&(0x7f0000003f40)="fd6511331b2cae1cb7fa86ab15347b506345505f5cef45734db6950ed64e28513a8c34ea9dc13ca218c6d45de7555524151fbd1e4131cb161388fdc6848e77b49701ffd11e31108ccb2196ae3c430e7a04942a35149fc4a6dbc37f2bb24d37be70b5344d21a9a7b61d66c75fcb552df81808d9709f550863acfc08dc39ef9a6c06e0e7c79b2bbce114d22392f06ae895743496b36ac5", 0x96}], 0x1, &(0x7f00000041c0)=[@rights={{0x10}}, @cred={{0x1c, 0x1, 0x2, {r89, r90, r91}}}, @cred={{0x1c, 0x1, 0x2, {r92, r94, r98}}}, @cred={{0x1c, 0x1, 0x2, {r99, r101, 0xee01}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r103, r104}}}], 0x90, 0x44891}], 0x5, 0x80) setsockopt$inet6_icmp_ICMP_FILTER(r8, 0x1, 0x1, &(0x7f00000000c0)={0x60}, 0x4) fchdir(r7) ioctl$VT_OPENQRY(r7, 0x5600, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) sendfile(r0, r3, &(0x7f0000000040)=0x40100060, 0x4000400000000003) r105 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r105, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$bt_hci(r105, 0x0, 0x1, &(0x7f0000000340)=""/226, &(0x7f00000001c0)=0xfffffffffffffebe) [ 2294.634071] binder: undelivered TRANSACTION_ERROR: 29201 03:44:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="000000000040000029cb87817035542745ae551457f2c84492b00f880eca1c0359d90f13076b7ba0d18c2d83d1bdd40082f33625f27f37dc770d02ae928f03c9d100000000000000000130ea294821323acb29f78be6e35a8864f3df9915612f68beb384699f80"], 0x0, 0x0, 0x0}) [ 2294.733129] binder: 31123:31125 unknown command 1221616401 [ 2294.739349] binder: 31122:31128 BC_ACQUIRE_DONE node 13572 has no pending acquire request [ 2294.739385] binder: 31122:31128 got reply transaction with no transaction stack [ 2294.739395] binder: 31122:31128 transaction failed 29201/-71, size 0-0 line 3046 03:44:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="096310000000000000000000000012634840000000000000000000efffffffffffffff0000000000000000000000000000f6076d599d9e0000000000000000000000000000000088c700"/102], 0x0, 0x0, 0x0}) 03:44:44 executing program 5: r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$UI_GET_VERSION(r0, 0x8004552d, &(0x7f0000000100)) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syslog(0x0, &(0x7f0000000000)=""/42, 0x2a) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000080)=0x2) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendfile(r1, r2, &(0x7f0000000040)=0x40100060, 0x40003ffffffffffc) [ 2294.739836] binder: undelivered TRANSACTION_ERROR: 29201 [ 2294.778510] binder_alloc: 31132: binder_alloc_buf size 70368744177792 failed, no address space [ 2294.778517] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2294.778538] binder: 31132:31133 transaction failed 29201/-28, size 99-24 line 3284 [ 2294.786524] binder: undelivered TRANSACTION_ERROR: 29201 [ 2294.804162] binder_alloc: 31132: binder_alloc_buf size 70368744177792 failed, no address space [ 2294.804169] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2294.804190] binder: 31132:31133 transaction failed 29201/-28, size 99-24 line 3284 [ 2294.804338] binder: undelivered TRANSACTION_ERROR: 29201 03:44:44 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x80000, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0xffffffffffffff27, 0x0, &(0x7f00000000c0)}, 0x400}], 0x0, 0x0, 0x0}) futex(&(0x7f0000000000)=0x1, 0xc7, 0x0, &(0x7f0000000180)={0x0, 0x989680}, &(0x7f00000001c0)=0x1, 0x0) r4 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r4, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TIOCGRS485(r4, 0x542e, &(0x7f0000000200)) 03:44:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) preadv(r0, &(0x7f0000000200)=[{&(0x7f0000000000)=""/106, 0x6a}, {&(0x7f0000000180)=""/71, 0x47}], 0x2, 0x51) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:44 executing program 3: prctl$PR_GET_TSC(0x19, &(0x7f00000000c0)) r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x18) setrlimit(0x0, &(0x7f0000000000)={0x85a, 0xffff}) prctl$PR_GET_NO_NEW_PRIVS(0x27) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000140)={0x2}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) setsockopt$inet_tcp_int(r2, 0x6, 0x0, &(0x7f0000000100)=0x1, 0xe5) 03:44:44 executing program 5: socket$inet6(0xa, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 2294.851161] binder: 31138:31141 unknown command 1073929 [ 2294.851169] binder: 31138:31141 ioctl c0306201 20000280 returned -22 [ 2294.939348] binder: 31123:31125 ioctl c0306201 20000000 returned -22 03:44:44 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$UI_END_FF_UPLOAD(r1, 0x406855c9, &(0x7f0000000000)={0x9, 0x1, {0x55, 0x20, 0x5c22, {0x4, 0x401}, {0x8, 0x200}, @const={0x3, {0x7, 0x0, 0x7, 0x3}}}, {0x7c, 0x7, 0x5, {0x3, 0x8}, {0xcdf3}, @const={0x1f, {0x1, 0xec, 0x65, 0x3}}}}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="10e31d2d36535676bb7da825098300000000000000280002000000004050000684b616d2a383cad473f208da381e307b8a50cbad7f75f03e4cf38d9e265e846f6dd65417b27d07a2ba1b41a38176c67212ce90d7bf8ef31093edc55f0ed244a18b440d3d50a54a4305795ee34d61bb31d190e4c737a4aabe7bb531374581cc850faf23a15d6e43d0705bdc7e87527b27bff7caea17b41194abacce347b9c5827e1f30cf5d53bb801021951"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:44 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000000)={'IDLETIMER\x00'}, &(0x7f0000000080)=0x1e) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') clone(0x2000000, &(0x7f0000000140)="cead53d1737a35c658c5fc16b50927a4438451a35038d635435bfe97c6d3a89eb3e50c03d21271fdf387d04126e3c6e8391dbfc7bd545926d96231a65d6146fc78bef6b4d99fb515a9d12fd2b39c4b4ba64511019f68865fa80cc1d21f8f54c1a8d5d7c7e5320e49ef5eb389034f991cc92be874abefcbcef779cd344e2cb55c8be1a3d757df43e5fafa892bb367b5f66523b55e4c018c117c7b5b0c2c4ee02b3fdfb4565a3439bb311e251f4a5f8cb2297f5484d18a51e1a9ed80526ad6ea126daf78c90ba302d28bb4e239de1c61d698d318bda02a3193d0c49b1a", &(0x7f00000000c0), &(0x7f0000000240), &(0x7f0000000280)="454b3f63c7d4fbd6d0e3bda57e51856a9f4b2ac470c11142ffa3d7df3b97e00d6d21d93e6fb02fbd99db3401c01e33702af23c57442a3298a4812092b34eebf81543c98d65b84fa15cb3141811") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendfile(r0, r2, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2295.017824] binder: 31152:31157 BC_ACQUIRE_DONE node 13581 has no pending acquire request [ 2295.019199] binder: 31150:31158 got transaction with invalid data ptr [ 2295.019226] binder: 31150:31158 transaction failed 29201/-14, size 99-24 line 3316 [ 2295.019360] binder: undelivered TRANSACTION_ERROR: 29201 03:44:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0xb61c0, 0x59fb64aa0c979f70) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000040)={0xe, 0x1, 0x1, 0x46, 0x2d, "b7ce970a419808c96a20b4bff81dc0071c92d770c9ef71f671d4e02f9f17a561fec38bb2c7bd7ea1a6575af81d"}, 0x39) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2295.085343] binder: 31159:31166 got transaction with invalid offset (8527094436622885648, min 0 max 104) or object. [ 2295.101238] binder: 31159:31166 transaction failed 29201/-22, size 104-24 line 3379 [ 2295.118149] binder: undelivered TRANSACTION_ERROR: 29201 [ 2295.124694] binder: 31152:31157 got reply transaction with no transaction stack [ 2295.140797] binder: 31152:31157 transaction failed 29201/-71, size 0-0 line 3046 [ 2295.163582] binder: 31172:31174 got transaction with invalid data ptr [ 2295.163608] binder: 31172:31174 transaction failed 29201/-14, size 99-24 line 3316 [ 2295.163762] binder: undelivered TRANSACTION_ERROR: 29201 [ 2295.311789] binder: undelivered TRANSACTION_ERROR: 29189 [ 2295.327604] binder: undelivered TRANSACTION_ERROR: 29201 03:44:45 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1800008, 0x110, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@binder={0x73622a85, 0x1, 0x2}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 03:44:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x80800) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="9e", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r4, 0x0) keyctl$get_security(0x11, r4, 0x0, 0x0) r5 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r8, 0x0) r9 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r9, r8, r6) keyctl$negate(0xd, r4, 0x797, r9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:45 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3b) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) r5 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r4, r5, 0x0, 0x8, &(0x7f0000000100)='pagemap\x00'}, 0x30) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x80, 0xfa, 0x2, 0x0, 0x0, 0x9, 0x12f10, 0x2, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1801, 0x6, @perf_bp={&(0x7f0000000000), 0x5}, 0x20000, 0x1, 0x5, 0x4, 0x400, 0x1f, 0x401}, 0xffffffffffffffff, 0x1, r6, 0x8) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) timer_delete(0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000400)='./file0\x00', 0x1) ioctl$SNDRV_TIMER_IOCTL_STATUS(r2, 0x80605414, &(0x7f0000000440)=""/103) r3 = openat(r1, &(0x7f0000000000)='./file0\x00', 0x200400, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000005c0), 0x40, 0x0, &(0x7f0000000580)="eb49ba8ef30c8399897411235fcc122819a863908c5f58d209a44b2dd2c66d3e9870914f207037cf107b00000000dec98d808e1107b56ca1878d8fbe00000000"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000000000000000000000c0000000000a10e0000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendfile(r5, r6, &(0x7f00000004c0), 0x6) 03:44:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f0000000000)=0x1c, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="09631040000000000000000000000000000000001263484000f0000000000000000000000000000000000000000000000000000000000000000000000000000003feffff00"/96], 0x0, 0x0, 0x0}) [ 2295.449193] binder: 31186:31191 got transaction with out-of-order buffer fixup [ 2295.459565] binder: 31189:31194 BC_ACQUIRE_DONE node 13594 has no pending acquire request [ 2295.459575] binder: 31189:31194 got reply transaction with no transaction stack [ 2295.459584] binder: 31189:31194 transaction failed 29201/-71, size 0-4294966787 line 3046 03:44:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$int_out(r2, 0x5460, &(0x7f0000000000)) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe22, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)={{0x77359400}}) [ 2295.459728] binder: undelivered TRANSACTION_ERROR: 29201 03:44:45 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r2 = socket$inet6(0xa, 0x3, 0x2) r3 = socket(0xa, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000001a80)={{{@in6=@ipv4={[], [], @broadcast}, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@remote}}, &(0x7f0000001b80)=0xe8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'lo\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xed\x1f', r4}) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000080)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, @dev={0xfe, 0x80, [], 0xc}, @empty, 0xf5d, 0x0, 0x0, 0x200, 0xc84, 0x0, r5}) fcntl$F_GET_RW_HINT(r3, 0x40b, &(0x7f0000000440)) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f00000002c0)={@rand_addr="77d0f304a0520c95f3561ac7c1e661b5", 0x7e, r5}) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000480)={@mcast2, @mcast1, @loopback, 0x0, 0x10001, 0x0, 0x0, 0xffffffffffffb8fa, 0x83420004, r5}) r6 = open(0x0, 0x4008040, 0x0) fcntl$setlease(r6, 0x400, 0x1) r7 = syz_genetlink_get_family_id$nbd(0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x42595117194974d9}, 0xc, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4600000051a0973138da93651c72e2ec3712d0c019c3c844fe823ba3a70a3922c5c687cf7cdb26b923c5fc5ad4ed5eb2b0352326c5a84418091cffbabfe2c24b2b2f24e5c02818a2a0cd97d5e1dcd51dcf123112ab64fe7b6a24", @ANYRES16=r7, @ANYRESDEC=0x0], 0x3}, 0x1, 0x0, 0x0, 0x40091}, 0x40d8012) sendmsg$NBD_CMD_STATUS(r6, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000000}, 0x6, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, r7, 0x400, 0x70bd26, 0x25dfdbfb}, 0x14}}, 0x40801) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2c2c000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, r7, 0x200, 0x0, 0x25dfdbfd, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8001}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x8}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x8}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x1f}]}, 0x50}, 0x1, 0x0, 0x0, 0x55}, 0x800) r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000001b00)='/selinux/enforce\x00', 0x204082, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001b40)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001c80)={&(0x7f0000000000), 0xc, &(0x7f0000001c40)={&(0x7f0000001bc0)={0x70, r7, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4}, @NBD_ATTR_SOCKETS={0x2c, 0x7, [{0x8}, {0x8, 0x1, r8}, {0x8, 0x1, r9}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7fff}, @NBD_ATTR_CLIENT_FLAGS={0xc}]}, 0x70}, 0x1, 0x0, 0x0, 0x243efde8e3e62f55}, 0x80) r10 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r10) r11 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0xb09040) r12 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r12) r13 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r14 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r14) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0xa2e2cf2a807e41b2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0xb0, r7, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x4c, 0x7, [{0x8}, {0x8, 0x1, r10}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r11}, {0x8, 0x1, r12}, {0x8, 0x1, r0}, {0x8, 0x1, r13}, {0x8, 0x1, r14}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x46b30d76cc6c203e}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x24}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x40}, @NBD_ATTR_SOCKETS={0x14, 0x7, [{0x8, 0x1, r0}, {0x8, 0x1, r15}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x401}]}, 0xb0}, 0x1, 0x0, 0x0, 0x10}, 0x9) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r16 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r16) ioctl$BLKGETSIZE(r16, 0x1260, &(0x7f00000000c0)) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) [ 2295.466782] binder: 31188:31193 got transaction with invalid data ptr [ 2295.466810] binder: 31188:31193 transaction failed 29201/-14, size 99-24 line 3316 03:44:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000000c000c0fd015ee407d23a00"/23], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup3(r5, r2, 0x80000) [ 2295.466964] binder: undelivered TRANSACTION_ERROR: 29201 [ 2295.483238] binder: 31187:31192 got transaction with invalid data ptr [ 2295.483264] binder: 31187:31192 transaction failed 29201/-14, size 99-24 line 3316 [ 2295.484332] binder: undelivered TRANSACTION_ERROR: 29201 03:44:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0963104000000000000000000000e08145cd0000126348400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c29a55bebb5582000000000000000000000d00"/96], 0x0, 0x0, 0x0}) 03:44:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="11634840800000000000f5ffffff00000000000000000000000000006300000000000000180000000000000000000000400000002a238d24b62694064092ecbefe765e15500170c8c1c4ea6775c7f82ca00d2b470736262c731ccfbcfc1ad02cb6b1d31a78f3e5518f712f15ee1f3c71d3d7b09abb54cdcdf1d30dc3e85587dc38be4b98b5d962e2845bdbf3386e14a6660f256ddce477dc5741c6fd64b5675a189718ff17e6e6f9430bc0ce32b1435ac211469928b397e8d508c22536cc5d626a64d50c61511282576a93b6217d5da7492104e72e6c94fbf13a1c2c531872b674a7684adcf10aeda9ddc2b5c14b924ae5592931530be2113bd74f7a58ab0f6c6f2241a04c1c936f8e67a46bf5f7b3f97358b549bc8b55bbcf65420898568f6e55d6aec18ba6c85777bb9941f0e18436459b89b167642a01b694a53f4eed00d0f9ab26409e19c1d9061430de4cc7943f21326c9f15746286bccc6a2f70ec7207c03a29bfa5ef5e75ba1694e60aaf4279e05dd97f12a165f37ff771633e596dd7d550", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 2295.487491] binder: 31189:31196 BC_ACQUIRE_DONE node 13598 has no pending acquire request [ 2295.487502] binder: 31189:31196 got reply transaction with no transaction stack [ 2295.487510] binder: 31189:31196 transaction failed 29201/-71, size 0-4294966787 line 3046 03:44:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x800) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") write$binfmt_aout(r5, &(0x7f00000001c0)={{0xcc, 0x9, 0x7f, 0x3, 0x1be, 0xfffffeff, 0x1d9, 0x9}, "432b6dfefe8020b3ca88ef372059dd391b9a5c4d8c586be03baaa3f73ce045e091a0c7ec7846e6f6b8e283e7c8ebb14d7b9fdfbadc414e014167eefe043ae4cfb544ce175b1870069076af4804bf2d5874197e7b1cbfc9c2751fb9f86b2e73c075f20122280d1a552dfdbd49c44b855f4d12b4954ea7ef5419b040743e65bdcbcc42b77bcffa08b664504c7e4e8defc7a6c0f2095a6e3f0c61f17a42ef0e1b214f779ea600d2906264b920e6393bbb877104fd708b3798a8a14f14c420c71052a591ec8dca0f72ecdccb85c037a36e8cdff2579abc5d6ad0f61a2ab5d4eb010fcfd75e6d33a12e23e69ed25a1813b38de00b517edb49432b62f986594d9945c917ee58a3eb8981fdbfef515265dc5b00382398bef93eb8dded3f20510f44b2f3cae89e0b936292a4f21a98bd6af2678a8e87c1cdf1da9d6e45b3611ff8e931c1f4b05996a9b3baa9cf0d2808170cce8464e47a005418797f3a6c4cefc039e8c1e96d2beb4f256cd5b1d8b28888c686796f7220620c0c1375f4d87a21f6ebd3eb8832af7832a3e3f26f3e9a938d75ee571cdca453ff271cc3c6801b3ecc107603287240bdf32fbac693a335e7277d510ba5ebd86cb0ac9af6d1f9c4c9db1a40538e4c8d690aed17967c05c4071c36978bc45098dc99306dddeeedc6ecf89105e4b2a930d5e009bfbcf2ba6b066207de817eaa07e78ddff1660f051d901ea36e3f3310f46e773cc1d8c4483db51d40b45f9ef4f234bcf5f7673a0e12d15f44a0f59aa7673f295b1572694a9f62235a70cf2506cd80c0834b41ffbaf5059bab74047db55dbacd945fc05a73f39343b35345f0614a68e7d9a46af7c1d3c9358e6d12afd1e3798174cc440729a36c489e73035b45bab743bb05a88055d0ef69cea7171a365f98a9f203cb5777c0430da8394e8b68ec8cb981a4245a5e3d9fcd7145a49cebf3006c702dad3a75c920fefa69eb1ca6ee5c7dbcf22fe64d9ca1169a3dc6fda70d017acb02c8f38e428915607a8d6643e1dc11f9423047bc7a036dda0264ce7bcc67d7a2e7d12d3b6b1479e858aba4a5b28b441f1520ae6dfd5a157e282df81d5008b91e4155202feb56cbd92bdf4430807fa610e56328d80c5d7c2d9259f18a82bc442fe2d333bfcf4975cdd180e8f142239d942c0c8c94ff734d246a3fa684730121efa631dfd2140d194f39550fce33390411bfc1b9e1cd402c897d6b34480536f269d7635a491438a5918ea6364890dcb83a52b983287bb3b1fb913eecf9504e1ad55ff7c319123be1d059369fdb0351734660487eb996b92c3e692dfee4fe963f732a7432836654ac9cf5aa8817ec4719e5ef681986658a59e6bb525848923e81ea92a30899d524689c14ac381e0a1a0d8d41f6a06eb03975e84c03bf16bb147ff4ecb16fe15007795c321e4072cfcb8ef466ad5249793824efeb811ee463a6bbfee6a8c3e35424d86689ce19d18901b45414134fe5f9c7700b2db92bd29a8b6dbda76269ede0299413b957aa89671cedb10cd1c0faabc7db7bb2832a19c7222c5c501ec6f79a627b2ba5e8eaae6b01e01255b636fc6233b1878e6d65043dab75c5ea830af696ea81e1e91b60267dc12be9d111726c1b737d4686294e9d87ba37cdacbc03238a9e0e21cbb644b97911d165175fb2b91faee756d5d6ebfd96d1e5d206bbbc724dda6d8084598e494de670e4de2235064c9ce319aea47c6c916dbce529f691bdf3ad28cde917981300d6f9869313f8d9883ff20fb32ee397b7b30c1059996e61b2bee1ae36d86baba274952419470fad811d78be00ce0933733b3bbca1a0221b6978328eda07280d40e062ad2dccf55f856bbe152c877627d304ccb71c08a2916e0e28eb9894fd0daeab85afeeee1fe4f04e03967787d376f13ebed4833a0c2c0e24af33275629dda40b41417dff8bc352afe1a4599e053bb7241f226875e622532d0ddc67d29de683e4bc5b29125c16531218143adaa6e2e2c1f10ebd05d141b591404ec76f1a90c0254e63d939500397d7c27961723ab8ba9a007897f631c6c638fd21abe4a51f369ae3a594c09c89b27a63eaebb8a294803f4f4748386c493ff22d72c0e5ec0c4849a80e9fac1e0c70a4a9b90cd611e9611aab597e562c0b1569104b46530ae7e82bfa6d59d853051adefd4adc35bd6942e2e8bf984bca76022db96e6989e6f57b8c212b24bb2787a5c35eeee03350ba4bc1caf5513665cb84ed07d3c265a58141e0910eadbd7652cae4f675ee57aab8212ea071605ed06feb69aa35b4b8faa2417f332481d583866433149ab4453b8c83600928ea41e2e0e82a156b7373708f3c6b793335b75adfeac4383a9693a43872f1a163be93ff3c3fe826d16be4640dfecf73fddf7eff7c09900cf2d2f188e2b2ec829f82a030eb66120368614b20a5b99aad562ecef393f977c08b8e11e9e2cbac60cd299eb63274345b4c064bde1f55ab282159bba488bdbc38b49b0e8274c6801655cba3cfa8ab7ec67470508f8bfa3380c3b9300f4cb9fcc0e5213250a0b8cefd0129154aa0df885f81a46b7f0a4fb2c6c6e2ce511612e5476812e5f5776338724a22b5781b35cd9148057946509045485e084a10ed0a76fdbb02a5fd5c344ef1eaa81c1e2811ab932d4d59034c2db653b9b9700b518d6428aa04beeb6dde7d3bd5c5a4f0edfe96c1efa2dc537c6ce50e37f4dfa1684ca74042f2e99a43930923953bd748c9ed13afd0ce93a053e3f7a09052dd77f08a437e9e593f5a554cbca4f637ebaa0ea1b8c43349fcce2dedf42eff9e0e64839b47b65d076786d7cad8bc15cb14f046c00654275e2cf86cc6870789df85b50a458d489527ac2ec1e146bae6272afc5a19fe0bff23b69e429915e3f08e1ba766806ef827e6aa084a25fbac17b9eaf7d684b71e6bcac751863a9b7392c1c69efc1b43734a3a46ffff499ff90fff4e1890083f58074dfff13dc10c4711f740c2e9c0de879d1e1662a86b3c9fc7b4355625571ac2430f0c8ce5872fbb4ac2fb2139070ef66f630ac2452f1576eb0483e60e7e46d29134eab467f900a95f90ed2b96b05c85a223f2979e3e37db5f6e5aab2555537a02a7986adb242518d052b22a13ade4889d28784bc282836901ef224d63593578335653e19cd57fe125ccbb710f41b65279798588518df71c184181ee4cadb1b229d078f7c243430cf2cc26f4db0af941eabb03646b5e68ebc61ddfc2f5f26c5fb47a8bb92c915444996426a706eb25f1def1ab98512f1cb56591be070d7983d659720750c1e5d351dbe5ac7ef04e4542ad7db3a91c329a699c3178f9133176907996196655ab72c153caa3d6d54d41f3f316d073b8bdd76112b5c7e96d688653f7eeaea15ddcebff58f7c4810f221700e4755fac45b48531e5600c9c01c166909adae31412f8f6dc58ba569af9f3c5afe5762962189f6c4bcb150908616442a58a1b6a4227e48795e4aa7e48b69c530f7ca8a4f59f291610c0ec71db3bbf4011d6f72cc57979d53d2372fa73dac881df7cf241c1c01a1054a7c9bda870a503a6f556cc01f5379b2f11f8e2e93af3edf3a5136abb8bcc66d947ca15efe1eebaca0f7d5b574862fef93da394cf4c38710ab8f3d5e105e9354b7c850f3448beaf593adabfd886455e1b5473f541a2542fe1dec1f9df1a9aa1e81df0d6f33ff7a26da1d9762070a43a244922e6833ea0790cb726c4da479c6558e87dc7fdf0d3594116aab5120dcea1c8ef2d5c2e6adb60ae39a2f6f8c7588903b942ee9b06c64083caabc7e6e7e12818f3abff09b74434b1cae1dae35db1f105dba7d2e7a3384ccdfde468672324e77d420cd8f2c840ecdfc3a17d13ae64834e4a1900a3a0d15f961f89358a7ccee561d3bb0eaae34ab5b075e0b972f58fefc142a65809f2219b131467a6a9bac1c370e594f55359cc2aa5c9e7ed6b3f2d12fb9d6ba3083f8e6ef09b3d7d45e0b0e4372bfaf4289dc57758f288c91ed9cccc00e860f1f82982b1a5600cd571b685cb5b1737f71e76ff1129d2c06311667e62765dd66241ef530759b156b8bc235ea694b544e4b2fe38388d28a53ee17ed88f004228e4dc75aa002e8643e0f16c9ce0ffbd0e24cde816c53832c24306422984075aae3469a7eeb2b92141f2b8dd9aaa64e865c0dfe94b09ed017d54e419824ac4496ba5123b2dd4ae47e3472f8fd07245cf7f7ea835e52c3fe3cd582125fb85f9330af5455a4f93e3cd7142dbef9964db460f9b10c5b8d1430c7e367b3f0200cac1e0570f6c4ada508b59f5cc6aeb6b487b994151fdb7d080893dcabe49260c8e86ee9d57b79b71b5c1332a154fc7c3f6a51bb459a5929eea9940321c6ff6c1a4249dd530e7ddd74d4f1f4e4297ae09ef72e3d4cbc0aa622d97a2cd968bc7d97225d5e067c479a5067f9ec1584802ad736f3fc09d35dd46ac6c1b1244888a38ee5eca33c5a1b802480a83fc87447dd2cda4d6f83114e7b5b8215c24e6daa2e85c84cc436d8b986f0013f19bca4ca045d97b4ff0d7bed7cf917b1a200d537f83c854bf5800d78cb8abc7789dc58853a693e730eee4b3b4398cd40cbe8fcbf4285ac2977c6e7c8f2643ea98e065efc6c474278f385f21bafdcd86c46a0a33789c1d1d35aaa1d7063c9beed3641d5d671bf376c0e90f53a0fba531653c537d5cf047f04e80e58a4985ce65f2a5ede230a44e9a5ee06597a37b35563f46d87ad2150d10a5bf542a0429bd74cecbafeb545894603247b97a9d8e4d2e099143d1876f4c96cbecc6ec5bbd76953e4b88574e37be061b283934ef1e6eee6d0901855bfe4adf1248ff2ca3cde2eae961f2f56dc164e853f3d18b1810f5d1d4a1d553117dba2d95cf21b3c68c15c5f7ceda6ba5fd00937cebb96c9dc241c077030248ae17a2afde91df2ac63080e734d6436cf914380c397156380f19e051055a1b9e1854e8bccc0d648fb3e3c0cfb4fd2b2babf4e569e764658441c859052d9f238f74cd1e225cf9e04dd3741e0e787d48a5dedd8582de1594ede1f33d1943b77e9fa72c655e1bd3243c284f43897994cb23f0a1c0c66ef6b6cab789689cbd13cae96829d8598fa43ab52b8749a7991a3672dead5c1cabb5840cfc47363caa490ab2eb1f1974b742b40354ee19a624d5fb2f3dd0ebe5d81de97ebddc47b35ffc94af63ddbeaca372e0d5a5a4e0a2188358c94951a365946ced92cb8e66221c06d0e9b611e601be83dbae62665f151f1639845d00ef9d01608fcc16f424b7928d5aa1451823d573e3af3211a341e082cf4b04f52286e2707bc7bc71739c9cfa785ecda4e7720340fe120f3b5824644d8c9e9870e5f8bfb5fd224c446c051df39bd8cd130879b2ac54f0fef441dc4ba1f7ebc3d44d496e1233b8b71d64ef392f86d0c828a63144dbdeec21a68cbab6b60840d1463b13964dff86d976b4234f480860c04c4a645742dd7246f1fa73017c230390addc506792efc5f4b3f80d0e11a34eaf0efbcb91c74d8d8a48973609a1c8a771cddf95da5ec79654fffa207ee27753581f84c03966bda732038c413a584ddfc554b2771c8d09098451dbfb1fe9f1fd2bde56624924e897f1bc890235edccf224414a71194977fd793caf9468a663e8c0f3a997bb8ac74deb8a8c8962031be4a8d9041e3efdad179e518091afea8455a6023f02992a6fa86a8a535d86fdec6dcb8f08d0c5f6118a2b1f3129f80623e0af162b128d8fd7b1e8d95931fcebce067ecb139bf59d66c18dc03601534ea33f99db77fc27fff25d7fe89d4c230f72f2cadc61b36bb63217fb3b87ddc010d2", [[], [], [], []]}, 0x1420) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0xffffffc0}}}], 0x0, 0x0, 0x0}) [ 2295.487779] binder: undelivered TRANSACTION_ERROR: 29201 [ 2295.620197] binder: 31203:31206 transaction failed 29201/-28, size 4294966818-24 line 3284 [ 2295.620418] binder: undelivered TRANSACTION_ERROR: 29201 [ 2295.623774] binder: 31203:31207 transaction failed 29201/-28, size 4294966818-24 line 3284 [ 2295.624046] binder: undelivered TRANSACTION_ERROR: 29201 [ 2295.681811] binder: 31201:31210 BC_ACQUIRE_DONE node 13603 has no pending acquire request [ 2295.681822] binder: 31201:31210 got reply transaction with no transaction stack [ 2295.681831] binder: 31201:31210 transaction failed 29201/-71, size 0-0 line 3046 [ 2295.745833] binder: undelivered TRANSACTION_ERROR: 29201 [ 2295.756218] binder: 31211:31214 got transaction with invalid data ptr [ 2295.756249] binder: 31211:31214 transaction failed 29201/-14, size 99-24 line 3316 [ 2295.760500] binder: undelivered TRANSACTION_ERROR: 29201 [ 2295.831556] binder: 31219:31221 got transaction to invalid handle [ 2295.831566] binder: 31219:31221 transaction failed 29201/-22, size 24-274877906944 line 3138 [ 2295.831705] binder: undelivered TRANSACTION_ERROR: 29201 [ 2295.884266] binder: 31220:31228 BC_ACQUIRE_DONE u0000000000000000 node 13613 cookie mismatch 0000cd4581e00000 != 0000000000000000 [ 2295.884278] binder: 31220:31228 got reply transaction with no transaction stack [ 2295.884287] binder: 31220:31228 transaction failed 29201/-71, size 0--4731705675468505088 line 3046 [ 2295.948590] binder_alloc: 31222: binder_alloc_buf, no vma [ 2295.948609] binder: 31222:31224 transaction failed 29189/-3, size 0-24 line 3284 [ 2295.948980] binder: undelivered TRANSACTION_ERROR: 29189 [ 2295.949243] binder: undelivered TRANSACTION_ERROR: 29201 [ 2296.117977] binder: 31186:31191 transaction failed 29201/-22, size 104-24 line 3525 03:44:46 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000000000042f37acb0000500000010000f804d5bc1af0fae972780000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:46 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) write$apparmor_exec(r0, &(0x7f0000000100)={'stack ', 'hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00'}, 0x21) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) [ 2296.128642] binder: undelivered TRANSACTION_ERROR: 29201 [ 2296.158888] binder: 31234:31237 got transaction with invalid offset (223728927637504, min 40 max 104) or object. [ 2296.171428] binder: 31234:31237 transaction failed 29201/-22, size 104-24 line 3379 [ 2296.181636] binder: undelivered TRANSACTION_ERROR: 29201 [ 2296.189024] binder: 31234:31238 got transaction with invalid offset (223728927637504, min 40 max 104) or object. [ 2296.200525] binder: 31234:31238 transaction failed 29201/-22, size 104-24 line 3379 [ 2296.210030] binder: undelivered TRANSACTION_ERROR: 29201 03:44:49 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") pread64(r5, &(0x7f0000000080)=""/114, 0x72, 0x0) sendfile(r0, r2, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcb6, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair(0xa, 0x5fb28c8c87a296d2, 0x9, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000100)=0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r4) ioctl$INOTIFY_IOC_SETNEXTWD(r4, 0x40044900, 0x3f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="0000000000800000"], 0x0, 0x0, 0x0}) 03:44:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=ANY=[], 0xffffffffffffff9f, 0x0, 0x0}) 03:44:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) perf_event_open$cgroup(&(0x7f0000000100)={0x4, 0x70, 0x81, 0x1, 0xb2, 0x5b, 0x0, 0x8000, 0x20081, 0x8, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x81, 0x7, @perf_config_ext={0x5, 0x7}, 0x2, 0x101, 0x1, 0x0, 0x3, 0xffff, 0x1f}, r1, 0xb, r2, 0x39f23112e1e41a9e) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$sock_inet_SIOCGIFADDR(0xffffffffffffffff, 0x8915, &(0x7f00000000c0)={'ip6_vti0\x00', {0x2, 0x4e21, @broadcast}}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) socketpair(0x0, 0x4, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000500)='/selinux/status\x00', 0x0, 0x0) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000580)={0x0, &(0x7f0000000540)}, 0x10) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_IP_IPSEC_POLICY(r5, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@initdev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000240)=0x83795b6c6c94186a) setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000380)={{{@in=@local, @in=@local, 0x4e24, 0x0, 0x4e22, 0xfff9, 0x2, 0x80, 0x80, 0x87, r2, r6}, {0x77d5, 0x81, 0x3, 0x81, 0xff, 0xffffffff00000000, 0x200}, {0x7f8000000, 0xfff, 0x20, 0x5d4}, 0x6, 0x6e6bbc, 0x1, 0x0, 0x1, 0x2}, {{@in6=@mcast1, 0x4d3, 0x2b}, 0xe, @in=@loopback, 0x3504, 0x4, 0x3, 0x80, 0x7, 0xd2b2, 0xff}}, 0xe8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0963104000000000000000000000000000000000126348400000000000000000000000000000000000000000000000000000000000f17c3c69000000000000000000000010070000000000000000000000000000000000000000000000180000"], 0x0, 0x0, 0x0}) r9 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r9) r10 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r10, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r10, 0x5411, &(0x7f00000002c0)) syz_open_pts(r9, 0x2) 03:44:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x200, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f00000001c0)={0x29, 0x3, 0x0, {0x137eaea8, 0x8, 0x0, 'vmnet1/&'}}, 0x29) seccomp(0x1, 0x1, &(0x7f00000000c0)={0x4, &(0x7f0000000040)=[{0x0, 0x81, 0x8, 0xdf}, {0x3, 0x0, 0x3, 0x7985}, {0xfff, 0x5, 0x3, 0x5}, {0x7, 0xec, 0x1, 0x1}]}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000700000094d38cad8495d6480d1a984631fcedf23a9ea5f1bb9c7501bea75eac0489be0dce92ec1e8335332e"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r3, &(0x7f00000004c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x1b0, r4, 0x20, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x160, 0x4, [@TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6f47}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4a7fab68}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffd1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xda0}]}]}, @TIPC_NLA_NET={0x3c, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xe7}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1974b193}]}]}, 0x1b0}, 0x1, 0x0, 0x0, 0x8000}, 0x8080) 03:44:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000300000000000000000000000000000000000000000000000000852a687700000000000000000000001500a3119f401e0000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000000c0)={0x0, 0x0, 0x2, 0x0, [], [{0x921b, 0xffff, 0x81, 0x0, 0xaa0f, 0x3}, {0x3, 0x4, 0x7ff, 0x3f, 0x2, 0x6}], [[], []]}) [ 2299.785721] binder_alloc: 31403: binder_alloc_buf size 140737488355456 failed, no address space [ 2299.789447] binder: 31401:31409 BC_ACQUIRE_DONE node 13625 has no pending acquire request 03:44:49 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20000, 0x108) getdents(r4, &(0x7f0000000080)=""/209, 0xd1) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2299.789456] binder: 31401:31409 got reply transaction with no transaction stack 03:44:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x40000, 0x0) openat$cgroup_type(r1, &(0x7f00000000c0)='cgroup.type\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000000d15d1134c6953bf6580627cc26f200000000002800"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:49 executing program 5: socket$inet6(0xa, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) socket$inet6(0xa, 0x5d46d03e6f1a01f4, 0xbe) ioctl$BLKRRPART(r3, 0x125f, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r5) ioctl$BLKTRACESTART(r5, 0x1274, 0x0) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r7 = accept4(r0, &(0x7f0000000140)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast2}}, &(0x7f00000001c0)=0x80, 0x800) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendfile(r7, r8, &(0x7f0000000040)=0x40100060, 0x5966) r9 = perf_event_open$cgroup(&(0x7f0000000080)={0x3, 0x70, 0x8, 0x56, 0xc3, 0x8, 0x0, 0xf, 0x40, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x40, 0x0, @perf_bp={&(0x7f0000000000), 0x4}, 0x4000, 0x7, 0x7, 0x2, 0x5, 0xffff}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_aout(r9, &(0x7f0000000480)={{0x10b, 0x4, 0x2, 0x342, 0x3dc, 0xfff, 0xdb, 0x8}, "7fc11f798214669c654a696ab06a78266554c986790374f93642247e94c7ea2244316841846f50d133532059ddb98323cf2015d74ebd2a61b3b6771f9e233998f5be88036b66c7c69ae2346b83c1eaf94de253d593b113c21a4ceb2240dab7c65ba9483f02a5fb2760e7756a073c2a10e5186a4d8a36bb7f", [[], [], [], [], []]}, 0x598) [ 2299.789464] binder: 31401:31409 transaction failed 29201/-71, size 0-0 line 3046 [ 2299.789607] binder: undelivered TRANSACTION_ERROR: 29201 03:44:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) [ 2299.794187] binder_alloc: 31399: binder_alloc_buf size -816 failed, no address space [ 2299.794194] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2299.794210] binder: 31399:31410 transaction failed 29201/-28, size -842-24 line 3284 [ 2299.794342] binder: undelivered TRANSACTION_ERROR: 29201 [ 2299.854164] binder: 31416:31418 BC_ACQUIRE_DONE node 13632 has no pending acquire request [ 2299.854175] binder: 31416:31418 got reply transaction with no transaction stack [ 2299.854184] binder: 31416:31418 transaction failed 29201/-71, size 105-7765300871168 line 3046 [ 2299.855203] binder: undelivered TRANSACTION_ERROR: 29201 [ 2299.900665] binder: 31425:31430 got transaction with out-of-order buffer fixup [ 2299.900690] binder: 31425:31430 transaction failed 29201/-22, size 104-24 line 3525 [ 2299.900816] binder: undelivered TRANSACTION_ERROR: 29201 [ 2299.903985] binder: 31427:31431 BC_ACQUIRE_DONE node 13636 has no pending acquire request [ 2299.903994] binder: 31427:31431 got reply transaction with no transaction stack [ 2299.904001] binder: 31427:31431 transaction failed 29201/-71, size 0-0 line 3046 [ 2299.904260] binder: undelivered TRANSACTION_ERROR: 29201 [ 2299.909622] binder: 31425:31434 got transaction with out-of-order buffer fixup [ 2299.909659] binder: 31425:31434 transaction failed 29201/-22, size 104-24 line 3525 [ 2299.910478] binder: undelivered TRANSACTION_ERROR: 29201 [ 2299.926578] binder_alloc: 31429: binder_alloc_buf, no vma [ 2299.926596] binder: 31429:31432 transaction failed 29189/-3, size 99-24 line 3284 [ 2299.970806] binder: undelivered TRANSACTION_ERROR: 29189 [ 2299.993781] binder_alloc: 31429: binder_alloc_buf, no vma [ 2299.993801] binder: 31429:31432 transaction failed 29189/-3, size 99-24 line 3284 [ 2300.001513] binder: 31443:31447 got transaction with invalid offset (-4164684660774797312, min 0 max 104) or object. [ 2300.001806] binder: 31443:31447 transaction failed 29201/-22, size 104-24 line 3379 [ 2300.002040] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.003153] binder: 31442:31446 BC_ACQUIRE_DONE node 13644 has no pending acquire request [ 2300.003162] binder: 31442:31446 got reply transaction with no transaction stack [ 2300.003171] binder: 31442:31446 transaction failed 29201/-71, size 0-0 line 3046 [ 2300.003328] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.017335] binder: 31443:31450 got transaction with invalid offset (-4164684660774797312, min 0 max 104) or object. [ 2300.017365] binder: 31443:31450 transaction failed 29201/-22, size 104-24 line 3379 [ 2300.017633] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.025928] binder: undelivered TRANSACTION_ERROR: 29189 [ 2300.342597] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 03:44:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000000)={0x200, 0x4}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) pidfd_open(r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000100)=[@release], 0x0, 0x0, 0x0}) [ 2300.351481] binder: 31403:31406 transaction failed 29201/-28, size 99-24 line 3284 [ 2300.361136] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.385755] binder: 31464:31466 got transaction with invalid data ptr [ 2300.394403] binder: 31464:31466 transaction failed 29201/-14, size 99-24 line 3316 [ 2300.403040] binder: undelivered TRANSACTION_ERROR: 29201 03:44:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0xff, 0x0, 0x0, 0x0, 0x3, 0x92502d20665413c5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$TCSETXW(r0, 0x5435, &(0x7f00000000c0)={0xfc8e, 0x0, [0x1000, 0x928e, 0xfffe, 0x1, 0xa0d], 0x8}) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9, 0x81}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = fcntl$dupfd(r1, 0x203, r0) ioctl$TCSBRK(r2, 0x5409, 0xb0b4) r3 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="9e", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r3, 0x0) keyctl$get_security(0x11, r3, 0x0, 0x0) r4 = add_key(&(0x7f0000000180)='logon\x00', &(0x7f00000001c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, 0x0, &(0x7f0000000200)=@chain={'key_or_keyring:', r4, ':chain\x00'}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x26}}, 0x10) inotify_init1(0x1000) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x3, 0x6, 0x7fff, 0x8001, 0x20, 0x1, 0x6, [], r2, r3, 0x2, 0x4}, 0x3c) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) getresgid(&(0x7f00000001c0), &(0x7f0000000240), &(0x7f0000000340)=0x0) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000000380)={0x90, 0x0, 0x3, {0x0, 0x3, 0x9, 0xfffffffffffffffd, 0x88b, 0x3, {0x0, 0x8, 0xfffffffffffffff9, 0x9, 0x5, 0x10001, 0x0, 0x2, 0x1, 0x400, 0x8, r6, r7, 0x4, 0x6}}}, 0x90) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r4, 0x28, &(0x7f0000000040)}, 0x10) r8 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r8, 0x40046207, 0x0) r9 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:50 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) r4 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mmap$perf(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000009, 0x40010, r1, 0x0) openat$cgroup_procs(r4, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) getsockopt$netlink(r4, 0x10e, 0x8, &(0x7f0000000080)=""/240, &(0x7f0000000000)=0xf0) 03:44:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 03:44:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup(r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f00000000c0)={0x17, 0x38, &(0x7f0000000000)="733249d5c3bd2fdf2764ad42d70a682793176a6c4e9a4c89dbf52c3a612ab1d78a1b05b88228d0de54559c938325a2c8299db15b53feec15"}) 03:44:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0963104000000000000000000000000000000000126348400000000000ad00000000000000000000b10cfe1fe9ef5331747c3400"/96], 0x0, 0x0, 0x0}) 03:44:50 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_AIE_OFF(r4, 0x7002) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x3) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) r5 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) getdents64(r5, &(0x7f0000000240)=""/221, 0xdd) fchdir(0xffffffffffffffff) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000080)=""/104, &(0x7f0000000000)=0x68) 03:44:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x333, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) ioctl$EVIOCGABS20(r3, 0x80184560, &(0x7f0000000000)=""/29) [ 2300.450020] binder: 31472:31476 got transaction with out-of-order buffer fixup [ 2300.459613] binder: 31474:31478 BC_ACQUIRE_DONE node 13655 has no pending acquire request [ 2300.459623] binder: 31474:31478 got reply transaction with no transaction stack [ 2300.459631] binder: 31474:31478 transaction failed 29201/-71, size 0-0 line 3046 [ 2300.459901] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.467601] binder: 31477:31482 got transaction with invalid data ptr 03:44:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) arch_prctl$ARCH_SET_GS(0x1001, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r4, 0xab4d6b1e9a6d172e, 0x70bd29, 0x25dfdbff, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @l2={'ib', 0x3a, 'veth0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0963104000000000efd66daa00000000000000001063484000000000000000000000000000000000000000000000000000000000000000000000000000000000003661f5b48cb3aaa000000000000000000000000000000000000080000000"], 0x0, 0x0, 0x0}) 03:44:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 2300.467629] binder: 31477:31482 transaction failed 29201/-14, size 99-24 line 3316 [ 2300.467952] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.541489] binder: 31493:31496 BC_ACQUIRE_DONE node 13660 has no pending acquire request 03:44:50 executing program 5: r0 = socket$inet6(0xa, 0x800, 0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2300.541498] binder: 31493:31496 got reply transaction with no transaction stack [ 2300.541506] binder: 31493:31496 transaction failed 29201/-71, size 0-0 line 3046 [ 2300.541658] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.542561] binder: 31492:31494 unknown command 0 [ 2300.542568] binder: 31492:31494 ioctl c0306201 200002c0 returned -22 03:44:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x2) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000008062030000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000180)) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000630000000000000018000000000000008000000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="09631040000000000000000000000000000000004000000000000000b2030000000000000000ee0000000000004ab7b9000000000000000000000000000000000000000000000000000000000000000000000200"/96], 0x0, 0x0, 0x0}) [ 2300.655534] binder: 31504:31508 BC_ACQUIRE_DONE uaa6dd6ef00000000 no match [ 2300.655541] binder: 31504:31508 unknown command 1078485776 [ 2300.655548] binder: 31504:31508 ioctl c0306201 20000280 returned -22 [ 2300.729957] binder: 31472:31476 transaction failed 29201/-22, size 104-24 line 3525 [ 2300.753585] binder: 31528:31530 got transaction with invalid data ptr [ 2300.753614] binder: 31528:31530 transaction failed 29201/-14, size 866-24 line 3316 [ 2300.753757] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.757459] binder: 31531:31533 BC_ACQUIRE_DONE node 13667 has no pending acquire request [ 2300.757466] binder: 31531:31533 unknown command 64 [ 2300.757473] binder: 31531:31533 ioctl c0306201 20000280 returned -22 [ 2300.762829] binder: 31529:31534 got transaction with invalid data ptr [ 2300.762857] binder: 31529:31534 transaction failed 29201/-14, size 99-24 line 3316 [ 2300.763013] binder: undelivered TRANSACTION_ERROR: 29201 03:44:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a6877000000000000000000000000000000000000000028b780a783e7361183c6ee18900edf18f01be9298c323e56d8ff427549056a6dd10f775f8181ebfaf3ec494b9d6297f53286d922a3caac4568c54579b76439987c92983609719a82099098597603664210e9d5b22fbe270b6b84a60b60514b07d4d175dc808b462857e76bc66b934987c6d53f80e46e1d34ebc8f6e6bb620572bec2e0773deae54a676cdd6e7d9d116f7bddb8e0dd6bed1e"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000028000000000000005000000000800000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) timer_create(0x7, &(0x7f0000000040)={0x0, 0x37, 0x2, @thr={&(0x7f0000000400)="4e7955818f626e8f693bc0dac4d3fac3b247c33fd3e1dcdff25e598c8d28d930858b3083bb09ba8ea01f4e64c2ca16bdbbcb38e4db773cdfde4f6ff093aee2230d7a903a91749598f2ec63c24c592d4c37467aef72b21f89a6478eed19d06c6923c7df156367d200445fc905c371143d11f2a0e9fd18878c400fdcde545087e5f56bae65f7ed7510662601637c3edf69db20fcb5a30b21d5c3e40e7136a1eb3af6f1a2f02abb87173f0fc5be226e38012c2eec83efc115bd755e526435a46cc09ef7864eeabda4e92e6fa12147229ecbb399fb6f3f615cc03251479d7e23a92bc7f5c0418cc7b026653128366bf91bbf1e51d6c9690f644ee50d6742d84e9aacd524772d965ae3eec3e2f2f5564d4cb8cd06680df1ae511b2303ffecc2fe4242f8bf81010d6c03bca493aefe6f78ad9279a56634943e577ac59e46c339c2c8bb68f3eefe4e131a021a906eb26ad0f748e4b2056f652d198152cd889c6117ca7d35e667c5f3e5fe31c4403c26b0b55ee66ec860df9454551f32c1021c98776adb519df923b7a52c7bb021cc97dda7cbbce80ee80be3e99d1136511c2aeab8e120e64acf6ea3ed0b8c857e51d68927834c0b6cbeceb3f7a9248ef4affcfabe7c83a0dc2c44a61cf7d94895646788b25a8af639c36eca01dab81ff13d353933416ce30ae710078148af8994b0b511ce75e32e4f5aeaae67b57116813b9af179a6f364a5e41de8756250ed23dca2e90eb4f5d171b3b861a2e6671b9961a4a4ba0f40099d82b6b3dcb36a1d59b7c23d49733e3bb4e0a7407561ec3f7bb3991063725fda65c29c32394485c7119c33e24c9c83d46a81c783b7160ba7c32ed32fd76945c23a3394d2d4bd82bc12a84c705bdb7cc5f9263ba7cfc4f18f1dcdc94f8ae6e3729f4b1ce94ee3f53f8126c4e7ae3525a78982d59af4850bca1f125f46c0cad83778487a7f78818ffd9a1369831805186760394221c277b2d4146b6aa7f591a614eb81213586f7ed8457f9726d0efb8e7641c52a5d2da837e82574b8b80f984ff6a49fbb5b3f1140de2054ba74199d1c8de0c08b1b28570c939805e656fd086bd4d14084a5357ff481dc3f5d082a7bd3215128d4dffe32d7ae4088114756ce52ec57c09d76058c14d7bdbba8c74386c2d9040cc117109ce6bb65f735e6e7743a34fbf56d6ff19bc61d68b11f922b2390b0b02f2bab97882a922e5474827cf872a84b97182167a5d9ee9ab984207c8f364c2a47254223efe086bcff6a4ab29ed33b46fa34a7aa8c69843e1c3d42fc1d6089d8d3e05b41c9a89485456087af699d189588d0e8b4f69f9b38d17c2f3d08ae8b3ce7aea798fad35d853774814d963affcf262c271ff43bf2103a1c2005dcff6f74cb16768aa62aaf867491ead7ea4c2b6f657cd089a95858b4bc525f83cb805edeb082a4f9504892fb4b3f73553984675c4f637827b5dd8ae46f8e0ed94914d8939ff47c4f5a0de930d93a1c84ae1baf4e96cef0d6d77b6d12a710c4a1e0c58bb0c58a9e50bdac0615f2f4dc09af69cdc115144360bf267a6b1a09045bcba38a8fe6a4d42462b2475902a299391e883695ce17a00de7754e6fd13e823671cae45c04f8bb08cfc1734f3f5e3f30bd99d4cfe0fb01f68e0c393d7e3db3bdf1d9871cee3ba90896cce438d82da1b45bf8c64b740619a0c690b930b927ac24333e089a5c0c88ffc09d62c90c01539882cae9bed1b982641bb6e605d2a7d05cca5b33260bcdfcec118459c0da89a607e84e9fbb91b464597fe5acd54b5b4020fd91d6ae45ff70559574776b1402122a5c03f8a75830fb25884ee2a564ce58786ea1e4a19f7026f0d989f1f54f16849f805d0059b5d47a743cde64e2a346491713245d7479f3fc980dc0a0e2cb601f5cf1d7692a6b21cab0919ccd5bcf670d7a263d4a8d4c303d9a6c53bf7f5270060dc6a075ca138bd95318e48e86b70acd140c40d95e69ae16d3e596b6d681189450885e21a4f97bfd481da67f2ff806a1c5f3979de190f80c9edd49723173652428f825d57d8a5d2c44cfb43496576b58c4450ca9f577209ea1ca59bf0ea43ba3a596db899fb37e732dd8af371b4e2d7ee3cfcff531e414dd7245a173e66f1c5a6e2f06a22e5ab277895695c276fe1c86c4677226729becf52e02136bf135d20ba9be16265e7f2eb466f430ad49e8433f1bd8e73fe05500c8f5f9e5d31a1ae61cefb36e700acdc7901a2bcc992c11701c609eefd2cb702c5f219eec64d9748d1e33643f94c2f0497da5f066755d342be3ebdd4fb51aad0f1a1bf92398189a43bd47fe8d9a99f1c558f278f6382f0e60494f219f3315be90db3360021567c1d38f7b2fbb8e6f2d5984ed4e52a95de645ba7415140ee72f98cbbbf523bc7224d40f502ec058b3f5d359ccc557b58c3a77c0efcb82b4bb215e818ff7160d3739f0a4774c7ba1770d182d851718c8914c267215707b378d986f8643ef4cff76798d5d3b7ca39ed62de60a6b7f7fdff22323da4c48b722906a03bb0d563acd9ba39fd1e2bc2ebe9b79b58cbcbfbc432418e2f63ee7c6b1836a072d750457fab94a3cdcc2e6c2a6109ad765e3ace0eaa6c1eb42e64be7947bd7cab3a19e858d74b6b87704ae3dab6380d585de064bc2b035b4ad1cc43bedd9c2619f121967d2896047553feed5f60e4aa935a369dcc9fde7f3bc2ce8e32e390917b5327b69ec874692ffcaad22f9e8e939041812c5e4b8ae0aeba39f8d2f076229f192aeef3574be06a2ab4b7f3f7909f9495d57c27e8cd9324f358e794ea5e4326ec51f85d707fc40848790414dc847fbb29a73869dc4420605b0b725d90a2623eb121ccdee49a9e077fb739220310996b7a3ea6e7bf77d1b5250d21a842fce3a85e7b5f1b05257484bd2721d35acee96488ac18bd12506fb6316ee652335bb175757157fcae860bc888d1a71666402de3506243c7349e6c81fab92dbf48a24774aaa8520c65ac21c5a72eced15ef2e4f54093761fb8b903c7cdf76d5b04650750388f2713cf782405e6b33eb996d0777c89443c7b0bacca0632e262eb64b0e129f2e893df6e4e303e26f9a59eefc009a32e1ff1595fef862f39db97fee6914485aa304779f5945cd3e50e233502051e0cfe1f9234d6aa0a1f17ffb019aed8924154281efda19cf96794dc328133f6a3c25e7bc57b4e6674690a626c3560b59222f139c89ed5e97d281346b45950763ab113a65c52bd58f64558d10827a4fcad451acc7a6e19fcc8c6c81102ace7a0328064a3f6a7deaca1838165527d8570b70263fa1cfc20a16aa72b09290dd304de99d6e6fdd10160fd2d2f80852ffffd48922255223b2edd643039c4e31b121702fe3c92a6413ea7d9d68a2290f7e80f2ea5caa4405fd9e2b621e390d35712afcdc32c344369655da797f4631e46f047435eccceb3e80faf6a8624af0cd3f502374f64c0f74e3b7cf25ea2d572fd5c6c7b43bd1668c894cb66f67a2db65e36e3e9a2760eec627d40df2ea038bcf0d1381f0f2e948cbacadb2f5e1e055f10fe497bec87e1e4aecc20c8cc26231f1621d57206fa150a9dffa7967103dc91fab3f445d3a41d981419c69837521c29a4cf730553dbf2a9a3ae9db310fa10d4ffc83491332a96f4533bad21bc2fafb5fcfb2ad72ee25cf17727a2b4e9fc857a3ef2052be0a9ac53e9404111b5a2ad66c9b035439fcba3c5e27baf786cd458a288308958c2d0c93ce1b2f082993d5b7d360805bf61798badab66b32c86fdac05fbc6d163a751e35162b039a8f790d9f306a2d41533347420f1ef61263079ab7984971e2aa3b11085f8766c31654f525e55764c86e1f7b6dd5cea6d32997d71a6d1e03151bbe723362181a88334ede788cac34e4412219d22bbeaa156c5e1def243d158a4a8435b0f985794e1523070f0b3d1ef737ed51bc152ed0c5eefc5dbc1fee62b78a016eb6e6a7d75d6c05cabdb788c0889f003fb878db866aa8d3575513bb9ed7003636e27705da8bcdb10aa2a73d85a85e56b3994a5f02514b6985220e9f3aefd259aa7d84fddac0bbf5c58badae484282d2a723b39d2cd79350c56f6b73ffaf6574617f6734b61e4c14ddc804784ddde739f4b3756ee7bc74aba400854e63a86240560338c580836adfc50198b6c8dd3c7a16eef82141ad0d3f0b9d7c61b816dfc2a32552262dc8e45b0fecb7971dfb05cf8d35bb4d5eaac6b2a326d706c893ab3749df80bf4c433cccc1e699ed11ed72c503783000437ca66d5b13eab6a8101605674f6881982395b290015e29b14a7616707331f47b22b16014d44e5c6193ee83fcc5a0ccfef5af1c538c91e6b516f25c68fa40325e47c40fe030a125c75ab0ffef05e04de97954ab5e2762263c8ecaea7f028f25b7cf6cad07fcb28cd44470dd75fd860c6b8f13ae9a77842bf75b5e73a9545d7f7641d1f8bee537edf3a67dc4ab29645006af4cb41360bc63a454ec249efcb9510fe82eed212dc488c2610f91a83ae62f40037f6fa603d037fbd59688106d75b2f0cf22333768f1b90987e7d63f5482fd325d083715773980b5f21399fe024c0d1db4962ae6386fbf2ca92811635c50eb55873e9c6a77865862beab43f22396ebf215b3168c20a306044c6291fb19a3349bd2f5b40c8c7d17f8fc445d47776e5e93fb2a2f6a284ad00c5c86881fcffb97b79276a685f92cb224cfb26af1d19346a0278d8737c0ab94fbd0d56590ca135abb9295a2876ddcd509097dc9d21ac48a6255d7719a836478b08612009a78870873ccf373bd1239d1830c31c29a8a2c56d25a8b716ab965e7e2815dcc2a90fb35dce3469cb6756ef87692a7bc7d2404eabaae82a409261b5a3ba48b2307160194dcdd993990c96b4a3121b8c32af299e9818c6c0492b4a30b27ce2e4105946b5073abc5e8bfe5173afb8b598ffaf3f1aed4c5aecea780eb382f1a6675196636032b6ac873f2ebb1bd9d14e21cc4d8ca38a8ca32e29cefc5ea01c5ff01462ae9176e5cf4791825d76ce341c67980f33ae5e1a812015288ed362ed8bee8839a9d9c2778573a1b21c068cb112b14bddb1c59427e4419cd5d00f546cf06fb4a7191e089dcf44e6ed0adbc826e96d8dec0cb56d762fff1b5712485e6200ee5193a9b5daef7086873f9ac16c3279d8273cb6c032b252d08480b6f9b64718f2d873a572a4c8177defdfb9f1bfed5dec5c76ac35a7ca1f227cc579b3553269296c25d71ed640f5ae0cb6b4c58e8058e0a25963bb864488ba13543553f8ea2fe2dc1b1ff0578943a067c17e09a668542d8956314e19244a484cef6d30be0794f05b85e43f85e217ac22f63e38f8d1c3f0571d3b746eb5a58eaa1b774731fada58b57aa080a3b273ad9e66d27c1bf974d0f6fbcddd9e791902ce209dee0f3cb1806cd02f06d43eadf27798b09a2284172bcebcfa7bb50bda23e738be1ed12f3228e700ec772e1801aae9153b663b3f113f91fe05d83f53df3816f11d7b209e5ff92f181f56629cd160b7d33891d812b7e555d87992f59d9267291bec9b87249afbd516f632395a1cbb30275be936a16db80ff1b81f852d909ae9fa9909becd33b6e90dbc47eec12437995a82ca53ed0f065b087e7d3423c81f46430e4fcdffb052982ad9faf8557bc48b36f15d94cc06499b7ed08d1600305a5c0e2fec31cc3526c699198f0c4d9e15af93cee4a9e8836cd29bc49fea7e0c583e84abe1e34183f471b736793248593e9b40c02a694d770d07ef1938997a72ccc8d89784e90eed953a4db0d5084ad7a4f12f943da6c4c5a12fabfb1c533f1b887a864c4", &(0x7f0000001400)="b68b2222d2d3251931952a24497e01f510e7673a476f3d1462b79e563db729b3f3592308f8cce0eab60ba6467ebbf3cf5e7f862c66d60f3bce68946b6ab7f53f1301f0fb24c0a7b0134293512795c99e5d6d996ec8a5a1dabb9810036a0562711225f291fb0bd44727777f4d66130983ac192f5c329ce0ec04f9ebb92d13c54db6099f4ce496cb4aa4f4ee1047a723"}}, &(0x7f0000000180)) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) ioctl$BLKBSZSET(r2, 0x40081271, &(0x7f0000000000)=0x5) 03:44:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0963104000000000000000000000000000000000126348400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001600"/96], 0x0, 0x0, 0x0}) 03:44:50 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r5 = dup3(r0, r4, 0x80000) write$char_usb(r1, &(0x7f0000000140)="da0a86a999f759c78b95e8e0a7350b072d5fd1e0770fc9e0", 0x18) getsockopt$bt_hci(r5, 0x0, 0x9334a0322f2069fe, &(0x7f0000000080)=""/104, &(0x7f0000000000)=0x68) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x1001, 0x3}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000063000000000000001800"/46, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 2300.854319] binder: undelivered TRANSACTION_ERROR: 29201 03:44:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 03:44:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x1, 0x11, r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$EBT_SO_GET_INFO(r4, 0x0, 0x80, &(0x7f0000000180)={'filter\x00'}, &(0x7f0000000000)=0x78) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2300.902991] binder_alloc: 31547: binder_alloc_buf size 35184384671744 failed, no address space 03:44:50 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000000)=0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r4, 0x4, &(0x7f0000000080)=""/54) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2300.914070] binder: 31545:31551 BC_ACQUIRE_DONE node 13673 has no pending acquire request [ 2300.914081] binder: 31545:31551 got reply transaction with no transaction stack [ 2300.914089] binder: 31545:31551 transaction failed 29201/-71, size 0-0 line 3046 [ 2300.914458] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.915124] binder: BINDER_SET_CONTEXT_MGR already set [ 2300.915137] binder: 31548:31553 ioctl 40046207 0 returned -16 [ 2300.919578] binder: 31548:31553 got transaction with invalid data ptr [ 2300.919606] binder: 31548:31553 transaction failed 29201/-14, size 99-24 line 3316 [ 2300.919940] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.926375] binder: 31550:31555 got transaction with out-of-order buffer fixup [ 2300.926397] binder: 31550:31555 transaction failed 29201/-22, size 104-24 line 3525 [ 2300.928485] binder: undelivered TRANSACTION_ERROR: 29201 [ 2300.938327] binder: 31550:31556 got transaction with out-of-order buffer fixup [ 2300.938355] binder: 31550:31556 transaction failed 29201/-22, size 104-24 line 3525 [ 2300.943238] binder: undelivered TRANSACTION_ERROR: 29201 [ 2301.008432] binder_alloc: 31559: binder_alloc_buf, no vma [ 2301.008452] binder: 31559:31562 transaction failed 29189/-3, size 0-24 line 3284 [ 2301.008824] binder: undelivered TRANSACTION_ERROR: 29189 [ 2301.162716] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2301.171676] binder: 31547:31549 transaction failed 29201/-28, size 0-35184384671744 line 3284 [ 2301.182989] binder: undelivered TRANSACTION_ERROR: 29201 03:44:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) time(&(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:51 executing program 2: prctl$PR_GET_FPEMU(0x9, &(0x7f0000000000)) ioctl$KDSKBLED(0xffffffffffffffff, 0x4b65, 0x101) r0 = syz_open_dev$binderN(&(0x7f0000000080)='/Pev/binder#\x00', 0x0, 0x400) r1 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x36, 0x0, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r1, @ANYPTR=&(0x7f0000000300)=ANY=[], @ANYRES32=r3, @ANYBLOB="d64ff66f0308071e21006af00f707219ac17f30100000093"], 0x0, 0x0, 0x0}) 03:44:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000200)='{r#\x00\x00\x00\x00\x00\x00 \x00', 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000580)={0x58, 0x0, &(0x7f0000000440)=[@acquire, @release, @register_looper, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f00000003c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000180)=""/97, 0x61, 0x2, 0x32}, @fda={0x66646185, 0x6, 0x2, 0xf}, @fda={0x66646185, 0x2, 0x2}}, &(0x7f0000000240)={0x0, 0x28, 0x48}}}], 0xab, 0x0, &(0x7f00000004c0)="b628d118e80eed61de5df80681488d0b79bb80aa4b7874c086e9dc336b2fccbf56a2dc515505368304430e53b08bf35a4a3bd3dd52997efc2ebe608edbd3f68386f788a21adcdf3afcd669ce2582c7e6c94479620d737f1dfbb7d291cd40d600e73140a2644d5c5ad991ae6a62d522933a5aaabd6e3196e9b9898cd63dc0fae338ee87ae465de09cbeb5e4cc61dfdd8da12dcdf4c05756e5a83f11b340518c712fe0ad2ce466a47ed3e217"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x48, 0x48, 0xa, [@enum={0xc, 0x6, 0x0, 0x6, 0x4, [{0x4, 0x3}, {0x3, 0xcc12}, {0xf, 0x7fffffff}, {0xb, 0x81}, {0x5, 0x1ff}, {0xe}]}, @fwd={0x2}]}, {0x0, [0x5f, 0x2e, 0x30, 0x5f, 0x5f, 0x61, 0x5f, 0x30]}}, &(0x7f0000000340)=""/114, 0x6a, 0x72}, 0x20) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) futex(&(0x7f0000000080)=0x1, 0x3, 0x1, &(0x7f0000000100)={r4, r5+10000000}, &(0x7f0000000140)=0x1, 0x0) 03:44:51 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$random(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x410200, 0x0) r4 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r5 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$instantiate(0xc, r4, 0x0, 0x0, r5) r6 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) write$selinux_load(r6, &(0x7f0000000100)={0xf97cff8c, 0x8, 'SE Linux', "85d1fc6ed56b57155364756046d3c3363316aa8165a73de399c190a17ca34f51ff6cffeb3864e2dc55d549695393b4e72dc4de3f63fcec31251c6d89e24eef9efefee01cae1d5c8085ea1b1820"}, 0x5d) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") prctl$PR_SET_SECUREBITS(0x1c, 0x1) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup(r7) ioctl$sock_inet_SIOCSIFNETMASK(r3, 0x891c, &(0x7f0000000000)={'bridge_slave_1\x00', {0x2, 0x4e22, @loopback}}) r8 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000280)=0x1, 0x4000400000000000) 03:44:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000a34db60c695f8c4caccb65b21cb69cfbf32ef01f1df153d0b61facc20a0f1de363f26df76c253411facfa8d9bf55832b18279b9ea89018b0d63300bc14ec22d49054d9b2c84464cc8a9ff42306c18aa233b774bc375b10af080090d28666c92476cdca1a8d6ba24d35e00fa1c70547bacfd0abc4d498160096f8be0f63cca1ab3d264d01ffffff8214cc581fca49e233810fc936557a5b3fa98ea444172f2db9d8a67d1d6868947764fcc7850a83618746b8c300935dbe799e6a6fd5a589a483bdde7790b227720b95a9cab6efd11bd2ceb860a6cfbb30f2b8a0d1105b894f47aa11799a8805eb2e16f87913489129f7943f7c423c0ee3ba8a820f632b565795d5d253bdf48446f4e2f3118e31caf2728d7b7a4b2cd89865e479de7188648c83ac2c642d66e8e84398720ade964187b74dc742d94b50ba493a3b99e0c673057f246b91205ae86067459aff8d035854519d2c18aadae37c1e0b8600df4dfed396c1ddc26cc09c5472b81803e06d81f9eb11728e5c298af4262c505723654ef0ce32071bcebb0c24899c2b01c26f7b5d1fa99287bc3f21dcc8a9ce27d658b40272b34e6a8685ef2b9b6ef75a6e21527a3b7d388a7f9eae4a588d967923177750c8d32f8593fa384c29fd244f4be153e07a2519940933c98c179ecff3000000000010000000000000000000"], @ANYBLOB="bb00000000000000"], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x11, 0x800000003, 0x0) bind(r4, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0xfed3136079240de5, 0x0, 0x0, {0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x8, 0x1, 'fq\x00'}, {0x4}}]}, 0x30}}, 0x0) connect$packet(r2, &(0x7f0000000000)={0x11, 0x5, 0x0, 0x1, 0x6, 0x6, @link_local}, 0x14) 03:44:51 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') sendmsg$FOU_CMD_DEL(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r1, 0x8, 0x70bd2c, 0x25dfdbfd, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @local}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400c0}, 0x8000000) r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:51 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r0, 0x400454ce, r2) setfsgid(r2) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0xfdd6, 0x0, &(0x7f0000000300)=ANY=[@ANYRES32=0x0, @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x98, 0x0, 0x0}) [ 2301.297551] binder: 31579:31583 got transaction with invalid data ptr [ 2301.299220] binder: 31578:31584 got transaction with invalid data ptr [ 2301.299246] binder: 31578:31584 transaction failed 29201/-14, size 99-24 line 3316 03:44:51 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r3) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r4) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@loopback, @in6=@ipv4={[], [], @dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) close(r2) ioctl$sock_inet6_SIOCDIFADDR(r4, 0x8936, &(0x7f0000000180)={@loopback, 0x39, r5}) r6 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r6) ioctl$TCSETSF(r6, 0x5404, &(0x7f00000001c0)={0x7, 0x81, 0x81, 0xffff64c0, 0x9, 0x4, 0x1, 0x4, 0x5, 0x0, 0x42, 0x8000}) ftruncate(r4, 0x10000) [ 2301.302846] binder: undelivered TRANSACTION_ERROR: 29201 [ 2301.356362] binder: 31578:31584 got transaction with invalid data ptr 03:44:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000180)={'IDLETIMER\x00'}, &(0x7f00000001c0)=0x1e) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) write$P9_RCLUNK(r3, &(0x7f0000000000)={0x7, 0x79, 0x1}, 0x7) dup(0xffffffffffffffff) ioctl$TCGETS(0xffffffffffffffff, 0x5401, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r6, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TIOCSERGETLSR(r6, 0x5459, &(0x7f0000000440)) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r7 = dup2(r4, r5) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r7, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40108000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r8, 0xc02, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x28, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffffc}]}, @TIPC_NLA_MEDIA={0x14, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x2080055}, 0x4) 03:44:51 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x400) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 2301.356392] binder: 31578:31584 transaction failed 29201/-14, size 99-24 line 3316 [ 2301.357727] binder: undelivered TRANSACTION_ERROR: 29201 [ 2301.393729] binder: 31597:31600 unknown command 0 03:44:51 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0xb79374455b8509a7) faccessat(r4, &(0x7f0000000000)='./file0\x00', 0x10, 0x800) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2301.393738] binder: 31597:31600 ioctl c0306201 200002c0 returned -22 [ 2301.427521] binder: 31595:31598 BC_ACQUIRE_DONE node 13692 has no pending acquire request [ 2301.427530] binder: 31595:31598 got reply transaction with no transaction stack [ 2301.427538] binder: 31595:31598 transaction failed 29201/-71, size 0-0 line 3046 [ 2301.427797] binder: undelivered TRANSACTION_ERROR: 29201 [ 2301.440718] binder: 31597:31611 unknown command 0 [ 2301.440727] binder: 31597:31611 ioctl c0306201 200002c0 returned -22 [ 2301.491889] binder: 31613:31615 got transaction with invalid data ptr [ 2301.491980] binder: 31613:31615 transaction failed 29201/-14, size 99-24 line 3316 [ 2301.528615] binder: undelivered TRANSACTION_ERROR: 29201 [ 2301.530475] binder: 31620:31622 got transaction with out-of-order buffer fixup [ 2301.530503] binder: 31620:31622 transaction failed 29201/-22, size 104-24 line 3525 [ 2301.530746] binder: undelivered TRANSACTION_ERROR: 29201 [ 2301.535380] binder: 31613:31615 got transaction with invalid data ptr [ 2301.535412] binder: 31613:31615 transaction failed 29201/-14, size 99-24 line 3316 03:44:51 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r4) ioctl$VT_WAITACTIVE(r4, 0x5607) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000000)=0x2) r5 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r6 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r6) madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xf) openat(r6, &(0x7f00000000c0)='./file0\x00', 0x284000, 0x2) openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TIOCMSET(r5, 0x5418, &(0x7f0000000080)=0x4) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2301.569723] binder: undelivered TRANSACTION_ERROR: 29201 [ 2301.743844] binder: 31579:31583 transaction failed 29201/-14, size 99-24 line 3316 [ 2301.754478] binder: undelivered TRANSACTION_ERROR: 29201 03:44:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0xfffffffffffffcfc, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) 03:44:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x2}, 0x4) r2 = socket$inet6(0xa, 0x100800000000002, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000005780), 0x4000000000000d2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:51 executing program 5: socket$inet6(0xa, 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='ppp0security}em1GPL\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendfile(r0, r0, &(0x7f0000000040)=0x100040100060, 0x4000400000000000) 03:44:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r2, 0x400454ce, r4) stat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(r4, r5) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r6 = creat(&(0x7f0000000000)='./file0\x00', 0x1) getsockopt$IP6T_SO_GET_INFO(r6, 0x29, 0x40, &(0x7f0000000180)={'filter\x00'}, &(0x7f0000000040)=0x54) 03:44:51 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') write$P9_RLCREATE(r1, &(0x7f0000000000)={0x18, 0xf, 0x1, {{0x10c, 0x4}, 0x2}}, 0x18) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2301.915962] binder: 31643:31646 got transaction with invalid data ptr [ 2301.935533] binder: 31643:31646 transaction failed 29201/-14, size 99-24 line 3316 03:44:51 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000000)=""/44) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2301.951005] binder: 31651:31652 got transaction with out-of-order buffer fixup [ 2301.951034] binder: 31651:31652 transaction failed 29201/-22, size 104-24 line 3525 [ 2301.952325] binder: undelivered TRANSACTION_ERROR: 29201 [ 2302.017958] binder: 31651:31652 got transaction with out-of-order buffer fixup [ 2302.017987] binder: 31651:31652 transaction failed 29201/-22, size 104-24 line 3525 03:44:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ATTR(r1, &(0x7f0000000400)={0x78, 0x7fffffffffffffed, 0x7, {0x6bf, 0x9, 0x0, {0x1, 0x100000000, 0x7, 0x5f, 0x80000001, 0xffffffffffff42ab, 0xc3, 0x7fff, 0x1ff, 0xd6, 0x40, r2, r3, 0xb0a, 0x101}}}, 0x78) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$UI_SET_FFBIT(r5, 0x4004556b, 0x18) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x321000, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r6, 0x8004e500, &(0x7f0000000380)=r1) [ 2302.018284] binder: undelivered TRANSACTION_ERROR: 29201 03:44:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$P9_RSYMLINK(r1, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x6, 0x5, 0x8}}, 0x14) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="9e", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r2, 0x0) keyctl$get_security(0x11, r2, 0x0, 0x0) r3 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r6, 0x0) r7 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r7, r6, r4) r8 = add_key(&(0x7f00000001c0)='.request_key_auth\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f0000000300)="a5ca2de882129c0af17a0386836f8d7566fc6957d09298f314d446e8b5dde308e6fa14b5444ce14dec7473eaa17ffdc83c1840c65ebd7d5df310c7519003eef0b4ac97541b3f97db905a99bfc59b126e67c688acaf20652da1ce174020711c7684184a534c289c41b6d8cbf206fbb66c875d31035eb8fe40efe7d30c868a8b5c39dbddc2de0f4f27fced202f190895efd2ccd9f8f47a3bee26051a223b1af53c950fa9e331f895f8590e91f63fed6bb825901a8afe", 0xb5, r7) keyctl$search(0xa, r2, &(0x7f0000000040)='trusted\x00', &(0x7f0000000180)={'syz', 0x0}, r8) 03:44:52 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) rt_sigaction(0x0, &(0x7f0000000380)={0x0, {}, 0x0, 0x0}, 0x0, 0x8, &(0x7f00000003c0)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x3f) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2302.153801] binder: undelivered TRANSACTION_ERROR: 29201 03:44:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000180)=@broute={'broute\x00', 0x20, 0x2, 0xb4c, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000300], 0x0, &(0x7f0000000000), &(0x7f0000000300)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{0x3, 0x4, 0x886c, 'bridge_slave_1\x00', 'teql0\x00', 'nr0\x00', 'gre0\x00', @local, [0x80], @dev={[], 0xe}, [0xbd0b33e08edf6eda, 0xff, 0x1fe, 0xff], 0x976, 0x976, 0x9a6, [@time={'time\x00', 0x18, {{0x9ae, 0x840, 0x143bb, 0x131a7, 0x3, 0x2}}}, @among={'among\x00', 0x8a0, {{@zero, @zero, 0x2, {[0x9, 0x8, 0x8000, 0x1ff, 0xa7, 0x1936, 0x300000, 0x6, 0x0, 0x8, 0x6, 0x5865, 0x801, 0x2, 0xfffffff9, 0x0, 0x8, 0x3f, 0x1, 0x5a1b, 0x3, 0x5, 0x9e, 0x40, 0x9, 0x0, 0x5, 0x0, 0x10001, 0x4c, 0x1, 0x1, 0x7, 0x3ff, 0x8, 0x20, 0x40, 0x9, 0x1c00, 0x8, 0x3, 0x80, 0xfff, 0x7, 0x2, 0x4c2c1184, 0x0, 0x7, 0x101, 0x10001, 0x7, 0x1, 0xffffff81, 0x40, 0xebf, 0x10000, 0x8, 0x9, 0x6, 0x6, 0xffffffff, 0x4, 0x3, 0x5, 0x1, 0xc00000, 0x8, 0x9, 0x8000, 0x1, 0x53, 0x7, 0x2, 0xffffffff, 0x0, 0x9, 0x3, 0x563a, 0x40, 0xfff, 0xbb1e, 0xee2c, 0x95, 0x101, 0xdcda, 0x7f, 0x8, 0x401, 0x400, 0xd2, 0x6, 0x4, 0x4, 0x2, 0x0, 0x6, 0x1, 0xff, 0x7ff, 0xffffffff, 0x4, 0x2, 0x4, 0x8, 0xff, 0x0, 0x3, 0x3f, 0x8001, 0x53, 0x0, 0xcd16, 0x1, 0x0, 0x2, 0x8, 0x840f, 0x2, 0xfffffff8, 0x120000, 0x3ff, 0x8000, 0x100, 0x6, 0x5, 0xffff7fff, 0x90000, 0x80000000, 0x8000, 0x9, 0x401, 0x900000, 0x2, 0x5a6, 0x3ff, 0x4, 0x874, 0x9, 0x2, 0xa5e8, 0x8000, 0x0, 0x6, 0x7, 0x2, 0x0, 0x4, 0x401, 0xfffffff6, 0x82be, 0xfffffff9, 0x9, 0x1, 0x4da, 0x4000, 0x873, 0xfffffffc, 0x8, 0x2, 0x4, 0x4c, 0x7f, 0x2, 0xf3, 0x3056, 0x7, 0x4, 0x8, 0x3, 0x2, 0x6029, 0x1, 0x7ff, 0xffff, 0x354, 0xff, 0x400, 0xc3b8, 0x7ff, 0x9, 0x0, 0x8, 0x0, 0x6, 0x9880, 0x9, 0x1000, 0x10001, 0x590, 0xfff, 0x800, 0x9, 0x6, 0x1, 0x8, 0x3ff, 0xfffeffff, 0x5, 0x7, 0x1, 0x80, 0x4, 0x6, 0x34dc5db4, 0x0, 0x7, 0x4, 0x2, 0xffffffff, 0xc2, 0xf4, 0x8, 0xbd, 0x8, 0x0, 0x7, 0x5, 0x5ef, 0x8, 0x401, 0x5, 0x1, 0x3, 0x1000100, 0x1, 0x101, 0xeb3, 0x2, 0x8, 0x7ff, 0x5, 0xffff, 0x2, 0x81, 0x6d, 0x6, 0x1, 0x7, 0x7, 0x9, 0x5, 0x3, 0x6, 0xfffffffa, 0x421, 0x2, 0x7, 0x1, 0xfffffff8, 0xe7, 0x77, 0x7fffffff, 0x40, 0x76881604, 0x2fd, 0x3, 0x8892], 0x5, [{[0xf784, 0x3], @empty}, {[0x5, 0xffff], @empty}, {[0x0, 0x2], @loopback}, {[0x1ff, 0x1], @rand_addr=0x115d2ad7}, {[0x1ff00000, 0x10000], @multicast1}]}, {[0x18ee7563, 0xff, 0x6, 0x3, 0x10001, 0xffff, 0x0, 0xff, 0x7f, 0x7, 0x80000001, 0x1, 0xfff, 0x0, 0x1, 0x101, 0x78, 0x5, 0x7ab, 0x3, 0x3, 0x81, 0x1f, 0x200, 0x7, 0x1, 0x9, 0x8, 0x1, 0x7, 0x8000, 0x20, 0x8, 0x4, 0xedab, 0x0, 0x10000, 0x1, 0x9, 0x8, 0x4, 0x400, 0x40, 0x1, 0x9, 0x4, 0x3fde, 0x6, 0x35d3, 0x38, 0x2, 0x8, 0x800, 0x3, 0x2, 0x81, 0x6, 0x9, 0x0, 0xf0000000, 0x9, 0x101, 0x2, 0x3f, 0x5, 0x81, 0xc6d, 0x7ff, 0x8, 0xfffffffb, 0xffffffb8, 0xf4ab, 0x5, 0x3f, 0x0, 0xffffff47, 0xc, 0x800, 0x200, 0x0, 0x0, 0x1, 0x1, 0x2, 0xcf, 0x8, 0x7, 0x1, 0x38c8a173, 0x7, 0xff, 0x7ff, 0x8001, 0x5, 0x5, 0x6, 0x20, 0xbd2, 0xd4, 0x5, 0x7, 0x10000, 0x1, 0xa9, 0xffff0001, 0xfffff1a9, 0x1f, 0x8000, 0x8bf0, 0x8001, 0x8, 0xffffff23, 0x0, 0x3, 0x1f, 0x7, 0x9, 0xca, 0xffff529a, 0xc9c, 0x87, 0xffff, 0x1978, 0x0, 0xffffff7f, 0x5, 0x6, 0x1, 0x81, 0xfffffffe, 0x40, 0x80000001, 0x8, 0x5, 0x9, 0x80, 0x0, 0x31c1, 0x7ff, 0xffffca88, 0x1, 0xffffffff, 0x6, 0x3, 0x6, 0x0, 0x0, 0x6, 0xffff4745, 0x401, 0x7, 0x3f, 0xb1, 0x9, 0x1000000, 0x7fffffff, 0xd09, 0x8, 0x1e, 0x10000, 0x2, 0x1, 0xfffffff8, 0x13, 0x1f, 0xff, 0x200, 0x7fffffff, 0x20, 0x6, 0x5, 0xcbed, 0x1, 0x7035, 0xc4d, 0x4, 0x7, 0x0, 0x0, 0x5, 0xfff, 0x1, 0x242, 0x100, 0x7, 0x0, 0x0, 0x7, 0x80000000, 0xd6, 0x401, 0x1, 0x1, 0x8159, 0xffffffff, 0x8, 0x1, 0x5, 0x4, 0x7d77, 0x7a, 0x8000, 0x5, 0x4, 0x6, 0x1, 0x3, 0x0, 0x10001, 0xffff, 0xf41, 0x2, 0x7fff, 0x80, 0xe5d, 0x7, 0x5, 0x0, 0xa3, 0xe6, 0xec9, 0xfffffffa, 0x9, 0x8, 0x19, 0x6, 0x3, 0x1, 0x0, 0x5, 0x7fff, 0x3, 0x0, 0x9, 0x5000, 0x4, 0x1, 0xffffffff, 0x1, 0x5, 0x6, 0x3f, 0x7, 0x2, 0x81, 0x5a31, 0x3f, 0x3ff, 0x1, 0x0, 0x1000, 0x0, 0x7ff, 0x20, 0x5, 0xff, 0x20], 0x6, [{[0x1000], @rand_addr=0x3}, {[0x7fff, 0xffff7fff], @multicast1}, {[0x1, 0x8], @rand_addr=0x7}, {[0x10001, 0x5], @rand_addr=0x2}, {[0x3, 0x9], @empty}, {[0x64, 0x6], @rand_addr=0xfa}]}}}}], [], @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}}, {0x5, 0x26, 0x1c32bc32295240b9, 'veth1_to_bond\x00', 'bpq0\x00', 'veth1_to_team\x00', 'bcsh0\x00', @dev={[], 0x1a}, [0x0, 0xff, 0xff, 0xff, 0xff], @random="084d1b19ed01", [0x1fe, 0x0, 0xff, 0xff], 0x9e, 0x9e, 0x116, [@m802_3={'802_3\x00', 0x8, {{0xfc, 0x200, 0x0, 0x806beebc9709e469}}}], [], @common=@NFLOG={'NFLOG\x00', 0x50, {{0x9, 0x1000, 0x6, 0x1, 0x0, "9efed2ea509445f12a3ec0d3534a676b59514a11163314da1bbe869dc77ddbdf4abd6e060566c5b274fd500b4776149b89860845b778fc1edd23c63bc6be8e8f"}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc}, {0x0, '\x00', 0x2, 0xffffffffffffffff}]}, 0xbc4) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) mkdir(&(0x7f0000001140)='./file0\x00', 0x20) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r4, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400004e}, 0xc, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="0c010000f948c542d2d751358051e077dcd375539552039e3365bd4bacc77f0149edcd9f02518896e71889ef8ce38fbb3b89ff1b97ad128099b398a9e5b1ad171b482ef8a84bd78bca454009dd59bddf9c86616050df5e9c9db435a3d4c6d61e9a8ca8f50cb51110faea66ed69a35b54444c0efffef4d0b27b7d184081977eabe2b11ad4d75a1ee99a53", @ANYRES16=r5], 0x2}, 0x1, 0x0, 0x0, 0x80}, 0x20008010) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r7 = accept$inet(r6, &(0x7f0000002740)={0x2, 0x0, @loopback}, &(0x7f0000002780)=0x10) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000004300)=[{{&(0x7f00000011c0)=@in={0x2, 0x4e22, @multicast1}, 0x80, &(0x7f0000002680)=[{&(0x7f0000001240)="b7847495fbb11cdb54583672b54eb04e024df38854151b6d95d632b1b1058e43645d15aabb9a08d30a224fc3202768f5560dfb993aa012627830ac0e9459f6151b9a31606919c55a986eca5e8130a213b861cf483e96829f130717c8de9eca81492577bfc9f2ad9c20500cd475d644bbca16e6aa6c213e1c8a45ad3e9a38c1a066b8c7052d9807deecbc27039e0816fc86b645b3e46808e59a032eaa3e864f87c6dea0419f5b13588c767b9c8dbbe21636c9b39ac80bd997315626546861a6d5ccc0e089c4b252563d329405482addcfa076af06d92fb4a5f89cf5f43860", 0xde}, {&(0x7f0000001340)="fae1fffe8666da7ca7e0c19a644774ea1de8b3c167e9eaa8b881c6b5a811b70f435ab769dd1c17b8f4863f7c716c38d341ac1781cc6455b673b48c55dcab98ff718432f4f9d0f0255031c9fc0ed3626169fc0d2417b7573f5afb1f9718b0fbca379398da2cf8326468041d8dbe0fc1639470b8dae3ec0112bfe6ae6a0273508fe5c0dc3f106e6f2ec288d978209ce9f60e9fe39f0a604a14cad8544b0a2f1b9ad6bf2c9b285bf9836c7332004afdeb0aac6a7536f52195780632602f9ab5962afbdde17c3944d44ed54a4531c318ebd94e5ece18617073f1665a9601e7bd0c094725a46022fd49fe", 0xe8}, {&(0x7f0000001440)="35c6e1ab69286e8430e5f7850347389997b527d453bfa249b8dc250655516eeafa79e695adfa37761ef288b0f9c3b7191df9b9b0241fe0cd3ddaf16e0033a7bc71494749bb7e0b714445dcadb48717c78f9f0b1b3b48ee260b3531f0a3dc3b2bd294e9e10627a3a3e4cd91fc063786e30ea125eb", 0x74}, {&(0x7f00000014c0)="da1d02cd28757e5558eb986e3c2f8a71d09429645379b2b7c09c329cc645d7296b69f7bf405948319bfd1b51759e826d15f25b7e0346607339de066401470bb85a7da7de6a6c638ef87bb40086299570facdae8bd329307b078cf65f18863c0dd48efb4fb9034264b390d2ad6df8fa431b77fed858dc659e29e4fc446210510d27c1c6fd90c3fd3bcf6c45a38823f0f292c69f3e888face903acf6674864312e9c1c37c4e3422a4ad6a2aeb2ad8b987387b2c0c2c00984fbad714900ad734d3cd6d1324b1527746045d4ff0fef79d7b9a8d8177123c427870f1e171e130a9b08d024969b19e0498d5ff26c6eab92eb4fc856c0db2a8d99d1748c7821d1dce726a1294ba70da4e6f821485516100912bae64206ed76e0f6450a00fc4f7d7f8a42dbaeb1401c48fff23332096a7008f2efaa37cd4c75b40ed58778a8b450e622b4620ec34ba454772a7048b269c56b4318dd7234fe1ec5688225102cafcabdbd2e4a26c5e0f03b2e4e09c69bb8c2adf6f4e7b77bfd6278eaf1cfb604223c52b8d7832ce66e071a653e164981e63a70b035ac322110115b9b5287da9c613d5ee21c8dba2199c2f503deea4da9e272f4cea664913dcd3ce9748b7a715744dda96879efc0f694109554ca2c708a34dafbd21c553842a53c7b810a622d910b19369f7c1acad6616fce2c9bbcd6ffc3883c791f38b51b1c9f6118e324151a41c26a353407a47bc7307bfc84cbed730ececc135e4593b2fca0d15cff161a01063a2fe9dff7c03374eea988b2b65447460bfc8bfb86208b5ff5a460c781d33d25a5b9f718fbe069bef052f039a81c618aba778ac5982fa0bf51dbdb5b38126e9d93cc901e36e0405d749d1ac06ebe7f68df552f8ec2738a185aa3f2efea3b6362fe9ad6625ddf77bc56aaaa86eeea0779c0bfc0cec9deaaeab4688e9f1d1dae822d46280ab254118c7d75e993ce3bdb228bd3cfdce93b46f4c2f3710a6be0adc269af01a23560e1f6d07e4e271c4c1ec43cd7ec83f1ee994e7176337dae29b5ec452b09fade1b35d2683ab75177a8d01a2e09293142ba085ff01bb73048b33e4728b96a163c7079fe5ec9abef85d3c7c8cc5adebce7c8673cd1b476a9f514ee20821c09ea3077dec7231532a2d4152af08011e991b80f325639153198d1ce725a51a7045b201dbca53f3f32c0baee42e9b79108bf6ebcbb934c8a2464c6203d3367a29e2befe4d6ae6438d4fca38e287ea7a58776603ccdb63e6be225c06b0efce869980a3d74b4a76159952621f3a6d36bf08a819a2b2ced70658031fe979f5860e37322dd8c294f3e2b92ffe7d08674ee705f057de7532f52e5f80fa4faeba6df48011902ae1c3730f1417ad00799706f60a4e95ab05d436ebb6f1ede206f5b17f5af6fb0d85ca169d6b54ac72f0ff05cf561b52c002c472e038c3e2c13090d781125b6ec6353cb54f3faa17df296b03cf75fcfa7793db5e8d2542660dc17a47134d3cd7ddd5d78d2257ea31a7f49c81c55395e22721c1b43a52094cf662044271f8d045b8f70a12465b1ee6fd091fa96cbc73c113b395b06572257d5d42f0453ecc51064ea84ec0e480eef52392f0cff7b00e3bea1e0777fc038ea17a49462ae90857f3794b1bb5fc71e997a07b21af874651e2bc8d3aa4bc12116fa5f184c8d6209866103ea1c40609e284e602259cfeaa90c517d4c7b2b1a86cb11556e1a407e8f95e5bd45c7cc6ca567ce2463cafb0ed7c48d8dc776da22e02cb6346a970b46c302c9d26cb4ee19415d09e699301ad7c3784e5bc21009f775d26775b23c36850013093e8ca9bc18975a7a073695e147ed0ff2325816bec5fe65822ab4005f3e99943089700e3437fa71737fa1537c5db8c5bb172cceee06a32dcccf6c8ef4254f177a57458456faf7973ca0804f4d5050cfbe64ee61bddc96f9a2ad18bab401e103ad8b3a9725b146a72a9d9cfc5f31a9add8cc2755a085f10404405ab2290865305a9d69048cb1630d004295157397223e8e69eaead1915fef67ec6204c2fdcf853ce76d12e97d82db043c48d0dd952277421c9736a764c565498b9389fb6d1599f0282bb0b400162a593ad415bfc8f5efd2b3738433af9265d2dd214c3493191438413429d06f4902205c07d58795c75d2df5c0dd196e4b3ff5a83ef9148efaa00578aa013b9cf65ca2eee9a0ad968b7dfb5c6ede8eb5273c5565ad15dee261f0be0e6989070040cf6d1b9b24600327f4458dccdfc9a355d891e2dbb8482bcd689d17b895a4a3506b5cdbbfc98355db7c17a69f7388e33923ab46aef96073073c3311304255b77e13eb385d54b113d1897dea41236a7ad8a68441420d3132ff278b3544f97b1f280b844d087707626787a277b9acaaac4632732086bd34019b7dcdfe0b0f50827fcfbff9e7f8cf8939e1c0754374690cd557b034419cbda2a58662c608a67fb553179e79989304fc51d43bd19fab71edea2eceee9d82a545472d83836fd34b51480c6d85f71ac099b244dd0cec7feaf186436139a89438901b28611812003eb89799a017020ee4bd9a4c1d51f4d51bc26708b210082a1e3c2b713b41243a4b341cf660b92fa924b5a7ee7e868544ace82cf603d7b2a66a2306f1c6b241baf80a015fbe2b13f5900ca41cc35f27c18d1a76b7e10e17f64e8369e4bba44f5b8b203eb32be1db8f414e82fa6f8c27ef08531d003ea038bd924ba80112edf9755a65eb4b252595bf6be9f8ba3eb70433ff1e4df4dbf0dbfc9c5779e1dfe8fc10a7a14482d2f36fd30e85d05ae2bb5fc8ece67c217cd8b39cfab08de76cfb0d6926b0b3fff54c30a0ce67507e52891ca92b70b95757f92bc19b692cab72a4d62c5cd4faeb716403111ac783d6966e6e4064ab40aff9cf89b917901fee2c4b1ed6fd6ccd8a80aa09852a5b085e45f94eb965031de02533a1fe7bf9568b744902a8d532ecc1438626c8f2142bfe24afc557eade99efd38206633d3dcae030b2af55b3f5ea4c530bad3a3b328134e6868f5b29434af607fd2427838aacaa946e61635d847718a6caafc58cda0164412983de11b35d9418d8f7ba72a23e4109d9152fef49238a1cd9c499c1ba3fee8edeccc218b03d7d2d00deddea385295d2f64da8d64f8aa9d09bb95f5278d391877e5c85f4e1c4f0c981edd04715c1046b13feb4806afa6859da2c65afcb390ad1ad1e78e3fe563840385961d3cd8edbb3978397c9537c3ea56070332303f1cf232c5180d9a3076d0bf7213812b64550d4a27ebfc3e47a00a9e1c858425171e0646fbf88e2d2c47dbfc146c728d0e16a254e9fcd6fb81bbb59bdc6a5facdce925c14f47496c060bbb0e009cb0d3a41af82938311a832eb0774ca9cc7fdef82a7ec1c329a4639394c85fba0e6ca575be34cf987ce13c0dcea0e090b09e51ed7cafb88437c25c58d2929aef5cd01b84b3ca56563cf122eaabe4e48821c6f1990bcc78e1dc1171c3f2762cf7f2fbcc7ab06a0d099c4cd1a0ffca841f66eea8f5516f5f9b7dbc34d076bb8e89108e2bb5c8e36d7dae7a53294efd2a4102e1ec9103190930206089d6b39089297beb058cc4bf7cb2279ddcf497c5dd5f7c54bcb88cc92b8ca82b61648582e805d0d8a9de4d0b71f3cf9211e25da617bcb2fbde310280b346a6aa54005f7d85c7dc208d038dddb72d8e53896d2bac9ef61142e784e34f441f8ca3e291073b5857f620f267940363241514890abd11fb4f223939110d81df0d4e8bce9e2e5d6fe84b3571ddeaef30bf2300714c4b9f78f81cb41d3b6a0dc9bb3ecd230a1021eaf0887023ca94b13fe3119ae1287d0b04f77e8e22db670ec6bbc4eaeac1d7d4054acbf593afac16f76e3d0b7026892320f09bb613efb928d302bc308181117facd687af99639e985565d155f3a65ae3667ad1de3e4209db7bab6eb9b02c7adc8c95f82d15c0b190aa5c2f24f2b288812cd2b5878f0465b2ac48e3b2a1b4c777d3cb3e2fe9e615ac2e061a1d240c018f3e8dfaf855d2f6c4e13a431dae60eee5b4f4b12457fe77b3b0ae8ebd5a0a85fd105c12d8e42da0a8bfaeabce38fce12f2235135e2bc5302cc77d8c11ebb67b6d326b8a26500f69c6c88b31bf450feb7c941ec04d9d9e2e57a9caf97cc37ea8bc79f56c704c9fd431db294d403cb91837b3d56a99b233edbef7b6922a5edecfbbfe5550254d0ce06600872c7da0fce37b1b91b842323dd38046f7c65809ab39248dc1baaafdbe1e7dda1102a0af04fee8ed3f6d413bc21488b15ff3f84e5031f2105d64e99d0603572c9d383dbed648f5c2b35afd62e21c5031b8ac81946c015f64be5ce9c6219d2a82766d90e8f538b5792fde82024f6e72bc3895b563a18f4b874aa9d7153b556547abb24eedaab790184f1c26ae2ec664329fb4a636fd6e0936c7d69dc55b0770e3d10f18940d9b1f168c372855b8dd2d5ad73c78b2c0c2ce8e9e99d006b89e6ba96fa8fd866139536303342404ad1aebba981d4391a2b60339570aae7ea01ed19e50655d7d12ec3e744625f973da7d9b5f697cc6bd5865b72dd528422ea58321ce746a74bb661a2813f476429cd110539a259bb5885e1edeba3dcae1633fbfb29d857394f627f8a90cd8f72c78d89d5f2cfd1173fceaa467d0f9e37a8c95dfde33e01d17025e722cf298cd88a431c7433a3e2829563be14dfd31418dc8c9f0d31c069387537c30069a30a3f08972389498bf81ddc7622869a614e5e271cb6841857879174675112c121eea434ab3c3aadb1901b5f5488e2e1aea2d4a78a80a420fa14974c2b1d9faaf2ee4fc6e76fbb1dd12f601db2c9ec7e1dc13c62ccb6b79663e99de3d7a389689ccbe73c62c54cc61b38cccf997f067e16e0b9a070b620c260da5cbb470986af7ea8b529cf663cf802d0dbf58031ffc8a972f0a1714732d49fb27b5c39e8787fc412354176ec24aaf5a96463b26c35c839e2ad651f697e8decbd4e0b573dab2fd8a8b687f8197697d970237039ed4629e794943cc5d1a78786a4d5e3d0512583d3b93a5ae6a54d794c60a6bf5d21a707242ce1a959497d7ca66bbc92649a6fcefa58373bbac5a37dad25ead329c90cdd844db91bea7e002a59b6020e2b64b0599036621b4864429917970b7677867317976f887594e0ae0481356c08c3e4e50e175e7803c85083c0abc32edd0d4013ea8fc18bb1e0ba17e283aa3df0703d207e7b06e16159b4e27b1fbf3fd7fbcc5bfd13393d3af2b81ac6824026a77b13818b6fd94a9b8cd6fa49beaa3ecb91279cf22de8850bda46747a08f3591cce3122678b1bf84b2f441ce047673da76866d062686212a0ca5da7bba58481cb7648a366fb7c22f737ce25280ec1f66836b77040a08290a089e6325b9d2e48f59efcd58b8c472bd1e39f869d1f5310aa692cc402d658dc24b219c234bff4ac5d20ffa2e64e8855aebb5e8320d661c34273518613aba96f6b37b5ef7cd5e6744d52b45ad96cf71547a4bf70d0fc71f5d1b871e2c0f8c8de2b794647819be907305e99559da470facb92091452e604cacfc6d8c3b9222f3b05a2d681442ae43865a10ea9b6f4cfca22d46903a3dba187b412f6d882cdda2dfe17ddcd3a02b133a6290d8d7cecb86ee8772d66cb579d9f7b2f5df42f2d4380d41c31f7f45e55f769e931d18fe17cae6d7a956345aa69110ce5bab04029c87dc401e6da80c9e54a154bf2ce6d2e509e75651624c3f371541b4b7dc6b946b51c93ad579086036a7c3d72bd67eee955ac5f06c5de352c7823c8269dc47ffe7ce89d191573254f9ab04a92e2ac89140c995211d7c4", 0x1000}, {&(0x7f00000024c0)="575ec956c7dbc8fbee751839eb6fdd256d1a7f1f815ebc62316784ad4cc8ecf856ae3b99", 0x24}, {&(0x7f0000002500)}, {&(0x7f0000002540)="194c47f775d255c623ddf5b57a3223c4d0c6c093e241a8645205a07ac9851a53140f86babda3962e6936a6bd125a6af5cb46532f6914b7622fadeb2e04aeeab5a0d5945d59ddafb219c35069b82ff675625a77e5d10d28ab2d9d2525ec742d03c92631e801c3a6625f156c0b8da64648259ff1a3b78c3305aafd1b61516d2e8f279278e7f0e859814905392b460b29d779e462fa3f09bd45e1a7f0e2a76b8a902e80dda6031a19d02ecc0935929051a96aa7a04e3141360e650fb095d76e6187a67b40e7298695f2f94905509bf6c817e135f6bb8d8d4218b06344", 0xdb}, {&(0x7f0000002640)="ac64afb892693c5fefcea66cbcc357ebf325433e61f931d38da4d2f05f21e14c02ba4eb708eaf6", 0x27}], 0x8, &(0x7f0000002700)=[@txtime={{0x18, 0x1, 0x3d, 0x9}}], 0x18}}, {{&(0x7f00000027c0)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x4e24, @rand_addr=0xfff}, 0x4, 0x1, 0x1, 0x101}}, 0x80, &(0x7f0000002980)=[{&(0x7f0000002840)="5716d1f67b18d3c7144c76a1c0e6ee0f77621019817a1b3121d12e351631460052d5f24eef8b0e9187", 0x29}, {&(0x7f0000002880)="5ef4fdcfdb917fc16c19ca7c2f45925be75f7a7a64f9ccaa879fb7f1bb003e22d6773cfc7d8c3d4aaa94d2693c2f412177d3878e901bc8348cc40664db26d6af5db4be9bafe98988ecc99f60619926e250f9545a0464ac2f1897dcdd259147fdfb644e934e0a8ae000181c76f058ad0f37", 0x71}, {&(0x7f0000002900)="c7741b4eb0854d8f9129e04eea40a0605b5958e96dad5ed3b78c03ef22627a65960f3f72ec64aac4b17a2e", 0x2b}, {&(0x7f0000002940)="5fce047801f39859c2b9a0c7b1bfdf38dcbfa2ea73e0f7e4c47c7d6fee47b19dc81c5ac0e3d6375bf8df", 0x2a}], 0x4, &(0x7f00000029c0)=[@timestamping={{0x14, 0x1, 0x25, 0x14}}, @timestamping={{0x14, 0x1, 0x25, 0x3}}, @txtime={{0x18, 0x1, 0x3d, 0x10000}}, @mark={{0x14, 0x1, 0x24, 0x2}}], 0x60}}, {{&(0x7f0000002a40)=@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x80, &(0x7f0000002c00)=[{&(0x7f0000002ac0)="2a86e650f6881f5040d1904fb3ae8fcd163325ddf9d2ad72113a85fc03b84f7eacd55922bbe45dd5da608f36a9ee2a66b67846fbe7819e023e872f3c0d447b5689a79b33ca65fd1a1ee4017f0d00cc961db5fb41408e6258d2befbb009a30c6c674a2249b60cbef43d7c0d77783b3bbb935f62c5fbaaa51ae53a5d90ffae3fbb9c4934721bcb8eb732c59eff3696101afe2f19b323207d42e6573571e4a1a8702004ea12c3f1bd76ae361d5d1731f7de20ba769d642d0e58a6", 0xb9}, {&(0x7f0000002b80)="3d1811d125790c4d3a18ad2012b2edb054d308f81e7bc33866234e2517b80a65ff89d7e15ff6e741dfa64c51519e69465e72544b0013f78a5e7850420fea5ddffdbc41e070fbd5e495391455438fe8b78a669f431b0b", 0x56}], 0x2, &(0x7f0000002c40)=[@mark={{0x14, 0x1, 0x24, 0x900}}], 0x18}}, {{&(0x7f0000002c80)=@nfc={0x27, 0x0, 0x2, 0x2}, 0x80, &(0x7f0000004000)=[{&(0x7f0000002d00)="79d1b55451f333574af664cc279d6656734a91b883b9a2615dde72b06cbaed9c859f584b0aaaf29306861e3ef411b2cb1dd20d23c4eb8977e04f366853c6c59dadafd8687cdd33fe32797a5d910a9c5f4288e8efc57a0cc7cc2ef0603270d1c2023793c344f6cc03db5c6cc078b3edb4620da9052faff795d37ec78bc11a584416289d", 0x83}, {&(0x7f0000002dc0)="13fb83a878f4d984080aeb6fb8ef59bfe1474795c52109c5f73715ae33fbd097007d417db457e25f1b2493bf7c3792c517dd1d8c8dc603c1714dd8efe5be3eb5492ef8d9a1a2", 0x46}, {&(0x7f0000002e40)="c58ed67a43da69ad1680c56d00c0a9d894867fadf54c27536434f955e6f5b8d4ac6ff7ec6a51b0a5579c5d7530f6ff7831c2660435529cbc75831398525aaaa313d6f6ba7e931fc8a6eb966c06b32ddf3daf35c47b96c7fa5f26ef989d37520be424a5ef981d9bfaa5419653347119eeab9d", 0x72}, {&(0x7f0000002ec0)="5e4ae78c302fcde23eade980810b85b3c90b13dced5de030d5d80684e1e08a", 0x1f}, {&(0x7f0000002f00)}, {&(0x7f0000002f40)="48847908cda39c28ff51b2a74576d903a8f28a7574f52e43c4657cc42b600038dfea2ed6e4630f51d51ddb699cbe8b37be630b543c4a04b491899d29b74fe0f58650626a3d371302a36665c16e9736135297b386fb123f451002628fc737fb7ec6fdadcbeed3353e956694f55c13605ff0b7c15c8cc8d6f39d2f2108acbfea2e9296937accf612ad349fbfa73ad8a7383cf27461b8f03acfbd1c04235b15a4e1733ed427dd4158d70eb855d4bce31be8d75f98665134018c2639ca69f0ffc6622c77dd0288117477c38b080a7f7e85c5c533b3a9c76742eeb8bf44459524142bbda9e605a817d9d168994ccd175ac1bae8f5efd110316352375fd7a7fc625ed2512a07cd3c2f7ace73980ee01a5614f87ff8f134f66a293b804b5c5d99d87c5f22e6e69b273f120050e82a674da340506e483ef59b8210bf293e99b89c9bf104b11bf516f19c8c8c9d804f17367e1c0ee5e783d33b00394a9666aa5c8e7173928012106673b0754def163211875d0a7a4651bec72432ea5ddc82f5db08579608d8e591466596b445ac8c89e0e9f30680f4b39f5872030cc1e1306f57a8b71a25ed93d4d37ddd84fa4cf5afc93a3932306e3a4295982b1947bdcdf60b1deadcf48a7a75c3d817c2d7076a14331606808cd02d3786da1c98f424b9d7305ee4b27e1bab286b7e73d63ada2311f4eaedc171a0ee9fe57ed9da40d69debe9898dded4523b4f9a7423075a0cb5f3f66fa34ef43f58dd34ac79deb093ee2fd5db797c04901c30443fda8fcf2b1968f7573f1a13b35758008ad2dcde457046754fd9d3701d5087ecdf1c031c44dd07a5cb79884ee5e1f0ce1d757e6d17c4f744ce508b64935fef5176d728399c490ef0d268751b850a87845ba1f439b36bda5d728895ea657527a32a3383c07ab7eb9199948e546ce339cd90694b45cf49b54030cae98dd1561edd8f8506af2746f2deeedeca6cbda01ad0e6bd2295fcae84760035b8f82e1c063069cd6aafad52c2521e7d49ccac4bd6018baf0b60072972c0f30034122263a7037dedcacc94e4611109051cef708f0de15cb8439357de466d0a8ece35b074167d27d6b1e8f92b72a8cda576b634eba1a1ce75b02e93d61ee3f636067b6b1c5b654620f1a23b9bf9ae53603f423744c6f7ab82c9478f705efe1c6c6ad8bd995c011763a44477913d5ed01094bb660d22971d426e3b7c1c840407294cda79ecaf2dfd9744f10525a4129ae3490a5d8493e5bba013a984f8a7a8c94fc897026ba5afc36ea24522ddd22800b3d80432a36ac3253bf2adfe1470882c8a98406f62fa2b6a1cf6e8c51e61ecbe4cd8ce74542a5adec9cf9d16d2a3805062714a7ecd078d815b0a11ac2ec00cd40ab0fe4aece32a62532b4631a32dcaaab48621b13d923c973ff4b7ec90095cb4fa8129c6c2bc190789aeabfc033b09c9232b0a8345638abee1b38f8806a880a63dbf3d6ff20aafa9401e6eb5f0379092a9990030a9af79b8914db799a70a35e976c2d6a8a3a23582df15155b12cc579206de5aee60b0446b81bda36ba06549ebdddd0ac75c7fdadbf1a47ae2637bc7ebaee5e6f6b5a796bb259c7bf06f12f4a8551e8b3356215ca7db47d7df35fa7f8b17e7da278dc8d3c04a6f3fc2edf0fee7e4627bef5b6b2f81a04ce7b569522202d323f555b98f4adf2957378b06b93c01b5d97e21603017a0e88a0eacbd63303c4ab16c2e63a6a03207026ce725c275e8c67ef6550652632f7695bd7c878c329469f4157371900e5de613a6fe1d34c65e3909f305eb0b22a5e285c401a2d03a269d885280e5a04c9f0d39d6f2efe22ae89390e8ab9d164948e176b03e0d7da8b65f36ee597622737d13efccc07843550edc76464c07aa3a28c3f155e10b68fe351e89e53a50a620224daba9f9bd24d55daff54fe9fb410dfdae141582b10e6fd8ba128e7fdddaa6b18cda9ea6550b486c626419d29856760c6b5330520f52082baed18aa78ebc677d987d8273d9e44ee0ca591f1eee8473558992feaf21ec0c6a52bd20144b5c839325e4c479f2c72233968f89037750ad8c4e64d353100ac1664e8f526ad18e2daee4d98f3351cffe1386540ef0c149614146b087648ecd8cc4b05e8062fab515d2d2bbb79b4faf8ce56c6e27b9de35b549509412ba6ea56150f77979550016753f9ccb4ae3628e8f87ff6cfca7aa3f7e166eab50a8956f338c59de0fb6b22b98a552f222dffe1951b3665d80db3da085c7a859216fee42ed0a94fd2883de43427a1d7bdee5ea681cf9b74850a8f769adaad1f8a8ad35c6edf888ba79954d8600eeb13e9d1c2b32b5ac98f78280898c83e7cffb908edde59ef2066295c281110f085a23ecd75c443c7fee857a2d4ac33f4692aed9953f307755be25487fce32eff5132dfd9f146ad8e9485c847c9426377538a0c728f5b9b3d1187d863fab0e0cd229ca54426605b31784d9c2a98b2d3509f6bcb9c52ed15b15fb607b9bb99509acb0857375558db470272b4ddccd2a37b61fba7020ee72b1600962c4e1482815dea1881f1874aaa7162a759bda8617b75dc9aa78084693cbd9386b9a604d4b728618da92766b0a57f90a50331508165b0e3a106fa96b31adbba87cd1f26b4bfe6cdb4f583fa4b4a127148803148e01e924ffe27c80b6258eb98109c835494409bbe4a7ea978f5faf8188716516ab97cee165617caa99d4e914e38650f8a3fd0996d79cbc08d132f37a694cae9c6dbc3ad3faaf04f8405b7a5b08d3c0cad46be68cf23ba896b9148e274b0e0f43c0db309e0928afafad834292fcd6dc62573ad7c450d6461c333d261536324f1e95211a7726591c64956f3061e80f815066f3aacd86783092a97db1256f1a7f69202deb923eae34956162f8062d4740993951bd5d9be33363e811a547f092663b31f5b5634374dc30233511f6a67ce06c68b3c69c3759dec9d744a6512e465c5ca9ae8cb836a03f2043f8cf07578bb22ecb1ee82dc9f2abbe59f8161a2acf35af2721954f00ed0ac6e5060599a18dde032a034085f04ac6df0f46ac8e257eb07275c85a776635507f06c2ec085f98271841433c21d387417bc4eb87507163618d9929c4b2f0f90baa4bbf3d887891d08ddfaf37584ed895ef615c5431a4587cb7348215b7859be8dd5da60d16e1c4a35ccac1cae2dda744dae26230da897e5765efdb22a7bfe0642301d1302c78cbf5d130a529749b133178a8d2ef1fe6623dcb14a63a3d7c600d6fc321d2704ab7994d9c1022febf3c4e49ff394c4063b2c4d4bf71c7f6fd620c281d9be2bdc477d211493ec8df2d98b74335d64c95cf68266c9a9dbdbc59f11e0d9b325aa1b1a9e115f1b35a3c3daa1595aef868f633a467805802d408e73a1299300a59207deeb07dd83cff36d820067e718c1d2f0f3c67641be2610a3069520d72da20e4f9bfdffdbde74e7352f8abbb8a5ebcf65893ad2f2f9c5276314231acad71a730cc4256ccd997959f014838af5fece651107ba55e8ec8d4363bca594c14ef16d53a6c8dc5fc3d3dfa5f6f32783d0c27968747db4ff399a22f435a52deafcb761461da76fa63f972f9437be83656f54c99792767628d6b782424a00b71d3222ef7f2a72d1137fa322d7824f6c78451481e7e59fb5a29cdae2c276febfbcd42cc48173f141b0f973517cc437f3f6643b119f01495673364b5ee3849fc4cb3663835a551b98c5f456b44358984c88a4c58cabc30130143dc4599eb723f77f7a6ff963d733da1d1165f6fec1b9efbaad6524ab3e32ae2738ea043abb4502ab48283c3acefa9cf17e17f99630e332a51192c4e2a551c89ac499f85139219efb3596613820bc2784d17ca1c68dd018ba5c48cd1ff01f27eed6ee7958d0b0f1db6648687deee7fd062cf4ec58001aa6992c17e3b54ebdf038d56b5a42fb0ef393b2915872eae5f1c932fba76b784d616c9361be877c2680f2327ab62f24e2633f5947dc42b49b44712c4c4c7fcb98f6cce2853d24f6f5e61944cb2b7c86002546d926829e222b6c61bf4af8cd36b4acd5efe1d56c66fa503f7313ef5f73166801197702ae4e5e6c60d5dd951016ac2a41fa2851f97e31dcd329a82e7a443f947e95dbca381557eb01165db05d539bc3fb043e763490148fd12980d5cd2f844bb968d9417c185f573203b6dcedb62f885010018522cd35b446dd49ed88a821bce5dacbbddf80c6b0d3c0786dd2f2827c7e71c4f99b8ea8b1a7a2220b1567b763295fee409c0b07fcbbbeda5bfb6948a81aad39496c446529ab3c4d97e2ed30e1c43b2a577fb33e99deadcc9079cda6b7997f7206e1bdcde8eb9e6a6ecb9e93183877166e72ace8f41a7b9c7adab2bfe8520dbe58e3fd1a7430fe6fb00925606a45ce4fe8e3fdd355a9ed1461227fbd940609529f070bd72a95fbd23f3e6254af999d5127e303c6a08fc692b8170df67bd765d30ea514c4874328681fdf10ddb96c74d9978c6c4f554c865c7fa0c9b0a7e99317b3bfd7dafa87dc0910275c13589817d8bffa35e1d579447b0d99f5138abff48a6842c57ed28d8d62aa618d7afabeb3a35bea4e55fbb89d819d3610e4ba61ab676770e0b0eaee982a072506f9f1e6ee6b38d0df68b5c31d9910cccf5762109e84997edea93f2595b30507406bf3e042d9641856e166a7c325d3c8c61fe60367001d0cd17bc95e78a61dc9ab6ca1fd2fe0aa379dd542ba683020fc9ba74d647144266e81d4c7cb08f4f55b9bb48b4eaa763c47dbea10a125dab7c013cbf9865da2052791ee0c3b1547576c216341469761d579fd0da06d91a34db77bc3b1430b4bd8a40984c8d30a8cc1ed097135c51f3215c3306935a39f74d7eb7817aaabf1b20e9e7252689a07b1d905b0eef7810025b5e5eb443ca9c2c4c656ebf8f94889ed3516e48611589d23ca70b06d249426f728b69121dfa85b1282b10db7cce4d7159cda1c1b392560bc0bd165b563403d759f8cc8dbb2014c48876ab0cae50625549fd8f56f39df53e36640411b00dae9dff0a1ce25eb32ec72a0cb26c8cc03f1d80c214e1b2833f1a0ae7bfa72f5b0df14df9dd3925f99c6d689105c17eb13c2297c38d04f8cf4dc635598a40ed0ad52b1d021667e9076a554e05e9443df2887f3d280bd05955ceebdbd9501058034b0b521b8662bbcb9f7a5b12512e90cc0b8ae438347d5e94ec7f06edc4a93fc385969ce858cfdaf447f8567849cf1d34383682612ddb49a34034f7dfd4bd25d68ebda95fc71c7fc55be78d448b344e500e3af2cc1cd05ea388c01f338ab8b928699a1d038ed8515e7eb554ad8773c348a77359c4d7b186508006af1938ec72431ce7e91f9296157bf81e06cc5821d9ef667f1357767c3539e1a5c7fd37e1962fcded54ed5badae87e5a518d5b53cbcaf5655212b61090a368a586d42e3621878fa75dc24a8749d3c5b58ee6cf60a4d4a1183695c05ece80f7b3ddfb800a5e0ec98f0afa5b9196129a9dfd3024e0161f6f21ec20beda95a43639ba5c30ba98242201ec0c396213ad5872b28683b4e718e734cdb203343f8a3560057f6c91b4e62ca162d5e1588a90518ee8fcfa8387f87d7c8fd8506a54c8a83964d0f33918407db9cfbff20cfe55b01ecb1f91b93568bb1ae0f237ea8df3119d15d505bc048b8c62b91919cf6d737bdbc9b97f0c6cde9dd26245d9cdb6682074ad325459bd0153cc9cf8dca6b0cbf47ce84669bb296315f3dd1d044b81fb6f615ae62db4899eaf1c2dd710bb947d2652e0a35bdc6751ecea03fc235bdc2385a214d24dc8886fe1fc9e08b3d7f04", 0x1000}, {&(0x7f0000003f40)="837e1e603166e954427de55b07f3481b1604c84c3f51226b7c35e9c00cfcd304b38bc5aef54241e2ed3efcacb75668df43d713fe0f0f94f128dfed4b5d880a8da7582f9769c25fa0e1d5a449a47aef9213e7106ba97e80c146b959583c9510be925cb747cc8b8462d9bb620e58f6cc4e47190f964255b2f5cb14edefacb7e0d29b375370840c8718c406cf7a24b446ddc601097497a29604ca958639747fab75e3ae7eeb8c5443ab64c50ffb8bc3b7c3aa5f", 0xb2}], 0x7, &(0x7f0000004080)=[@mark={{0x14, 0x1, 0x24, 0x2}}], 0x18}}, {{&(0x7f00000040c0)=@caif, 0x80, &(0x7f00000042c0)=[{&(0x7f0000004140)="62cf084cbe2bfc68130f4cf43ead5924c08925ee099c98edc47d7a9d845a39972a99a724e48efa42695cd092856195ee76eedfb8eba4cd9b871c40edafcfd597a0d02e71788db83dc4cf849696ccbc6a90a34e4dd273d414fad7ff124fe86f26a13ca5d035c3f2b21ff9eea29b01ea6d5bdec33096cf48ebaa349cfc80b5f914cfae6564b51d8ae8f781e8e178d08bbb471064373bc4894a428600d3ddff09f15eb5bb02e91d4ba54267b8d2f07792019734657b340892d4c43701d69f50951b718c35747500b8bd473210528595a7e0d6b3a42b48db5b270a4fabe06e45014f7b030aee7225fed87edcca80026badc9cd4e576a", 0xf4}, {&(0x7f0000004240)="4eb800a3b146935298c0b7611b7eff15227a015243c86df6af7969aaa447bd4ccc4e6e1039a537c9ed7a4c3bd4fd2c1a41cdf5964cfad4b6f9e0e35fd3b6762af119a1198d2e1d525cbb60cb05dd4940a8010a238bc1d4147067b50df841065723498416521afd676f01c1038b1fa3b88c34b0cd14c0b1c3b7c0", 0x7a}], 0x2}}], 0x5, 0x40000) write$P9_RWRITE(r3, &(0x7f0000001180)={0xb, 0x77, 0x2, 0x9}, 0xb) sendmsg$TIPC_NL_BEARER_DISABLE(r3, &(0x7f0000001100)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2208}, 0xc, &(0x7f0000000280)={&(0x7f00000044c0)={0x244, r5, 0x100, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0x50, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb1f7}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'ib', 0x3a, 'eql\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x0, 0x4, {{0x0, 0x1, @in6={0xa, 0x4e24, 0x7fffffff, @rand_addr="5c3fc80bd6c69e77cbc2726ab8194271", 0x3}}, {0x0, 0x2, @in={0x2, 0x4e23, @local}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3f}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x101}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x160, 0x5, [@TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x0, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x353}, @TIPC_NLA_PROP_WIN={0x0, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_MEDIA_PROP={0x24}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf79c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x0, 0x3, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x0, 0x3, 0x200}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf5e3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}]}, @TIPC_NLA_SOCK={0x28}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xff}]}]}, 0x244}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = dup(r8) r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r10, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_inet_SIOCGARP(r10, 0x8954, &(0x7f0000004440)={{0x2, 0x4e24, @remote}, {0x301, @remote}, 0x40, {0x2, 0x4e20, @multicast2}, 'ipddp0\x00'}) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:52 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0xe, 0x8, 0x7, 0x0, 0x20, r1, 0x9, [], 0x0, r3, 0x5}, 0x3c) sendfile(r0, r5, &(0x7f0000000000)=0x40100062, 0x4000400000000004) 03:44:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) ptrace$setregset(0x4205, r2, 0x200, &(0x7f0000000180)={&(0x7f0000000000)="56b06d34a2134bff851049053e7e8b1792f19e876f53b0dbf95d192c03ca19c751d0a1af1c7ba3254d6ee5d8a450d445305c978df55beefaebe5f6a070744b5e15c820ae51709a4ad566b09bb4d9aba4958d008afe405d047805e3439071e5b82ae59781e1f0970feeebb6872aa7bc7b0e08e35f5669444e775dfd32ac", 0x7d}) 03:44:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r3, &(0x7f0000000440)='cgroup.procs\x00\x05\xf0\x1f>\f\xee\xdbnC\x1d\x00O\x1b\x1f$\xfb\x13\xe0\xb1\x147\x12\xa8\xf5\xe7[\x8a\xc7\\\xdb\f\xdb\x1e\xe2\xf6\'\x14\xf2', 0x2, 0x0) ioctl$PIO_FONT(r3, 0x4b61, &(0x7f0000000180)="21c7b0430e72316824ba172b7a932b7771e1439f05c2944241b9beacd834be5f8a678188a674e3d081bd8766001c1dc4a8a034ade7147566a0597c17a0bb8d85dbbc1eb3b17076e380100435c2de5abf6afbde71e677bf7ac9f6109b949060cd8146e56c7c5043ba26a0d96aadd4f3170938c88815f7431ed67f937f4aac12f06224bb678528e9d826db5a97efef09fba14889f5021378c00ae30b8c0f267245b4548f48e7e74ac7ccab38b29675b5a5e10e2615c363f09338040335244180cdec2537cf53186a8c0978f23cf48f") ioctl$EVIOCSCLOCKID(r3, 0x400445a0, &(0x7f0000000000)=0x7) pipe(&(0x7f0000000040)={0xffffffffffffffff}) write$P9_RXATTRWALK(r2, &(0x7f0000000140)={0xf, 0x1f, 0x2, 0xdfaa}, 0xf) setsockopt$IP_VS_SO_SET_DEL(r4, 0x0, 0x484, &(0x7f0000000280)={0x2b, @local, 0x4e21, 0x0, 'dh\x00', 0x0, 0x9, 0x79}, 0x2c) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xb8, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="116348400000080000000000000000baffffffff0000000000180000000000000000000000000600000000000000d10600"/65, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYPTR64=&(0x7f0000000400)=ANY=[@ANYRESOCT=r5, @ANYPTR64=&(0x7f0000001680)=ANY=[@ANYPTR=&(0x7f0000000640)=ANY=[@ANYBLOB="c18e6418295e1e015a58faecaa8c4f3e737fe2daf6d026557c0b296fc42e78976a510151593f40fb61a9ee02d056eb67de29579727eef514f5494b7623cff993f2f07c29661e86bcced93d74369b56dc41b05842d998164d0cc75a2cd38275ce09e6c262b4c0f0e552c59d1e97927d893b279da3f392ea619613cc22640f5d0145141f031b1dce52ba5b87e6ac5e31824f5b50ee7847e09fac2876a1d1f38b75051823c05438a94e8b76c359686569bad83eec5d0fb947c4c82e8807f054651a03e4d9cd2d0ee67aedecf55ddbe77b3121d488cd83ebaac9b767c2b6cd93b3449e60a214cb98be29b82cb56cdf2fb17873e206ec1096dd8999776d18e8be42b608b23e0943e35a47b91507262fa10bfc8791bd9bf44f0deb613138c9950d2ccab193538e0368913c5e009f973a151dea8f9ee97dc25eb41eec69eca48a7ebc02e34e549fa0bf1383a1db5fd02b077633a93fe819f4ed8025212a0f68df1879cd3203839e23501f1e92be444dc7b20e27c8b6b260cbc106b8f736eb24ee4a1629eb22c84eca920ad4f16ee7cd81d1d180686083c3905cc34ddec59d4d797c442c8a49df425ba37a25273bc5e2b8a8f1478c9e7de3bca01f588c45a822ef180d1970cc8c791ee7e0efa05ca95b51a6aac09b1102a79a3b17af422b809fbebcee7b4d0771abea2ed2043c26b7078bfb919a8c7ae0c16334845a276db4baa2aa5999d121f29ea3bf8beddf2a4a994138d21ad8cca7aff4d4cc7e323ed59f82dcd58fdcc512441a5e77600a3bb0c94260c4f9ace017bc30a2f9cb23f86b2c8595453971be4d20fb19e633c297d3b3e0383e5f48d12c6af3f400483308b0d439a2d037c20d58127713efdb7d1b17b9f42e57ed4c15dd7a6e49a69c29bb2e097b40497978ca080ba00cbc6762e638bb7ad9b1f45342baf03cc0a6001d3de50a9c7b64c370e589eae2161891271c39d3e8d05986dce38bb8da71f086ec816798642e76fb2e4e0032a3ad85711d296340b46ca148410e6f7f0b094876026d7f0d6aafa8f0d5ba141dc4688dd10bca112dfdef3f3ed69ef5e9f2cacd7f2cb2c789fa167197b3b03a35fa0d8210d1ebc61c1f0c6531d7be7e0158eb83531c68323aeda753d6feb19ad5beda4fba6b289bb186fe0ef66365929530c5272ec7ccf17d5cf6a463594ef5e254eeccb1f8d8654a5b370db91c77ab5db6d8a27faa30b0bb7222ee471186db6f4d4e3cba5d3b2ee075449f57c97fa84c6184ff500cb6e5adc620f90880a0a3e0e2ff85049cc853691e982bd8186148cb69542aa8d04f8bc33937dc9543a8e25ab0504348db7d0e111213af0d0359fe7ed8623c3abc368419ec629d8b895f81ae08f990824531ce2f4b73553fb2e0afcbf3a9667da8094d518acb968d6b0a5c3a1116dd3ae5ea3b01df3c2f1150597ea57a87b66c96a8178aaa421bca87b5e0508c6cf0f4baf1947f31ec5efd353093f7d519660f55790db6352d25d5fd63379ce838da24b0c5c384e19868eee701583411d68a92e5ebc7596d75795bfed5107dc302c963547fd47d79ee9131de3a105916d949f31eac9207f5b4d0dfda0e154e1d42c682a9f5c9f1f4453dc613b936cf441acc6ff832dab0bc4bd47b1ddbc4c2abd9e4098cbc80270d8b1aa5e9985cd383dccaa9fd07f4d8fe63d29c97658243e45087ed40a3036bfb789724676f12d64fb09877508c5147b3e24b711a5c6b7591c73dba56d3ef7948444feaa167daeff8af95b93e743b4a6f94edcd0abaec50d7af11c863e0c5c82b3cbfead025fb99fbb816fb77cbf4d77c4300a0f6d94360bb9219dd88d07c005b03c8f7ad136dbac27cf3dd76228af9ada8e88d4c356237a55a8b8338b8b9c223d67667e36de343a630afdd9130d32e3389883da9fb1e1c9d9fa8955cf719c548adb34ff9f3be02489182f6161b08cf93ea8544e1196f0a6699e91adee5c9b2135ae5a89d580f6e3aa196e2ebdb2fb799471b3b78ae8ef5aa93d4389893e360aecb4238e0b071f488d307acd57e3adc1eb2ef73f4de7bb1c24f8dc381625250100c1cee1442c3381b87d0321df05f758eeac0a8ab42de60248c6bf6b27e6cc68c523a14f1c3a9cdf9901849703b80b69a414cd08a4547bdee7db4328291dd59e39b6d062e528556a40258e117efa4ff0007d10292b280abe93e00f17886dc06eb2c5104f9f5571bc2f8cdd5130dea6963f88f52572ec276b452ff380f4551d56d03e79a6efc0155e00bd7338d860a448dba64e1723fa7f559836b94c7cc31b26b639bd89627a098a4530c3f3e7382c30764773b05d9444b6e38863ce8ab9b3abcf2e8ba7475104423cca83e93ec9bfee03930e30bd5f5f8a615c547a7af5f114f0136023dd0e2a0cb3525ba2360ec51d62826400df02d35f752375c2baafbb3cbafe4cdae0537928a0b43ac6f14694704e0ebf7fd2a91e07be20a7927e7e253bbcbb0d461e212227af1fc63298c2f291261ce57f0b58654a6de99a406f0638e42b4e73669e718cb99b926b13a776adbbcb538046bb09569a62cef98851a5a9f77972c3871a588d05c82b5517ecace90e9369e6c60656ae8e200b223a9038632adb3e330b9321eba264a0c3dad4a8fc16a5bd0f1545a4cd905f1d43b14524f35804ca434076dd8a2ad707fe360bca4aef66b0392b2da885c2bbd31950fba74ddc6d05c244e729407c86115fd5f72a549e2a47f35f0d6acb69faf50e1f74daebed556a11350ef189b2855f257777ade939ad83fe0fe5bed803f73ca81b13c2535fe89771f34ccf375c779484d7833798f9e50f3c5e61e0f9e2c7326229139c77da2ea88894f0d98cb8111c4f555579e7b9bd7072882f0d7bdb64f2994f60ceddef45499ae0762aa0e27ae8a6f2340cd81403128dc15e498db1b267da8138cc77ae8d9a44c472ee9b1f1765f0d88e490e8893740d77b5005ac5cc77868cfea915be3234b8f2f09326478fa49235f2aba2074fa836d7601ef0d37da7c8ece8aa3725dd761ff44dab1f1db5dd3ec2ab851503c514f37e68718c2e1ae62f7693dc390da476ffd8709f64a54f89344a2fa23d7d55623b45310e9485ac79a2442b148124cca3fed32f12b8dc177e2dd6801913b793a371353f8e4721f94eaba24a82d49f636b0d6089ef492d34bb209f534002d9975c57cf9791762ad4eb630f9136d3581870b673bf763336bd4b2ba0e2d38a7b7d2cd945e44053fe046586ca5b568ee7dd2d944f96590a3f2db0a4df4e35ec4061a94a69f3498a1605e0ab6191ef4983024ffd6e14d7623e75fd2ecbd7dd4cc5ad3d1a276d80f6593fbf086f46a374cb43a0ca2ba8d72809e582aa1f5ff13a3bcb27a3b45b55ed943119f5014c3b8fcd55c30ec548ecd88c75e8bb6063966602895dccdb0d944571ecbf659078558c9e7688ac1dc6f57754497ffe0c237cdacc678b4d062f2f2d84b071c3d48292cd18ab887dde671cb0f926705476ed272b26e1dbc94487ecb317f96b3f730b83611881d6e3f802c9b92e39e774b76c95723b4f9c862b090fb204f04e0c2c36a11c7fef59a14ef8d80dfc3c34c15a39e5d50da00bdfb3de7ad02e2bcb6a907bcec0efd58e51d8377e02e95d39ecfe7834803c6bdb2d8a0e7e5d017bd5dbc8a19185c4e7e3ac87292aa5f1aa9ac82ea92ad93e924eae5f5f1eba2970d81642684fa76b6e35c20af0fa4907658f046de93e6d323bb638e92924a29cfc7ed21aee2dd08f75561829eefc48587ce80c291e244f92efd3945d1ed6ae8af44079e43cdb34e3acde123fc9a8b35ce7dd87f3d976de20127400511e21cb43dbcffcfcb5392b1cf1108e4da95576ad3952b7c670249a1cb0e26fdded57f03e90ff6d4d21245cf8acf1c006ef970a78e5282ddaf81087363d75555c699ee7c404596e0883959316b24f7506ca6db5019e34983bce741e71d22a9ed25d8d6dba75ee78fc6ecb1aa1a1aeeefed69746e7ac5991eaa99f86548356b391567e9ffc27f8dc27814cd3e397793bb779479b91bcac652f08a47b2d213fa34418af457aed0d9a59658c82f1af48b25dc5825577749c790915e2bb1498377bb65b54e84d7cec596fb468263a5fd005cf323353d04da15e1040da6e3238cfc00b7369024e492849ae1867b751e2dd41b92481151478231c41c179a0e220b6f58fc0bff1f30bf04cdea75e4221d0dc9fb928462ba0d685ef4cedef74f634a4d4e9a386f9a7c72e5403f1fff1ffdfbfb7b8cab5e466174c5fc0d38726e65679ccdd9b3518e7285ab8963084befdbed9832c41e0f32144025581856e51faa1ff45a425e7f2658352091ace9b8cca0a5ff905ff0e86942aca65661399f1fc7d6ae366db99af3052dbccad6e0ab8082b774ec65b0f9cd9d3acb038bcf37813801da434b72b5c9bdfc8d8abc015146a86c27eac2c26ab81bfae57d43f4a8a230d8f0c90d895b07132ef2cf4c7d6d290a2fa0fb3245e3e358759eac19444a482058d5a044d8f34cfa62969ffb1d69f5615d556f936196abcd90156e2c8e1964990813c90c7eeba85fc9e65748178e50f27e2b1e67a09c75782105e261d04807dd809b5c8dddad3282fa890cd7abe7eea4c4cdeb3d5ebef669fd35762284182d1c3641cc69f6940d8b681308cac087ac3b468b986765e81f0b4a05e921d0eb4c171cf3a914e1d24cef1310f0abab07b531b304cef09ac952bb83b28794f68a84dbc6a2de65def3d17838807868a7092aeee4d61d30dd602946870b6c4bde530e57d80c3b85542d3a12331a533ce401a3a6305146ea27c3ceac077f4a72fee96f68525a4cc3989e11170289ac6af49ec3bc1ec7de3381f8d5cdac4c9c6844e2b55f7568b6631c45a663e53817c1e68383c0b4134c35bd910f17c1b4862942cf3c085c9297f988b9447ba735acc7f4be3459252eef2231d562f1265977b674c9d7d36a3991d4b62573443db70129e334ee04dedd8f80c21ab20d97db8e197e8f0a7aa0c58422ce83a288ed9716fc9dfa365bf051d4147a48dc8fbc2d302064cfa9b8ab9f87a4668418de0f17ef5f05f30859e117862d779bdfb44d08decfa2fa6bff7e019e075f3546c5a1c3f1a793158880d6422f89c32555463e358db1db166e918bb1b0d0816bd2aff2106e7596ce2ffcf00ad1599587417b388c33a92204acc39b8a94a56a4d1b04cd982b332acb891467e2b93cab02e0bebd59ebe5091365996b553497cd75fd038977237d13c5656cd462ce675de9e3e02ee8c3e7f968bc859af85fbfea864f0ca44b71887b8878a92f4654596441d43f612579a06f97ee0c49ee3c797d39e891e4f5a5f5239ed30674656cd7b7997de9e3ead145732c5546d97e2168730f1514a336d7ab8373f168d01059e6b87951339e5cc4a51601933f6eba5e520022a7a576147647aeb5c128e3c9062840dcfc39e4f179c0a80cd189f53ea463dbaa1eda3e5ae08ab7919e2fcc6a3ffdc5559e44fb17e675c0c131bfc1a2ab251ed0b0be5a46ff4e388751b51c241816b9a1761db4db323f60e3e64cf0991fb22ce176558b2938deb0d7355fc76a7a2e6fbd099fb6542d22beafa650b7454798307d7a193e36c193ef33024a70898512f8f7bc840ef6c202d1221c3d7810e7229497fb17fb8125a8e99c0fecd7e1e38682b933578beebd7071eaf1ca037c09edf87558d7c80e8f6d3f32530cd32821be71530795dd815dead7d9fe496e2bc8881c5efd6321faabb7c8f6ec0a5a26b4dffa8326d6c82960197bc07c4dfa6709e1a0fdf5f9694a23b9634a5ab86e5edc90286314cdfeeecbeb1085882b62759e", @ANYPTR64=&(0x7f0000000500)=ANY=[@ANYBLOB="1b5cf59610af6685be677e8db7b6b5cc745f1ac10c3ff5518c0e8068de8bdc1114836ff71c221195b7266efa606deb8a67641de13ffc54a3c87f9ad1808634a33b3732693cc86476c7964e0c96c45e69f8dad81cd6b4616671da64b582aa63a8fcc037462f7d92e6cf0bbd85c3b94fcce79da95dc48dfb2159077ecaa6ae957c6b59d1011f0c484a6a7da9d51233a32e2a47ad965faa776b864dd49dbd00f0b721e83cfaff58acbcb9b5efd9331630b4f39981a5ccbf6208c0ef336f56910c01ff71b03d45d3ab3c922571ff3e2b4ce5e2a420847c8602b9e59e65498fca213ab2dca2f369"], @ANYPTR64=&(0x7f0000000600)=ANY=[@ANYPTR, @ANYPTR]], @ANYRES64=0x0, @ANYRESHEX, @ANYRES32, @ANYRESOCT=0x0], @ANYRES32=0x0]], @ANYBLOB="004979f292e69b2173e0620000000000aacf0c3cb29650bd8b06f1ea1c2ea9a4b84969d1f596c23f511b9cd66b4db9078bbe71a8d0548c77d5a682da97934b9524abe1139db5badd948023f5e1cab7cce12e8469a19f903ae79a6a8ced5b301c862eae377d56877ea4ab69c73badc0a245eedd16"], 0x0, 0x0, 0x0}) [ 2302.304252] binder: 31677:31678 got transaction with invalid data ptr [ 2302.306694] binder: 31682:31685 got transaction with invalid data ptr 03:44:52 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e21, 0x4, @mcast2, 0x4}, 0x1c) fchdir(r3) write$P9_RREMOVE(r3, &(0x7f0000000000)={0x7, 0x7b, 0x2}, 0x7) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl(0xfff, &(0x7f0000000080)='./file0\x00', r4, &(0x7f0000000240)="d114e85294a3567fb3a10dc0b76e00e1c09d64c00083b5f2a2a6b6a673603ac34426fcef3688a7a060d5f005c9fc0c235b7e67bd28ad2c949e0b05c51b206a6dfdc4f10743de1c25c35ca036b37adebaf4353e5ec9ff416c56f242ced3465728c141e9d72ae3ed0c1227f35e533ea6bda7cba06e43e8ab57fdf0a4b68579a3ba1894e6540535a0e245fa435760b7f1ec63a5120b66c62019457dff2d7685765a37d0325be64b15b34e362b10dd98c734795b349ae65dadf9ae4946d0b077ff2e33479876c22a0e5a0a7da48f1dc475cb85d27ef9504102d165044f91df7f66f4917b1fc13d64dbd0c069acdf5b68dc2ecaf623361698") r5 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)={0x2b4, r2, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xe07}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x10001}]}, @TIPC_NLA_BEARER={0xb4, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @empty}}, {0x14, 0x2, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x4, @dev={0xfe, 0x80, [], 0x11}, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x5, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x1, @mcast2, 0x1}}}}]}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1f}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd52}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2000000}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffa}]}, @TIPC_NLA_LINK={0x6c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x74f2}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0xf8, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xee79}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}]}, 0x2b4}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 2302.306721] binder: 31682:31685 transaction failed 29201/-14, size 99-24 line 3316 [ 2302.306859] binder: undelivered TRANSACTION_ERROR: 29201 [ 2302.344698] binder: 31683:31688 got transaction with out-of-order buffer fixup 03:44:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) pwrite64(r0, &(0x7f0000000000)="6af2724cf247e3cd83ef3d48e71ab8e6eff46487cf03d093cc7bbee4935f27bd6d1739ad718dcb402f715367e540685799a1", 0x32, 0x0) dup(0xffffffffffffffff) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) 03:44:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") tkill(0xffffffffffffffff, 0x1d) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x404002, 0x8) write$P9_RREADDIR(r3, &(0x7f0000000300)={0x2a, 0x29, 0x2, {0x8, [{{0x30, 0x4, 0x2}, 0x4, 0x9, 0x7, './file0'}]}}, 0x2a) fgetxattr(r2, &(0x7f0000000000)=@random={'osx.', '/dev/binder#\x00'}, &(0x7f0000000180)=""/72, 0x48) [ 2302.344728] binder: 31683:31688 transaction failed 29201/-22, size 104-24 line 3525 [ 2302.356474] binder: undelivered TRANSACTION_ERROR: 29201 [ 2302.390435] binder: 31690:31693 got transaction to invalid handle 03:44:52 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = dup3(r4, r2, 0x0) write$selinux_load(r5, &(0x7f0000000080)={0xf97cff8c, 0x8, 'SE Linux', "102be16327377adeda9c11d378611a742fbb52054768a520ac59ad232ef2b7d705f2c7ea6422421b11434cdd71a730301b99380386828ed0d203e8379659fb0c138ba0693bdb65c2ff052918b2e328394a37f199ad19eaf335dda183b5d5529b1293d775296e1be9352faeb2b8df"}, 0x7e) r6 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r6, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r7 = accept$inet6(r6, &(0x7f0000000000), &(0x7f0000000100)=0x1c) fsetxattr(r7, &(0x7f0000000140)=@random={'system.', '\x00'}, &(0x7f0000000180)='SE Linux', 0x8, 0x0) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2302.390446] binder: 31690:31693 transaction failed 29201/-22, size 393216-114360320 line 3138 [ 2302.390587] binder: undelivered TRANSACTION_ERROR: 29201 [ 2302.416402] binder: 31690:31695 got transaction to invalid handle 03:44:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder\x9e\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xfed2, 0x0, &(0x7f0000000100)=ANY=[@ANYRESDEC=r3, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRES64=r0], @ANYBLOB='\x00\x00\x00\x00\a\x00\x00\x00'], 0x0, 0x0, 0x0}) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$TUNGETDEVNETNS(r2, 0x54e3, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup3(r4, r5, 0x80000) [ 2302.416412] binder: 31690:31695 transaction failed 29201/-22, size 393216-114360320 line 3138 [ 2302.417162] binder: undelivered TRANSACTION_ERROR: 29201 [ 2302.429614] binder: 31694:31697 got transaction with out-of-order buffer fixup 03:44:52 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") dup(r3) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2302.429643] binder: 31694:31697 transaction failed 29201/-22, size 104-24 line 3525 [ 2302.429833] binder: undelivered TRANSACTION_ERROR: 29201 [ 2302.511745] binder: 31709:31712 got transaction with out-of-order buffer fixup [ 2302.511774] binder: 31709:31712 transaction failed 29201/-22, size 104-24 line 3525 [ 2302.513570] binder: undelivered TRANSACTION_ERROR: 29201 [ 2302.523647] binder: 31709:31715 ioctl 8912 20000040 returned -22 [ 2302.699788] binder: 31677:31678 transaction failed 29201/-14, size 99-24 line 3316 03:44:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) [ 2302.718294] binder: undelivered TRANSACTION_ERROR: 29201 03:44:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a747000000000000000000000000066ffffffffffffff00000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700000000fcffffff00"/104], @ANYPTR=&(0x7f0000001700)=ANY=[@ANYBLOB="000000000000e65ddece62a12f90e2330433009b6eb0a37d2c6221eb8b02e782"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000180)="3390a82d763c9a9995f3483627c0ae85fb319d5a67caed1f6fb5a3059961a67174ab20", 0x23, 0xfffffffffffffffb) r3 = request_key(&(0x7f00000001c0)='.dead\x00', &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000300)='$\x00', 0xfffffffffffffffc) socket(0xa, 0x80001, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) r8 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r8, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r9 = openat(r8, &(0x7f0000001600)='./file0\x00', 0x1, 0x60) ioctl$EVIOCGMASK(r9, 0x80104592, &(0x7f00000016c0)={0x1, 0x71, &(0x7f0000001640)="c1bced357fa254dd5d1189ce3daf0b481874b9d5ab8533170cbcef9f91b8882a68bfee4913bdef748a243c14ee276465e88cfc657f48f56f18a0b7f950ee69ca836dcba6abb6e5871d2b2fb97320e446945453b419fb958db668f6e46836eab2fbf4560a06253ce3942f59aa3bd832aa13"}) r10 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000001740)='/selinux/load\x00', 0x2, 0x0) fsetxattr$security_smack_transmute(r10, &(0x7f0000001780)='security.SMACK64TRANSMUTE\x00', &(0x7f00000017c0)='TRUE', 0x4, 0x2) setresuid(0x0, r7, 0x0) r11 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r11, r7, r5) r12 = add_key$user(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f00000003c0)="2b2051c8b56963c803aa04", 0xb, r11) keyctl$dh_compute(0x17, &(0x7f0000000400)={r2, r3, r12}, &(0x7f0000000440)=""/4096, 0x1000, &(0x7f0000001580)={&(0x7f0000001440)={'sha3-512\x00'}, &(0x7f0000001480)="9611c7cc0eac42185a848de515b907e9c3c2de20da0e26523c16352bdc26accfe3f57633dd3c0b653a2c82453580daefc8be0a35ad9a99c73baa6c59ce56526d9050504427ad82beea0e4e1505fa0deb53d5f17bda3d6cad76b7a3793d2046f4c0e31a1dc39357f658acbace2d95dcf60cb69ae420119a301e2ee64c3dfe7878067d3deeb6deabacbb5ae27c4b23bdd2ab7253a62e5695e7a23b784129a1bcc271ac369fd784938f4167ca8ae436e60acd8d76625014046247c7b51d9e3e2994efc2607b2c507775b01e4fe7120ef0fea34f22b3b877c4e477abe126dfb7fcc74df96ff0dfdcbc6284a37b980489", 0xee}) r13 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r13, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TCSETS(r13, 0x5402, &(0x7f00000015c0)={0x81, 0x7, 0xffffffff, 0x7ff, 0x8, 0x4, 0x0, 0x34, 0x1ff, 0x2, 0x0, 0x3e8951d}) 03:44:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r2 = gettid() tkill(r2, 0x3c) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r3 = getpid() sched_setattr(r3, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r4, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r6, 0x407, 0x0) write(r6, &(0x7f0000000340), 0x41395527) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r7 = open(&(0x7f00000000c0)='./file0\x00', 0x1ada42, 0x0) ftruncate(r7, 0x28007d) mount$fuse(0x0, 0x0, &(0x7f0000000240)='fuse\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="32700153ef4e26e2e3e3ef673e16dafac896c1a251f46189df8875ed5745439a0e76754fdcb449cfd9124f4da67e45518284dcc39e1a39812e08a6dbf7abf517d6d8c0bd511a04ad306657f4a6aee66026231000cb6024f9b3861f71621d108773e809491a756498da9074bb1105e6c0c012299f6364b16880dfacbcdc45e4e6e24eb15b96644eac15e02ed358b1c277cfcc2905c45e4eb93d3c3d8af8b8aab93927f35b2aebabbb82d32e11a28551a1b5b2d5c940", @ANYBLOB="020006007570016964", @ANYRESDEC=0x0]) sendfile(r7, r7, 0x0, 0x2008000fffffffe) tkill(r3, 0x12) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:52 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2302.769105] binder: 31729:31730 got transaction with invalid data ptr [ 2302.788974] binder: 31729:31730 transaction failed 29201/-14, size 99-24 line 3316 [ 2302.793708] devpts: called with bogus options 03:44:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0xc0406618, &(0x7f0000000000)={{0x3, 0x0, @reserved="48ab37a159573c1c7af5a43d7b768b62e29285dd085e56b47611d8cd594e0e3a"}}) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r3 = dup2(r1, r2) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000007640)={0x0, @broadcast, @empty}, &(0x7f0000007680)=0xc) recvfrom$packet(r3, &(0x7f0000000180)=""/230, 0xe6, 0x0, &(0x7f00000076c0)={0x11, 0x16, r4, 0x1, 0x0, 0x6, @random="b647650dc06e"}, 0x14) dup(0xffffffffffffffff) r5 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$RTC_EPOCH_SET(r5, 0x4008700e, 0x8) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") setsockopt$inet_icmp_ICMP_FILTER(r6, 0x1, 0x1, &(0x7f00000000c0)={0x40}, 0x4) [ 2302.796687] binder: 31731:31734 got transaction with invalid offset (6766095490170748928, min 0 max 104) or object. [ 2302.796712] binder: 31731:31734 transaction failed 29201/-22, size 104-24 line 3379 03:44:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r2 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xfffffffffffffffe) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x1100, 0x0) write$selinux_validatetrans(r4, &(0x7f0000000300)={'system_u:object_r:setfiles_exec_t:s0', 0x20, 'system_u:object_r:checkpolicy_exec_t:s0', 0x20, 0x4, 0x20, '/usr/lib/telepathy/mission-control-5\x00'}, 0x87) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)=0x0) r6 = pidfd_open(r5, 0x0) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r7, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_MCE_KILL(0x21, 0x0, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r9, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x54, 0x0, &(0x7f0000000580)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRES64=r4], @ANYRES64], @ANYRES16, @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYRES32, @ANYRESOCT, @ANYRESHEX=0x0, @ANYRESHEX=r7, @ANYBLOB="1712c42d9f4ff24628b9a03ae697174e99400c9149ae444e50279b251339a4514ae37b14ba7d996af2bc0446bddfeb8d72dbfa02bfca069ce503d67e4cb6092158590fd6776556a13ecb934f2c85da76abc55927ba582af19c0b67e92384ed32a736c27d2dbd3314f4bd2178021aa26d815d4b759674fee3aa165e7065dc5f2effff3d797828901235cf97f5dd3ca905c51d37e8b84b1e033fc9b2f362c3059aa264d01ea3b9417d2df89195b81f784a667f0caa102bb281885d99f84d692641c0bfeadcc29e23f1ef0a55ed6c07ae64c4562ab4fab858d836e616f94b5002b1d7e11ee9d5eb70e2a7510e4e2a64c53333fb7de7aa95726eb54ce34e", @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYRES16, @ANYRES16=r0, @ANYPTR, @ANYRES16=r2, @ANYRES16=r6, @ANYRESOCT=r8], @ANYRES64], @ANYRESOCT=r9, @ANYRESDEC=0x0, @ANYRESOCT=r3], 0x0, 0x0, 0x0}) 03:44:52 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r5 = dup2(r4, r3) setns(r5, 0x6000000) ioctl$KDMKTONE(r3, 0x4b30, 0xf85c) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2302.807261] binder: undelivered TRANSACTION_ERROR: 29201 [ 2302.894412] binder: undelivered TRANSACTION_ERROR: 29201 [ 2302.905050] binder: BINDER_SET_CONTEXT_MGR already set 03:44:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) timer_create(0x45329b9565de5219, &(0x7f0000000240)={0x0, 0x8, 0x2, @thr={&(0x7f0000000180)="5508894da01565b64a28a1f222fa492e28fcd1b746db87a1e75927af21ebf7073afb53c2867d957b67cbe79a5f863bbbaed6bfb30c0db421fa7963a75b6ea812e5dbd9e94b078ccaa023183c5e2b6287640389b91dc4366737987f3db3edbb8f7582b81b6dad9e5511c7839a1fb7eeae1aab65ed5be11e5ce6a5192cc092efdbd4807b", &(0x7f0000000300)="7211190e73dd4311589781f9480a9d29900c816855d22df5956f103c7706922a7e19a9804314388ec17698fd7f5974e8fd100bd924d3a84e60b2044b4d9ab3105bfb2f08f99240cedea7eb645ab46b37910634956e7f8b6b1bfaab5b12b63bc6bae2ebce5729268c2289f4187258c6be342fac9e7bc3dd06e3dead160c0f71e25ab9ccb927387c7c9f6f688c5fef15ef28c48212b046e4ebc162a2a02ef0cf"}}, &(0x7f0000000280)=0x0) timer_getoverrun(r3) r4 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:52 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$KDSETMODE(0xffffffffffffffff, 0x4b3a, 0x80000000000000) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socket$inet_udplite(0x2, 0x2, 0x88) fcntl$setstatus(r0, 0x4, 0x2800) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2302.927611] binder: 31744:31745 ioctl 40046207 0 returned -16 [ 2302.936667] binder: 31746:31751 unknown command 536871552 03:44:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffecc, 0x0, &(0x7f0000000040), 0xfffffffffffffe5c, 0x0, 0x0}) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r3, 0x40087705, &(0x7f0000000040)={0x6, 0x9}) 03:44:52 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x781800) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000140)=0x2) r1 = socket$inet6(0xa, 0x1, 0x40) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = dup(0xffffffffffffffff) ioctl$KDDISABIO(r5, 0x4b37) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000000)) sendfile(r1, r2, &(0x7f0000000040)=0x40100060, 0x4000400000000000) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x2, 0x80) ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f00000000c0)={0xc624, 0x2, 0xffff, 0xf4, 0x1}) prctl$PR_SET_SECUREBITS(0x1c, 0x4) [ 2302.936674] binder: 31746:31751 ioctl c0306201 200002c0 returned -22 [ 2302.955423] binder: 31744:31754 ioctl c0406618 20000000 returned -22 03:44:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB='\x00\x00\t\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 2303.016781] binder: 31756:31758 got transaction with invalid data ptr 03:44:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840030000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0000019aa94d8f06"], 0x0, 0x0, 0x0}) 03:44:53 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r4) setsockopt$inet_tcp_int(r4, 0x6, 0x9, &(0x7f0000000000)=0x101, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2303.016809] binder: 31756:31758 transaction failed 29201/-14, size 99-24 line 3316 [ 2303.017078] binder: undelivered TRANSACTION_ERROR: 29201 03:44:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r3 = fcntl$getown(r0, 0x9) write$cgroup_pid(r2, &(0x7f0000000000)=r3, 0x12) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r4, 0xc0506617, &(0x7f0000000180)={{0x3, 0x0, @descriptor="203030fe7a9bc34f"}, 0x15, [], "0b01b88b51fa069bbfab65ebb5d19fdec438cf8278"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="664509c1a01ae0b2f293000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:53 executing program 2: fstat(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x1, &(0x7f0000000040)=[r0]) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="852a7470000000000000000800000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a68770000000000000000000000000000000000000000705b76c3b4c886cf64dac7214016f71619d860c55e6f080a13c61ebc37ca1a09c57f649793b19d67ad4a5a77d3507f2641807683abfa5971fd9168f76922a1a45c4223e3d6c14336c255c675701ce60e16f8c73f4e3807d61f6908a05b8c80fc81082a0a"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000000)) [ 2303.065777] binder: 31764:31769 ioctl c0306201 20000000 returned -14 [ 2303.068688] binder_alloc: 31767: binder_alloc_buf size 589952 failed, no address space [ 2303.068695] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2303.068713] binder: 31767:31770 transaction failed 29201/-28, size 99-24 line 3284 [ 2303.068861] binder: undelivered TRANSACTION_ERROR: 29201 [ 2303.071756] binder: 31764:31771 ioctl c0306201 20000000 returned -14 [ 2303.146943] binder: 31776:31778 got transaction to invalid handle [ 2303.146952] binder: 31776:31778 transaction failed 29201/-22, size 104-24 line 3138 [ 2303.147253] binder: undelivered TRANSACTION_ERROR: 29201 [ 2303.147892] binder: 31776:31780 got transaction to invalid handle [ 2303.147901] binder: 31776:31780 transaction failed 29201/-22, size 104-24 line 3138 [ 2303.148123] binder: undelivered TRANSACTION_ERROR: 29201 [ 2303.216112] binder: 31782:31787 got transaction with invalid data ptr [ 2303.216158] binder: 31782:31787 transaction failed 29201/-14, size 99-24 line 3316 [ 2303.216489] binder: undelivered TRANSACTION_ERROR: 29201 [ 2303.244352] binder: 31786:31789 got transaction with out-of-order buffer fixup [ 2303.244375] binder: 31786:31789 transaction failed 29201/-22, size 104-24 line 3525 [ 2303.244521] binder: undelivered TRANSACTION_ERROR: 29201 [ 2303.258166] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.258176] binder: 31786:31791 ioctl 40046207 0 returned -16 03:44:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/access\x00', 0x2, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) sendfile(r2, r0, &(0x7f0000000080), 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000040)={0x0, 0x1, 0x1, 0x66, 0x8}) fchdir(r3) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) 03:44:53 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) eventfd(0x7fff) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) open(&(0x7f0000000000)='./file0\x00', 0x10000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040), 0x4000400000000000) 03:44:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup/syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r2, &(0x7f0000000340)='cpu.stat\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) clock_adjtime(0x0, &(0x7f0000000180)={0x200, 0xbd, 0x5, 0x80000000, 0x6, 0x7fff, 0x100000001, 0x5, 0xfffffffffffffffd, 0xfffffffffffffffa, 0x7, 0xff8000000000000, 0x8, 0x4, 0x0, 0x8, 0x2, 0x6, 0x101, 0x1, 0x400, 0x190, 0x9, 0x56a, 0x8, 0x100000000}) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000000)={0x5}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) ioctl$FS_IOC_MEASURE_VERITY(r3, 0xc0046686, &(0x7f0000000280)=ANY=[@ANYBLOB="00003900d2723b98f1af15329d0d6b98471c0ba76adff2fdbcd753cad6651c7da78e44d81ff9cee1ce0a7589546ea531c1aec11e60b0df593800000000"]) 03:44:53 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") socketpair(0x4, 0x1, 0x11, &(0x7f0000000b40)={0xffffffffffffffff}) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r8 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r7, 0x400454ce, r9) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) ptrace$setregs(0xd, r10, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r10, 0x0, 0x0) r11 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r12) r13 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r13, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r14 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r14, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r13, 0x400454ce, r15) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000d40)=0x0) r17 = geteuid() r18 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r18, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r19 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r19, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r18, 0x400454ce, r20) r21 = gettid() ptrace$setopts(0x4206, r21, 0x0, 0x0) tkill(r21, 0x3b) ptrace$setregs(0xd, r21, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r21, 0x0, 0x0) r22 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r22, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r23) r24 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r24, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r25 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r25, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r24, 0x400454ce, r26) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000001840)=0x0) r28 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r28, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r29 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r29, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r28, 0x400454ce, r30) r31 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r31, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r32) stat(&(0x7f0000001880)='./file0\x00', &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r34 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r34, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r35 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r35, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r36 = socket$packet(0x11, 0x3, 0x300) r37 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r37, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r38 = socket$nl_generic(0x10, 0x3, 0x10) r39 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000001980)={&(0x7f0000001940)='./file0\x00', 0x0, 0x10}, 0x10) r40 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r40, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r41 = gettid() ptrace$setopts(0x4206, r41, 0x0, 0x0) tkill(r41, 0x3b) ptrace$setregs(0xd, r41, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r41, 0x0, 0x0) r42 = perf_event_open(&(0x7f0000001a00)={0x6, 0x70, 0x0, 0x9, 0x0, 0x8, 0x0, 0x4, 0x8400, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x200, 0x98c62bff2fa0fd5a, @perf_bp={&(0x7f00000019c0), 0xb}, 0x200, 0x9, 0x56e, 0x6, 0x2, 0x6, 0x80e}, r41, 0x2, 0xffffffffffffffff, 0x9) r43 = gettid() ptrace$setopts(0x4206, r43, 0x0, 0x0) tkill(r43, 0x3b) ptrace$setregs(0xd, r43, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r43, 0x0, 0x0) r44 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r44, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r45) r46 = getegid() r47 = gettid() ptrace$setopts(0x4206, r47, 0x0, 0x0) tkill(r47, 0x3b) ptrace$setregs(0xd, r47, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r47, 0x0, 0x0) fstat(r1, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0x0}) r49 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r49, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r50 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r50, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r49, 0x400454ce, r51) r52 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r52, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r53 = openat$cgroup_int(r52, &(0x7f0000001b00)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) r54 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r54, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r55 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r55, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r56 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r56, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r57 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r57, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r58 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r58, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r59 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r59, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r60 = gettid() ptrace$setopts(0x4206, r60, 0x0, 0x0) tkill(r60, 0x3b) ptrace$setregs(0xd, r60, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r60, 0x0, 0x0) r61 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r61, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r62) r63 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r63, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r64 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r64, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r65 = openat$random(0xffffffffffffff9c, &(0x7f0000001fc0)='/dev/urandom\x00', 0x2, 0x0) r66 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r66, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r67 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r67, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r68 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r68, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r69 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r69, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r70 = gettid() ptrace$setopts(0x4206, r70, 0x0, 0x0) tkill(r70, 0x3b) ptrace$setregs(0xd, r70, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r70, 0x0, 0x0) r71 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x20, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x4}, 0x149e6, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r71, 0xc0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x0, 0x4}, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x7, 0x1, 0x2ff}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=0x100000001}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)='\x00', r72}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000002040)={r70, 0xffffffffffffffff, 0x0, 0x8, &(0x7f0000002000)='trusted\x00', r72}, 0x30) r74 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r74, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r75) r76 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r76, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00D\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r77 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r77, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x1b7) ioctl$TUNSETGROUP(r76, 0x400454ce, r78) fcntl$getownex(r1, 0x10, &(0x7f0000002080)={0x0, 0x0}) r80 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r80, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$sock_cred(r80, 0x1, 0x11, &(0x7f00000020c0)={0x0, 0x0}, &(0x7f0000002100)=0xc) r82 = getegid() sendmmsg$unix(r4, &(0x7f0000002200)=[{&(0x7f0000000b80)=@file={0x3, './file0\x00'}, 0x6e, &(0x7f0000000d00)=[{&(0x7f0000000c00)="76809904caf411887fd90068cf815e32a9ee1c093f726a", 0x17}, {&(0x7f0000000c40)="f927519552481e582a61a2c8f551a190acdb220878368c61758aa72da120ef74a3f75b1c6655d1811ad665cfb0ba3b8797f9d5e5499724b58067040388b1c553818430f806df190dc4bc74d429c604b606fe2d20e54ba8b9963733497cc60f0c4d1bd97a6202d1c7795419d547c783f9589441f43f506611b509dc73c8667b2889c79ef0", 0x84}], 0x2, &(0x7f0000000d80)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r6, r9}}}, @cred={{0x1c, 0x1, 0x2, {r10, r12, r15}}}, @cred={{0x1c, 0x1, 0x2, {r16, r17, r20}}}, @rights={{0x10}}], 0x70, 0x400a800}, {&(0x7f0000000e00)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001040)=[{&(0x7f0000000e80)="1a7aea", 0x3}, {&(0x7f0000000ec0)="4c9780082aec371530d4f76d620776a60319c35276c9c1f9ac3c9f4abbf5390bc5ef70d4c79b987ca156f8e774d59818aa3b4896453052bad8c02b5939eeac18de254e12736f7b935a69d733263c5d6d6899bd8e6cdefa0dd1ac52c4183157fe1fe2835135cde94b96a0981698446afd4045b76b7fede7b9ec3d8416b3e59426320254a3edada6496582e9de", 0x8c}, {&(0x7f0000000f80)="f4e65a765e3ab7242cb7335a019038b9fcca0f39b1dbbefc63b2b7aa57e066bd485af066c6ebe84cb16cb622b7ff33cb35998dafd993afe04c47e5bfd4d83444708384ba7f38f7b3d4ee3ed9ad298c9db5d60a4ef448529f56bfe4be1e860e45ecb692c434a8e6176bffa1d16ac5ca5f024e098008e0c6b783e60b18113f94d6fd25ac1d08e8043c408fc9e84606499df62f01d9abf44a077c2f28328072f867192f120e", 0xa4}], 0x3, &(0x7f0000001080)=[@cred={{0x1c, 0x1, 0x2, {r21, r23, r26}}}], 0x20, 0x4}, {&(0x7f00000010c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f00000017c0)=[{&(0x7f0000001140)="6b7c479b4d537c169e16a2db7afde83a4050f7f75a88468c800742e5f9d374f56a8091ecf15cae16a801c3a9e5a59fa9fa7cbe5d140a1c852116acdb342652f59c2b44670bf1b34f0aa11a7595866e1147773b54497e4776b3ae88be39c4c5ba9db7c2ecfce9ce0dbf267d1da951a8015ac96febbd70ab0852bb56d7f1694b5a1af4c3aeb352fae5cb01fccb77180ee13ea136842beb8ca28e8b8c57ba5400866a5fade6e2ffb555b6caea044e27602e6950825019cb4d38b6ea777c3c00b1b75f18b1f125b13340ac00eecd7c1e63d0ed9671fa66b518863b6674fdd86ef88af67c402ea92f6fd45c", 0xe9}, {&(0x7f0000001240)="cc247af01d665072a7e31774fe773db00512bc4515296389b882c1c83ec2170ed0fc61077c68402e914f29bd418e8ac6187af839e3dc50f7b487acfeb6839676310137e4be9bac4a63a15540caa61612812ca18d05e60f127f000f391815f2527d5475be8478bf1208a9cd3be525a7a20cb69f9f872b33390707be7bee4fda5580fe6f66aad8eccae302bc5f798340b452e287ed97c9d56f07f62e9de05b1aeac6ea8540f7bd8f5b9c67fae20fc353ba5c4a5e25c4cca47ea4b3dbf5274cc6c4a6bb35b28b8e5b7282a67604aef9ac0f30a17478b04d94e523f08aaf118a2e4c98dbafd010698b9f230a3bad4a334b82d80f", 0xf2}, {&(0x7f0000001340)="686b5a825a5fb215aa9a750982c0fd41749609457db001c4700e2ac1d4ab2e5169fd736e0d6385f09069a4a1159d3fbf3eeff1045e03bd07aac4ef135eebb4904e551f6cebff99c31d050bce2ca1443b771adb6663436495966ccda5fd1cbe598e73a3a6601c9beb28788ab5cebe9e83fd19cc11d51933d68c4e9700173ee13acb140d6685bf6c51880021a0f5f1e0ef7e238dc24e933e833134d328f4f3d9e63cc4de26911865613d2c255af28c826a5526ea7a247b4fb38c374e1118e0216c3c249b", 0xc3}, {&(0x7f0000001440)="05842a39e840cb5ca69dff21edfcec298fa4af0b00896c76d3694e7b585b51b3362b2c175660d8a3cf421f395256cef8dc6a676120b5e435c9c5d3183ff11def07af47ffc39be7f119d5faec97460ffded3ea20154c909092b5cee5b7909fad366ccae745d522103157fd3ba163ebb46196f670ca5a452ccfc57713015a3379eb0bdf578410d762fd94b0249bbd585723aff381add79c7b798c17ca5c40bd5379ff1148939f11fed3924a9001a87bdd51a1329d87d9d71", 0xb7}, {&(0x7f0000001500)="e787d14ed39e57f6ee9a1f94611fba4a7afaa55c8f4201fadc4e199c992ed5bc3f75d7146f4c49c219a766d460d9b275938628807cd2e20c774fad52fc8091687967a6ea8a5d9365a6deb5a387d6659a2c4f2d441b8a9d2a2bcc459fdf6be3d1d03928f5ba6818df7e058bfef8d320ab55185e5a18b12db96be06a39e8c63a99178f4048846bd8388552280b3b252d86542eb4a7ecffffcb02015c0dfa0cb5e67a78914a2205243a0567a810febb94bab761de1f7fff816078bea5ffc699b36313b9dd07c96b57a3", 0xc8}, {&(0x7f0000001600)="805422dd66e310531fdfe5e9e308785051e8abf241b65ccc16343888e59aad235f39c4f80d5886eb41bbd7fb0f003e4a0d9d4e3ea3211d6f28ea43c5ab7ccd7a933ab0d313b8d88c2f5290a502bbdeae7d7f15af099f9a67915c29061e00e71d463ddd6a4cd71bdc3a58d3e2e02ee64d63f11f3241e8362d899c17bd0a8502057c109a038f8245797b03bd341fb43edfcce1691130ae39b5b20487dc252b4d6c3a90bf5b62", 0xa5}, {&(0x7f00000016c0)="7788f9eb4913522e80f1d2ba5d6f343eef727e126ae6913b5cc66a3090c0010965c4d41f656fd46341eb5d9269abf07b045ef2842904eb42286aa0a9b50768757d74b1a9d44605f01487d125e2350fbd30d3b62aad77cf1e7da296dbd39c650fabffa6d6be05be698ab61de7b07f2202700fe69530e3cb1337420280ed2e4ea3db1322762ae7ef762c696520e768d18fe61522a3aa845d906b10b2cd125d385b2b6e04b32db82272cc6037084444cd7bc3ce024d9a7afdeb24ac5860b2525a70ec0496293f39dd60e4fdd69ee7f29b26b172f7c5f66a67d86d512a43dc4203beeb5eb62be6e3039f7690e562ea1753944d195bb423bad3d240ec9cb3", 0xfc}], 0x7, &(0x7f0000001b40)=[@cred={{0x1c, 0x1, 0x2, {r27, 0x0, r30}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r32, r33}}}, @rights={{0x28, 0x1, 0x1, [r34, r35, r36, r3, r37, r2]}}, @rights={{0x1c, 0x1, 0x1, [r38, r39, r0]}}, @rights={{0x1c, 0x1, 0x1, [r40, 0xffffffffffffffff, r42]}}, @cred={{0x1c, 0x1, 0x2, {r43, r45, r46}}}, @cred={{0x1c, 0x1, 0x2, {r47, r48, r51}}}, @rights={{0x28, 0x1, 0x1, [r53, r0, r54, r2, r55, r56]}}, @rights={{0x28, 0x1, 0x1, [r3, r1, r57, r58, r3, r59]}}, @cred={{0x1c, 0x1, 0x2, {r60, r62, 0xee01}}}], 0x158, 0x800}, {&(0x7f0000001cc0)=@file={0x2, './file0\x00'}, 0x6e, &(0x7f0000001f80)=[{&(0x7f0000001d40)="23824c5764ac8ab258203d29eb85bb242316905c8475808ba37338bb957788e6dd176c834da9e8c04319a608b0c0e38c71957a9cbce92a45c923a61f5283d59555fdb2a98fcb6824016e3247b9bcca0395f435ba04abbe665d8dd19a166281c011754ba098be5cdfe253dd4a9b812c1f780be8d47ddadb60b0dd02593ff25662c2243ce7800358e40cf6c8984c12043c7b543efde6b95d442e29169d470625ca5788311bba2a072bcb85a9b4671256cc9c40704f1e6ce9459f3477e49fabe731b5d9cfa14a1a812d7fd0d86ed82f9a91d46c97", 0xd3}, {&(0x7f0000001e40)="15d99624f7921e930c0dfc1b997c31bb8116798b02e295b23c054ec0c5b72322c59b9a5381a5120a7040aad19aec8927b051f1a357", 0x35}, {&(0x7f0000001e80)="d6bc3d7994c7f0e52cae6ba9ef2a1cb6d022541097051b72df70a9482917cef814632622b228ed80517baa9e45719467016121f2bf769216e31e777855f84d5c0dd67c5bf7a8226fd3b2236c2f60b799335d367ecc929f4cc275ab5fab1902b065a2b178f410fa0e95347c2042298ed77ad4d9b0ce0813989b44cc7e8d44a9c9e4bc8596918c05328a12f18ca6a8398a83fff2b1fa3d2923c2c5ac2c449c3cce1220f82059cb3131d7d48ee4bea7934b2835070611de7b6346883ef75bca0e14a680ca1795da7c2564b6ea4f1c356077092b775f", 0xd4}], 0x3, &(0x7f0000002140)=[@rights={{0x18, 0x1, 0x1, [r63, r64]}}, @rights={{0x18, 0x1, 0x1, [r65, r66]}}, @rights={{0x24, 0x1, 0x1, [r3, r67, 0xffffffffffffffff, r68, r69]}}, @cred={{0x1c, 0x1, 0x2, {r73, r75, r78}}}, @cred={{0x1c, 0x1, 0x2, {r79, r81, r82}}}], 0x98}], 0x4, 0x4001012) sendmsg(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="10d67e610612a8d0333f1f0bd733b8ddbdd9c7f4f7030d1372ad47d1f42cb5692eee6d7fa3fb39", 0x27}], 0x1, &(0x7f0000000140)=ANY=[@ANYBLOB="a8000000000000000c010000ffff000014e6a3b725c0c3e3640f9e3eb7d9812a3b8c0291a8d39acada714f88a267e7a017801c7d3e60f3e943fad1658d2ff31ea831cace87d70fa4133d00681a0463bbb0a074b194bcb0c5f15591418f126e51bf3f966ce7c8dc635e1645b917b9ac418a63caf91d1aad4d37fd5cf9809249f654a28038b610c2ea1ca6456d87156827db9038143d86d14f547939829bdf13125f4312b5458f2ec7f800000000000000880000001f000000e77ca969c5e5ff14f8a692cf344c76c1b3b47b787b964adc19cc02c724cf14ca9248075ead2bec513e57093f49f8ff817dd97e23ac0a3631608858347e77db14dbc121978870ad42eea1ddea5cb68499a7c7936a074516055e32d3d580ee6a0bebc97a5a36a4ad58e09875dd68ff67a874829e19f91527d2a71ef7926fb9e2441bfac8bfd38691a623f021066652941e092d3a5fec94a3d5aff297b5b3659fe62f06de9d412746353e6a89436238d5b76b1c57bcdee92a05160ee5a66f98c7b364539d0a443de41474cd42906d48510d6d941bbef0508e4d3b64183f6244123e5d4b7496540000000801000000000000090100000000008062baf772dd57059d2afc2ecb963b4742b7f4b15a3330e55f303ada5e2157bab1a26daf4f2134b38e035ac86f6c380614622b1f5f1bfcfc05adc00300000000000000b640b93a8c8ca468b34ff71f855f50b8238e50e264528d73ff0ac1a077490f0d37eeeeb0dac7cad7b1108b60aa0c550a8ca992dc6a2bedc68cf8b554aea6304954c2a9b4391756087f9fd4b2d563518cc52acf9388d9b9c6c7c5afd9ee1c4eb2a67cac4d859e26fe3579149a651335e2a48edb012279ab2bbfb8165c414ab8686e9c8922f34b78029e2a06f0fa782effbccb7c28e2de98392133722a6f86ff1e787c94c6867c5c6d591189c5906e610000000000000040000000000000000b010000ffffff7f139a166def88d354eaa22d2e935c6f5440ee92a228ac4d031fe7170b7bbc6e6103230f1e1a52c7a0ec489e0b00000000b8000000000000001401000003000000acac1bb446d7faaf6befa5ef16d64c47c6a48983126dd49bbda08f364ad28233307a3cd56ba0b6c8f761ac64148e1737a04124c8ed773731f064a688f3f278d31ced02a88059990bfd864c135f87ce8523f36ef5372db5eb5c0d7fe7f7ae8ff680affaf291219652789f5530afe17438cf6100f41131ee443fa1c4b4af3de63b162aee3c267c105aebfdad412da6a0eae9a4e05f554c81acae2321480bc4139e134ae102000000002800000000000000110000000800000848f8d2f24fcf00d62aa9da16b6456a4ebef1fe0d3be90000"], 0x3c8}, 0x800) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) 03:44:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r2) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f00000000c0)=0x1, 0x4) syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x61200, 0x80) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="2e04000000000000"], 0x0, 0x0, 0x0}) r5 = open(&(0x7f0000000100)='./file0\x00', 0x10001, 0x40) openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r5, 0x80e85411, &(0x7f0000000140)=""/95) 03:44:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000040)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="f4"}) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000012c0)={0x10, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="03630840", @ANYRES64=r5, @ANYBLOB="01634040"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000001440)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/4096, 0x0, 0x2, 0x39}, @fda={0x66646185, 0x1, 0x1, 0x1b}, @flat=@weak_binder={0x77622a85, 0x200, 0x2}}}, 0x1440}, @free_buffer={0x40086303, r5}, @exit_looper, @clear_death, @increfs_done={0x40106308, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/37, 0x0, 0x2, 0x17}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_binder={0x77622a85, 0xa}}, &(0x7f00000002c0)}}], 0xfffffffffffffcb5, 0x0, 0x0}) [ 2303.688912] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.694531] binder: 31744:31761 ioctl 40046207 0 returned -16 [ 2303.700883] binder: 31744:31745 ioctl c0406618 20000000 returned -22 [ 2303.753030] binder: 31798:31806 got transaction to invalid handle [ 2303.755820] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.755828] binder: 31803:31804 ioctl 40046207 0 returned -16 [ 2303.756121] binder: 31803:31804 got transaction with invalid data ptr [ 2303.756147] binder: 31803:31804 transaction failed 29201/-14, size 99-24 line 3316 [ 2303.757917] binder: undelivered TRANSACTION_ERROR: 29201 [ 2303.762183] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.762193] binder: 31803:31810 ioctl 40046207 0 returned -16 [ 2303.762510] binder: 31803:31804 got transaction with invalid data ptr [ 2303.762537] binder: 31803:31804 transaction failed 29201/-14, size 99-24 line 3316 [ 2303.763013] binder: undelivered TRANSACTION_ERROR: 29201 [ 2303.800110] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.800119] binder: 31814:31815 ioctl 40046207 0 returned -16 [ 2303.801505] binder: 31814:31815 got transaction with invalid data ptr [ 2303.801531] binder: 31814:31815 transaction failed 29201/-14, size 99-24 line 3316 [ 2303.801676] binder: undelivered TRANSACTION_ERROR: 29201 [ 2303.803031] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.803040] binder: 31814:31816 ioctl 40046207 0 returned -16 [ 2303.829206] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.829214] binder: 31817:31818 ioctl 40046207 0 returned -16 [ 2303.831010] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.831018] binder: 31817:31819 ioctl 40046207 0 returned -16 [ 2303.858575] binder: 31811:31820 BC_ACQUIRE_DONE node 13757 has no pending acquire request [ 2303.858585] binder: 31811:31820 got reply transaction with no transaction stack 03:44:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) mlockall(0x7) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000000)) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x40, 0x1, 0x80, 0x1ff}]}, 0x10) dup(0xffffffffffffffff) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000180)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000100)={0x0, 0xfb, 0x92, 0x4, 0x1, "ac79760fa32117d6a06e57c2a85018b6", "e950fd91f499b6ea4beaf30281e66ae5b9e3dc0cc0270e19fd375ea3c17a0884fcb756ca2ed5eafdfafb40ff2bd4899eeadf8873e7a84dd4d141deda3d3f840a2682bead1f3f83cec1035a89509bb649e44a2c8916a112399397449cc0465e2d62440c871a82ab3af52cefbbb63db2ae2ad2064b2497abc5baaee801f1"}, 0x92, 0x1) r1 = dup(0xffffffffffffffff) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000200)={&(0x7f00000001c0)='./file0\x00', 0x0, 0x8}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x52095ec87417f75b, 0x0, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0}) 03:44:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/create\x00', 0x2, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:53 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='\xc0\x14~\a\xbc\xdd\x97\xa8\x00\x00\x00\x01\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:53 executing program 2: setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000040)={0x2, 'nr0\x00', 0x2}, 0x18) r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x80, 0x0) ioctl$PPPIOCGDEBUG(r1, 0x80047441, &(0x7f0000000100)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470030000000000000000000000000000000000000000000000000000000000000000000000852a687700"/104], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="0000000000fe2f00"/24], @ANYBLOB="0000000000000000a88533609f6f3cd6de2e6dfe15d0ac7ae96ffc0ac8426d7b3754c606e35faa20e2d89dc0225dde3901a5363a605da461abbadc93f493e7e245af6a01b0d204cadcb4b510614efeb7970745177b52a88bdcbb9c862b07940773f78bc3833a5afa5349bfb1eb00f5a1c56465fa2b72a0b318c13f85"], 0x0, 0x0, 0x0}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000140)={0x0, @aes128}) 03:44:53 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000080)=0x1e) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2303.858592] binder: 31811:31820 transaction failed 29201/-71, size 0-0 line 3046 03:44:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) [ 2303.948562] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.960875] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.960883] binder: 31835:31836 ioctl 40046207 0 returned -16 03:44:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/policy\x00', 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r4) ioctl$PPPIOCGIDLE(r4, 0x8010743f, &(0x7f0000000180)) epoll_pwait(r3, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0x100, &(0x7f0000000000)={0x5}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xfffffe3d, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) 03:44:53 executing program 0: r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f00000001c0)) ioctl$RTC_PIE_OFF(r0, 0x7006) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x2000, 0x0) write$tun(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="0000050001013f00090058aaa7432d4f88acf3d23fc8c4f6d0acd858ad2ef7c5280e90dc5c45952d3932b5c7cb1cd9f71b216b17010001005e4d7f8a225a8a61784c34404ab9e8402d88446606f251339c7e50a1dbbfd022aed38a5d62af23f02c1aebdbc194018de8e08971f69131c4efd9b77fc38739cf15a6b5e3600a820d6ed3df68fd4a48745e8d5d61d2dfa2df15006f0528963997c52417eec034369c4ff4627b32d321460b6da9f9483e70032e2e1b0c94b6bb750d513581266df586a42286297e30cf3aca4ef80e98fd72fc21a89336ca4c2ba27be1fc1bd6be00000000000000000cd572ca9580e66109fc5cd48b03294f5564f56cc2d2dc06fea650bb7fcc9c627adbcf35c2a207a7cf70cbad68b9c172728760d9c791d37f438506da922d8e895e45c1c9a94f0000000000000000f0119a039a3ef7a19b0663f031240d962adc21170097daa5a6a8482345f1d7d87a4bc31c0062e90cbe7375435cbccc3d74e0a2f6a92181f808eb56a1ebcf1f5fc940d5163aeb7840b80fbfacf8a928bd2dcc3a9ee8150813630cbba697c0bc1b105241c789749eb346ebb7ba972b5ee5c5"], 0x98) io_setup(0x4, &(0x7f0000000140)=0x0) io_getevents(r3, 0x400, 0x4, &(0x7f0000000300)=[{}, {}, {}, {}], &(0x7f0000000180)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x669, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r6 = dup2(r5, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x40082406, &(0x7f0000002940)='\'\xc4\'\v\xec\xe4\t\xc5r\x12-\x90\xda\x9a\x94\x02\xec\xea\x10\x90\x03\xcb\xf8\x1b6\xa5t\xd6\xd3\x93\xd3\xdf\x85P\x19G7Q\v\xdcHv\x03Qa\xf3\xd4\xfc(\x83\xfb\xf8C\xf6\x8a$\xb1\x90\xeb\'~\xa0\xd8\xc8\xe8\x94#\xcd\xd5Kp\xbf\xc0\x8d7\x1b?A(\xe8^\x9c\xff\x0f\x1ck\xbc\x95\x05\xcd\x17\xf7\x15o\xd4\xdc4\x84uw\xa6w\x0f\xea`1\xec\xb4\x04\xd5\r\x8d\xde\x1f]\x15\xe5\xe8\xd00\xe5\x8d\x9c\x9ec+\x02\x1d\xffa5\x94\xab\xddNe\xfe\x8c\xc4q\xbb#f\xc1\xb9\x81W\xa4$)!\v\x9b\xa7\b\x91\xe5\xeb\x88\x1c\x0f\xb2.Tr\xe4\x99\x9e\x03\xb4\xd2\xf9KW\xce\xd1cC\xd5\xcf\x97\xa9\xeab\xda\xd6:\xa91q\xf7\xc5\xc0C\xd1\'\x89\xee\x84T:\x88x\xe2\x83\xf2r\xf4&t@\x9e\xa4qf\xdf\xf4\xb5\x01\\a\x85\xd3\xe0\xb7\n\xe7\xed\x84Q\xd7s\xcd4B\xcbQ\xa4\x9f[\x99\xdfJ%\xa8\xfc\xe3`\xc1JA\xc9\xbc\xd4~}\xce\xe8\xfejH\x8fb\xdd\xbcJ\vk\'\xe7Q\xfd\xaaA`\xb5\xa1\xe4\xf8\x9eG\xcfb\xe8@\x04\xe1\xf8\xacU)(S\xed\xffA\xfaqt\xb6-\x9b5\xf6\x1e\x13$e\n\xc7\x9b\xb0X\xb6\xd4\t\x99^^\xc2>J\x16\xd0\x8c\xecy*\xa0\a\xe9Ar\xa6\xb4n9j\xe5\xba\x8a\n\xce2\xcf_\x1b.t)\x8d09A[-\xf6\xe7\xe8\x1f\x92>\xb8\xd4>-\xacY\x9e\x88\x96\xa7\xfa\xdaoL\xa6\xec\xe8\xd5\xbfaf\xd7\xfc\x03\x91w)\xcd\x1f\xbe\xc9R\xcfz\x03\xec\br\x83\x8bM-\xf8X\xfd\"\xb4RV\x7f\xda\xd3\xd4h\x1c\xdb\xbe\xa4U\xec\xcd\'\xbc\xd22\x85{,\xe6-,6\x9d\x85\xb4fL\b\x98\xe9@\xee\xc2.\xb3\xd6w\x10\x94\xb5%D\xe8\r\xfe\x98G\x82\fx,\xa2J\x12\x03ec\xd5e-\x1f6\xe7\xb6\xd9\xcf0J\xed\xb7\x9b\xfd\xfc\x00EQ\x1f\x00D\xc95\xdeG +\x1bp\xf4\t\x94\x87\xf1ZbO\xa6\xe9\f`u\xda\xb3\x1d\xf9\x94\x80\xc1\x17\xde(_\xa7\xe7\x11\x9a\xac\x8c\xb1\xd71\xc5\xe9\xd3n\xc2\xa4\x98P\x9aF\xc2\x93\xad@\xa9h\x96\x1b]2\x88\xf3\xd8\xc798\x8c\x9f\xd4W4\xf1}\aD\xa0\xd8\xda\xf4\x1bEx(t|\xf4Y\xfaJ\xc2GS\xc9R\xb5\xda\xa8\x9b\xaa\x01\xe2~\xd8f.#\x94\xbf\x85z\xbf\xa0x62L\x1f\x91\xd2\x1e%\x88\x1f\f\xabb\x8ds\x93\x9e\xed\xd2\xdb\x02\x0e\xcf\xf5\xaf\xc8>+\x03e\xb7\xba\xb9}\xca\xfc\xe8\xed\x9b\xa2\x9ey\bMv\x8f\x8a8\xfd;\x9a5J\xee\x9a\xae\x83>$\x8a6\x05P\x8c\x05\xb8\r\xcf\xdd\x15/\xa9\xa1\xd4\x87{\xc9I4\xe3 i\xa4\xc5\xe5l\x03?\xfdM&\xc0a9}h\x8ef\x10!\xf0\x99\x80\xb72\xcc\x06\'+\xf0\xa1\a\xeeSGH\x12\x068S7s\xd3\xdaT\"\xa9jk\xed\xa2IyM\xa3&t\xfeA\xa9\"\xb4\xec\xdex\x00\x80`p\x91\x84\xbfK\xb6\x00\xa7\xa2\x06\xce\xc8X\x7f\xd1@\xf1\xcf\xdf\xae\xdb\r\xf6h\xdf\xc6+\xac\r\x9f\xc2D\xdf\xd6\xde`\xa4\xd1=\x1b\x8d\xf4\xbe#\tH\x06;a(`\xdcw\x1dc_\v\x046j\xf9`\r\xc0\a\x8d\x12:l\xc7j3E\xd7\xcaX\x97\xad\x93\xea\x99\xca\xd7m\xb8\x1e1\xb6Nz\"U/\x0eP\b=\x01W\xcd\xf1x\x85\xf4&\xe7\xf9W\x06\xa4\xf8&\xbc\xf4\xd0\xd2\xd1W\xee\x9a\xdd\xdbu\x0e\x9aV\xe2\xc5\x84`Bu\x12\xa8/=\x17\xc4F\x11\xdfm-)\xd9hc\xba\xb7\x91\xd9\x11\x9a,\x19\xf4]\xa7Y@B\x1f') bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) [ 2303.961012] binder: 31835:31836 got transaction with invalid offset (13508599858855936, min 0 max 104) or object. [ 2303.961037] binder: 31835:31836 transaction failed 29201/-22, size 104-24 line 3379 [ 2303.961228] binder: undelivered TRANSACTION_ERROR: 29201 [ 2303.966804] binder: 31798:31806 transaction failed 29201/-22, size 0-24 line 3138 [ 2303.970429] binder: undelivered TRANSACTION_ERROR: 29201 03:44:53 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNGETSNDBUF(0xffffffffffffffff, 0x800454d3, &(0x7f00000000c0)) r2 = dup(r1) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = openat(r2, &(0x7f00000001c0)='./file0\x00', 0x104, 0x0) write$FUSE_GETXATTR(r4, &(0x7f0000000200)={0x18, 0xfffffffffffffffe, 0x1, {0xcb2}}, 0x18) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fsetxattr$trusted_overlay_nlink(r3, &(0x7f0000000100)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'U+', 0x4a2}, 0x28, 0x1) r5 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/validatetrans\x00', 0x1, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r5, 0x40286608, &(0x7f0000000080)={0x3, 0x6ab, 0x80000000, 0x2, 0x2}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendfile(r0, 0xffffffffffffffff, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 2303.998380] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.059216] binder: 31843:31845 got transaction with out-of-order buffer fixup 03:44:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x40) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) link(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='./file0\x00') fchdir(r2) r3 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x6c, 0x0, &(0x7f0000000380)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/98, 0x62, 0x0, 0x40}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/18, 0x12, 0x1, 0x2}}, &(0x7f0000000200)={0x0, 0x28, 0x40}}}, @acquire_done={0x40106309, 0x2}, @free_buffer={0x40086303, r3}], 0x37, 0x0, &(0x7f0000000240)="15e0c02b34e54f31840079605bf6bc9c63b72e220f9f981e8a7e073c74079f18216fccde13a2682f8c718349e2a2f9155fca714e53d504"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0963104000000000000000000000000000000000126348400000000000000000000000ffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d4f3a9fd390d183b6db6084763cb2b93ee4bc63c07a19bc484f3e321ff38e94ad6f1d14aa403b4baed071c1b6a21f714c4224f0814a5dae08375b18c073c6c36dc20d0a9a7d031677ecab9a9b8e2725f6d90432452f6902d9063c4be9c6203174db8919b8af6df865f9a1e2ed3777fde92a037e1ebcf32767801b0435f7ff903185ee92739719cb4be347b83c1517bea08f6cad825c750bc4a6d44f82175d983be06530c9c53c665de0f448dcb60b4a6a8"], 0x0, 0x0, 0x0}) 03:44:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00001d4daa110cc2e9c4000000000000500000000000001a"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:44:54 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") request_key(&(0x7f0000000080)='pkcs7_test\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100)='pagemap\x00', 0xfffffffffffffffe) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x1) ioctl$EXT4_IOC_SETFLAGS(r4, 0x40086602, &(0x7f0000000000)=0x4000) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0xff, 0x0) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2304.059340] binder: 31843:31845 transaction failed 29201/-22, size 104-24 line 3525 [ 2304.059847] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.079197] binder: 31843:31847 got transaction with out-of-order buffer fixup [ 2304.079227] binder: 31843:31847 transaction failed 29201/-22, size 104-24 line 3525 [ 2304.084156] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.122154] binder: 31849:31853 unknown command 0 [ 2304.122163] binder: 31849:31853 ioctl c0306201 20000240 returned -22 [ 2304.138548] binder_alloc: 31855: binder_alloc_buf, no vma [ 2304.138567] binder: 31855:31858 transaction failed 29189/-3, size 104-24 line 3284 [ 2304.138818] binder: undelivered TRANSACTION_ERROR: 29189 [ 2304.215600] binder: 31861:31864 BC_ACQUIRE_DONE node 13773 has no pending acquire request [ 2304.215610] binder: 31861:31864 got reply transaction with no transaction stack [ 2304.215618] binder: 31861:31864 transaction failed 29201/-71, size 0-0 line 3046 [ 2304.215781] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.243840] binder: 31865:31868 got transaction with invalid offset (-4464173707495145472, min 0 max 120) or object. [ 2304.243875] binder: 31865:31868 transaction failed 29201/-22, size 120-24 line 3379 [ 2304.244036] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.257689] binder: 31865:31874 got transaction with invalid offset (-4464173707495145472, min 0 max 120) or object. [ 2304.257717] binder: 31865:31874 transaction failed 29201/-22, size 120-24 line 3379 [ 2304.258004] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.550595] binder: 31825:31828 ioctl 40046207 0 returned -16 [ 2304.568335] binder: BINDER_SET_CONTEXT_MGR already set [ 2304.574449] binder: 31825:31840 ioctl 40046207 0 returned -16 [ 2304.587899] binder: 31825:31840 got transaction with invalid data ptr 03:44:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$TCGETS2(r1, 0x802c542a, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:44:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle={0x77682a85, 0x1000}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, r4, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1f}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x6}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40890}, 0x50) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x201800}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)={0x100, r4, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0xffffffffffffffe6, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e25}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7f}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}]}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x11}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x401}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_INACT_CONNS={0x0, 0x8, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x254, 0x9, 0x9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5}]}, @IPVS_CMD_ATTR_SERVICE={0x70, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@empty}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x800}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1f}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x95}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}]}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x20}]}, 0x100}, 0x1, 0x0, 0x0, 0x40000}, 0x5) 03:44:54 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x1, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000080)={0x0, @rand_addr, @multicast2}, &(0x7f00000000c0)=0xc) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000100)={r2, @multicast1, @empty}, 0xc) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) sendfile(r3, r4, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) pkey_alloc(0x0, 0x3) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r7, 0x0) r8 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) r9 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r10) keyctl$chown(0x4, r8, r10, r5) r12 = request_key(&(0x7f0000000000)='blacklist\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)='/dev/binder#\x00', r8) r13 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000100)=0x374) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r14, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xed) setresuid(0x0, r15, 0x0) r16 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r16, r15, r11) keyctl$link(0x8, r12, r16) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000020b06986a41e86eaf34da3ead4152bf127b9754c60a49893a80000001b000000000000005e374481c4b58eb03f8bc2e51142fe2616b9782aa2518d684d83037b1f0b2e744cf5f6ae2abda20bf7c37e3b3f3e0d3b7c9be20f0afb975ba2993cffe8669ff3429b261b6298a04c1e2f068c2809402e68f3fbf82fc34e6451d668180cdcc14e057f3a7abc0a806c59b6a2ffbc27b8498a38700b84a3", @ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="02000000800000000000000000000000df0870985eb68e417f24e6aded1d9c692d86aa4f88a63ef4ed30d70b0598a14f9394208226deb3183ae3399561aa740f5aa24aecb9f6e5ec41974b9b7f08998c5cdf482fe4264f647cc54c3cca74911a15c4bb13ff00cc5f22"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r17 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r17, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r18 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/policy\x00', 0x0, 0x0) r19 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r18, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x30, r19, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x2, 0x9, 0x6, 0xbf4}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000146}, 0x4) sendmsg$TIPC_CMD_SET_NODE_ADDR(r17, &(0x7f0000000440)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x48000040}, 0xc, &(0x7f0000000400)={&(0x7f0000000200)={0x24, r19, 0x20, 0x70bd2c, 0x25dfdbfc, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x8495}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40011}, 0x762bb13749c59c91) [ 2304.605413] binder: 31825:31840 transaction failed 29201/-14, size 99-24 line 3316 [ 2304.620223] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.668418] binder: 31879:31884 BC_ACQUIRE_DONE node 13780 has no pending acquire request [ 2304.680637] binder: 31880:31885 got transaction with out-of-order buffer fixup 03:44:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x81, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="096310400000000045363d810269110200000033e22742001263484000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd9fe006deeb1f07"], 0x0, 0x0, 0x0}) [ 2304.692270] binder: 31882:31886 transaction failed 29201/-22, size -6679414483722525562-8482855289892492522 line 3284 [ 2304.697793] binder: BINDER_SET_CONTEXT_MGR already set [ 2304.697802] binder: 31883:31888 ioctl 40046207 0 returned -16 [ 2304.699402] binder: 31883:31888 got transaction with invalid data ptr [ 2304.699430] binder: 31883:31888 transaction failed 29201/-14, size 99-24 line 3316 [ 2304.699585] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.708852] binder: 31879:31884 got reply transaction with no transaction stack [ 2304.708864] binder: 31879:31884 transaction failed 29201/-71, size 0-0 line 3046 [ 2304.709807] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.712386] binder: BINDER_SET_CONTEXT_MGR already set [ 2304.712397] binder: 31883:31890 ioctl 40046207 0 returned -16 [ 2304.746875] binder: undelivered TRANSACTION_ERROR: 29201 03:44:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="44950e249b1fa4015fa00c54d6ba8fbbd87991aff5b29050d20fd09c962c4274b3b007df6c420f9c4cf5294072aaa63bd41d6a1a42ae2e7d95c9fea12a255a1c91d1f71c3e7d79b7546023c1efd1832e4e83bbd9a19702492f3d8a9e5438a70ca8ad6c71d1496593deeab76bd8"], 0x0, 0x0, 0x0}) 03:44:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) dup(0xffffffffffffffff) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") fcntl$setflags(r2, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="0100000000000000"], 0x0, 0x0, 0x0}) 03:44:54 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg(r4, &(0x7f0000002980)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="ee1466436c2c39f2b954157d14cb48c038dea3d610b6e3011f8b56ba77aba4a89cc9fde49da0e87e05afac55f6f0546ffc5c8b01ed14894186b12610ca92ec453677508a82a82fd019fe1379728a989a23a193f74e2361ab33cc224b6b6cfcede041a282659e49b21f38e988191b7d39da1b39a1c15756e1a29845c44513bd008c8defc39e5912a68d85b7401bd518a5807fa5a66ff8", 0x96}, {&(0x7f0000000240)="b634ff3aeb63b61b0d4e88311eef986a43dcb3c14c65eba09f2de464f058b80c32f5341e45870fe05a287bdabfdd84853ec8fbbaee3523475d032d7dbbd4e907b834d3c13ebf7c360db1ea2fc713aebebbd030ba633cffc7887fab71c83a846b897b0ce3e4497f1096c34ae9541315d5619d30bf722a9888ff6c70ee97d202d125d99aaac30664d301bdf349dbb1", 0x8e}, {&(0x7f0000000300)="99ccb9adbbad36eaab7eae2179cc9a878063330b87d0f6ce149d15dcf7a67f28680c40c3afebd82f11ea14e403b4df80d1756c6d9a3c762f644c89d7a9d41366a6ac429c46e83a23ee088494773265e370af726e22d176ccaf22fd8af6cc907c90bdb8bf6b6bc83269d049cabece9e959bad02e45c019643f2f17e8e50", 0x7d}], 0x3, &(0x7f0000000480)=[{0x70, 0x104, 0x2, "7134eb67a4279ff83618ea28bee4d516d1d0c65ee86f29599dc2ca6968186c15b5074c01040de9bafbd739000fc8272cd68f6e822815e53bc4f2d673a6fa2cd8bc6b60b05c7fc8651b61c33493640d43f8aa05f7398f112f8e89ef"}, {0x110, 0x84, 0x9c, "f4b7d266ac5cc046365f0719f256ed4336ebc2d1010e78d7d8e984e9f6d7e1bc3c6ea7dfbe891030e15596d306373c774eb4de6ffaf886fb39262e0e23da59b2e081e95a9eff3e727d174ed7bc09f5fde541b42ed31b190575036cd8c85f6a201d58e745e3b138088ca96c127de11138669fc7dd1f2e01cd9d3686cb7c7eb78c5a4fa405a2e218bdec78799bd7ccb10e0d379a7e80a22a3a4015df3a8372444862f947b0f1cd27fbf5f9bbe70aa08eb0b913b452c544f785966d28b269f62d346f6c5ac357f657db0a6fc8adda87bb4e0590147cb980b46f9625ee45fc395c15202728a9f181f5835ef6ab04caf3383289b1804d63d3c149713351621229"}, {0x18, 0x110, 0x8, "5803b7755605"}], 0x198}}, {{&(0x7f0000000380)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x7fff, 0x1, 0x2, 0x2, {0xa, 0x4e21, 0x0, @mcast2, 0xfffffffe}}}, 0x80, &(0x7f0000001800)=[{&(0x7f0000000640)="3a43e48478897153ab82e29e6cae6115e951a8e2e290a7a9471901d5d80c4e50b4b38145f837dacb13947bcd5cb7b6ae2238ad0562746c722797d4ed429fe3792e2c4ba5e6c3cc1eff90ddd1f303d2d07b2e7b579e277b7bd2d7f4af0777c318beb44ee918f18afe402feb15bc2f7f8a71ed4ced103e22273685c992f419822164f443e587eaed2fd8c68b8a602725d52d964c6f226850e9ec1513fc72a6ee25769468f930e960e337b32d691150f592e213a9f2933068a29ca90b47a9d81a42faaf4a82538960f23f7f01e8647bbc5f4fb87a64efe2cf901ced0576308cc45360b618378fc785f84b1ee5023b971f7300ad8f26790e2dd963e03a0b544bb44caf8654cda2e2d7e421999b0a0d00aad55e02a2bc836c4144ba58dea3e4a30d682edba89626197b697b492779adb1f6d339aa8b630235a581aad21e8bfe3e0c4d812970ea7cb0294ae221905ae97bc612885207a457c745b6789e901c44711a20a83837705584692fa9a5f20eb57c7a30f18613b90a364a714323e1241d48d9eb9defcf5e2677deea0555b3cb60915008ede073fa71e23a92347aa8a4474ca09e700563fd7e309feb676db83e36b3bbce60f906ad4192e3a79428805564074ab07aecb337a24d441df461ed02cd404642f563a678b7c3f6bbb5977559c46eeb840c2a3f35b2f472e30dd56dbae6c7b1b3995def754cb0eeada13ca0db86998ecb78caa1c75903bfae26c6b4fc55c67f05afc1b08491d257ed7df29100106503614bb507c9903c4f2d3a68613e91a8954159508633572b8e26a98358e7dcb551f307e05c347579d55128511a2647a0e99c68c0ba2333d7e226a861b24d2bce0900566cd67f2ec91bf1385b3cfdcaa5860472501a1a00fc2db049ab7bcb1a04cc2ee372cc0cf0e5025e06bef03edbd4f7fc244af431d392ea0581d943f66a440b7e3538855abd3d003a23114c9ca71a1d1ccceb5c0125f9ab72c25c1dbfb5f9cb7982afe31f9fcc9023d67f3e3d85e491bc9ec6dac475c5757aa2bef3e11c4f61aa3738482d63a4f2ce824121d681e944181b599a629e02dd5ef920d2e060d5ec274701571f5eac932661cfa6b22b7c2c70df21bc35f8c2a55c57320e5dd46f0979b5f944040df2c5976c7fdaf57ccdc5531ac519f6ab5fcd6c1a40de92ca56fbf6f8718716fadc23d9458e86937ffc2951a09607d642a3523831635d6e72fbed9823bd8e5c060abc04c0436bbf4dd5a46802f9285aec6f0dd54917fe21a0d80eb5df1ae641337c66a8fa7125297c10d805d96fd5ce419666ad30244aee7ce8227925953571e2fcddcc2712332c71305693d13cdddd2103f379d8b32d900dc13ac554045cb2858e295418b56ad23b302abc009668ee56e93dd447b8a35b855ed02fab6d24003b53af7ad0568a53726c584f8bab32b90f9d3726492ae569222188b41e7f5618923eed44ccb15f08931ca34d214daf98b14254274fe2240bb9762ca65d92585f823ddf9abd4435db9e1bb2fedd5b72fbc704ae7b2ee2d89f646752d27d5afbcbea1d43da4188fac5597c099553e7e7d3c6e88ac515e6690c2c0dc8a11c425e61d9025179ffe55fb235f2019c5ad442202e5df83af651447c255137ef1d0ac2b8963b9d483daa5590ca361a6705664d3d6cc1a20f2b525802decd04dfe635a44b4816e78ffe4a4b918f66848b39dfb96848c422852dd95f5efb7b31ad00a7bc0ca73cf42cd415b0f83694c5ac166f1f5daeb33f7200938085d6085e0d2fcca359d35847449238f67f2f7d5af479a09ef89326593153134df4977deb8e881105f0f710d85a3795c68d83403d55a07b807c123db0b0a1e97114025f9626fc056d4e6442662ba78d1fa9ef4b32cb6d3757ce24f7b78258b025512b00c6ea362589d5a0bad230bc4fb85988a8806d2b17bc99cec87c3cfb14685b9a46a45097aa07457f590eeb94bc989588597ea7c2d97757237e5ea9ab0d4334223e6cb6969ed85012f4f464b9d146c049eaa451b536016e1864a8b8881c3d20e6c62d12d98d7c471a909be79eb1e5d8fe071ea575ee0be6ef9b4f19f25cb9bd8d7dfea849c83bbf7304c9e2c99999ad349fe334a62902a87bb4123d44d33651d1444aa5c6fdb052d9155b39e325bcfc96ae0e377d059be5ef3a057868dd26736751f68089af1180f470f281438640bf25ee11bccb66ef27f3eb8ab00e6525d44ebe059259fc2d060b3b92c8650cbbad452c1b96bd65f3c338a216ade34be8a507c07ade3892389322d47187d9e30498bd844f519568df9873d7e01b5ba2b9da7a115c9eec82304ed8bb0d48ee5a1cfc783e94c59e4643b888d4815dceb8c8520cb500db3a1b38fa9402191cede1e9e150d53c49110899a054c16f23469170aa289bbc22abb102ec8c5b3fea4083e1979cef5b81fac060432fa555b1ce08be12e6c7a83ae7d44fe4e941154efe520fefb08e1a597c8be86a1d6b3ec0330d15bfff6b8f013e69e299e418fc4fe89a630088ebac500c143b1d147b24868c3c279bc99a8ef46d2151e3fcd7c904c2b36eb6d9ecdd305f43185a4516f6205ba3e53b3a579c116487729663e7175ec5bf5d5c69146b1c027859dbba4bad925be59192b6a33a4b6360bec71b80e6a9e5d9ca182262b4f47ed78accb97c05c59a26d79c16a912d8629b59d6a94b3218b0222f3c1bb866fd196dfe428c886cae315f6f1f5b0e6490cb0b95a8fbeeff28eaed61b89d3e816d1391e95df24b8472cd133215e116bf736f9ade3a5a27f22c72feeaf953a809e73a684bd0b408973afea9de7cde4140f22b0106e09c3e90e96d669e466b646e6b135f2b726348eac05c4287312d1c45b1f855dbfb5f12d0f7917ace5eaaa3bd45383fd8fafd8cd1856c26ba4ac6b5fe85dd885b55aeaf63c338711426a2e83f04e27808407f4bf0bb607c71fb34d89526f89b028b5e0ff8c0b9f5511adb1e8b433a662fed4a76255c32fc102ea1b3ba3219b3cb33f1158591b718e12741c4dbb850fe45ad0121f84f860c4c326a18e23ea390587e3dacfd494cdbe5fd8a2765dd3e52c24cc133fc407dd6f67efb204bc0fa46740a7e1e51d1baed0db44b77a522f5becece4b119ce274d3926978181db9004b240b3164d35d55d1acf099316755dc4e3351113a424dce2cd9650ab047f5696ab7238cc15186951aa556ba7207de396fba8eb41e9c5fa235b9aafc6c40a8864c59c0747c64d8a24523d7066a6656b992f630bdce3517890225f6f967c669f63a2c64563c7612084ebd573a2136f8453ecb8bfa046031cbf684faed4b2326d8325cf2819499ef0e6f6b218a4e3211b1e10620f79dcf2ccdceb550866b20c9ac1cff130647c60df696fc991a4d03c64654d1e0ae159c11cddfb3abc1cfb849d9a1e24185ca25bb02f5c3261e47494181bcea9e9533cc59ec321620542639ca65b0e82634d992c100db335f92663d4d3854222e552cb0adb64c7fc35886c20882b386ea4e32bb82bb3eebb5cb2c0c9c908b18dd8837296e842d6dc299ac09caf03524dd9d4353f36ffe68f41d71ad616368ad43acf86f83e6053901651f02d2e9ce18b57db347864c04ed57e97dd953396fa94b0cf9ee31ecd45a05edc6ddd5f197cc5057affaa81673fc789f024f00d1410be06dee7774bbe7ca9b987a1462f94b1e68ca8beece986a3df05f5bb6368504a4c03b6b55f53195a1993ecfff2a678ddd6532c89561a79c2d5ff443b058098517fda0d7cd3233b1e0c34e18d2e14ea2aa7f9012d9d483e106569300d39bc1e2e2628d7586853874f0f7feb36d42dd844749ad8ef3864f3e4cf23edf697430949e339c5936c5bd110ad4134d98560104871344dabd68c59874c087343e1307c861870b4781418f087055ceae6bb02ce90a558986807549692af8eaff89471cb381e6119984d1ca667c63156831a7a7d8722b61fdca2a70f3ba85780a41f891b89d63c61a96bb59df6d666f0737da9f5d7bdbb0df57430398c5f436551bb92325e9de8b9afcc9d4f0d90728e6f8b86b896597a1bf740c8f613e840e9f584dd2b3dad38666ea900451143a5c9f043c83dfc4193c9f43f73b556ca703a426b9bd5dbd9a3367df1e64cc9326c6baada79236ea6d3916ead680f1081be48510181f1a2da484f144a5cb07dcf3a2b627accd1ed563f6266495f5a3967b4630c51f23e3a53fe77dbbc155048ed25d5ea9169130a8a57b62662c5bbaaa25211713deaad2e43629e0ec8a4779443690407d18b5ea0ae65230038436532e8f9c17f0ed6c17879f8956df6ca7608a7e1e23c9eff804d9b5c0a45a84adfdc60fc952b66afbca06c85712aa8177f0b7120b3a12c3ac17a3eb95819d51f9449439927ca3c865b73b0312d94ddb70705b5fa03f200cee48028622df8d6cc73ce5f678d5475c2119cc119011425a12c962a3a31172421cea685886ceec3794f2a8feb736f33dac2c2bd0122bd12fcc965a5a6ee079175189ae154a2e10f6926045332915bb7fe89e16585bb08aa5bd4b8ca195f8e70a633d83f83072bfdc0f08f73b4f58edadb072de10cf4b1c962a963cd44a455b2dac0149d7087cdf625e826383160db7b39ca82d487d48959add3c7df83df3f862815452744803b56f6c4dd0d73663dc3efb974c975bd9b63bf8274a2d420a59cd72b461352d7ddd2eaaf452c85e8897fa839638760ff6691895b8d1d95c62a9b86e82de4aa2157a6f19ebb13f474a4e1a8c0d9eae3317c32c5a6a9a63e7fe2cd0b16f0dc58a924f96459b68455e2a863cc0702f141fa6b058d343a0fa5fa97def3494452e0e5a3cb34ecc4edaade50903fbb94e2f721d89461602581805ef10929b2808dbb06a6fd5c8918b90af8a9a9d3d3a673aaf47f7e4e66c676e1a22ce27084e36b717d0bd1a07fbcf9b41ee46b9be3e110a5e1a03c42e244254db5395718c758b1bb0134358eb973e3f7971ff188b6a9c7d3fe89b432ff1a92a3ec3b54ae98616675e671e168be657627d4e0b177daef9d6658da880764941728e5e0faa5dd0fa43bec06eacde8ea3905e08297db117f448b2e93e323339c6af27089f282a2c3bb3d97623c5d340ddf3f17041538a53b9082b8ea0c2e95e214180c562030496f3f0df369bfa7f89f9367ad7eb99e8390f961c69fff7f6cf1a876928197e419926f0b87a2b5d5699536a4d161478ba3a5c9d40b8dbb3a406df5a15c0a8b51a9ea4e4b1106e838bab3beb94a8b7764ad62c1ab5fd45e04623f02ccfd09789e540c189193db4be20cb63e044617ff040d45fc6c95a2bd0e36a9f73acb33162a4269698d84b5297b6d722fa8ace91429eb8469e4682430fee45f2ad20f38950a1397fe6ab4fde2ea47424d340f9429ee800df7217e90ddc611888ed5b65596f5500a72948256ab7886e8491cb7c0bc01d3be1ca8fdb5799431b63edd6b935d57ffaeefcc5914b9cb497bcddbddfbb3bd15874b9fc6e10010150381be6e9d2c2a8dcc7010be1fd0c10ba3558a55d045d9a502d4fca96719321cab73c41d4a55e4e496e3d13f998aaeb4998781000229d15791035e72193c1152773afccf6ce82fb9985ffb2bb28f59f554527a563da35c2b94cd8fb753dc9ed250f23e9c17969e5589cb6ac04948b7baf694f56560c57f91554e130c9958702c1c6c28ac151b38485036e21050e799c32454d58b5b72c1bf25609b5619168990fef27e99a612c6aa693f608b5570ba17ad5a237bb91c68b09732e2ea333c49a0ce23ef50f214bec1eb8f642d50414d831b3c9dca11f17ae670a05444bea98dbcbc25fe461ee98", 0x1000}, {&(0x7f0000001640)="91ddd2334230815add5fd5d1c0401b772ee461d57b8e5ec1faa17229a5c2e7bfd3201a849ce759b3b66af2014f71a1b32d8eb4617455512cc4b6b507612e9594eb1038425022c45b15456a52577542912026522bcbe3", 0x56}, {&(0x7f00000016c0)="80af294dca512de9ab0ae76701f21b641f0e4a59d5b4a2b18d527d1253c097c6ec0767dfcbb6a92c0e966fbd53e75c8afbd55b61a2f5eeb820acfb8b5a9537d27770d54ef01f050d5b5c27eb20552b13d99e3a0ceee0224327fdb8b2807c8d5a0d016bd1cac0d6081924e41d14d5fa83d0a110ac0396c148f44e969e2f92a6a572ce4476064c938c6ce261548ffdec27a074ff611f4be581516da5e77e77a4607d0d03c33e44ffe25096e3a06ffec54c2e75a38c507c479c1420e22288222e7b", 0xc0}, {&(0x7f0000000400)="73fabf02237dc3907aefb23102f4e31012a5a15ad6bd2df7e5b570470e1cc362574f18cbfb", 0x25}, {&(0x7f0000001780)="eae3dae2f841c275259c0f5f23c767d1856b86b231ce7a40d251643f57b272eee062a08fb69f3cebfba53e0a2957bc0be9b83a0e024ef2d0f3359db6ae928b5f8dcc89193c23f0650130f90673c2802991870a249d5fa033a9aa103202b1b856e7d4f30d47d29a0eebc80055", 0x6c}], 0x5, &(0x7f0000001880)=ANY=[@ANYBLOB="88000000000000001401000000020000dfd5fe4ff35807c5a332bee8362e8a1798d17d56edd24223f8e445490af6049f4d6e4d88d9114d98e1fdfb7e253e8c5b2dc3560169641656c077e8f22883e722ba068660e7421ac3c4fd1535391eb5954eb444e2ff7db05f26afe78fa20e32e3724f526b2b839c5ec4663761aeb17c6eee30c6000000000010100000000000000401000008000000fd305d989cacc142cf17683a23af3bdb10be5a1d10473d9148b5a53ac7592f5aabcdf3a13df5faaa0207c66311079f3b80eec99224b888ed7d3e249b3029c9e1ade264122a44db58f3436bf178f450424195e8cb4562f400b5def84ed0f12b529397c4e517ac04d14c56e21f6908b1f7a9ec3c315954dd843a99ceb38ef6fce7d83cf6e900f716561e2f2ef925065501f6eb48256d277c6247189f8c903a25c702e53443a767ed1441ba9fadf4baa0aaadecf3576d1a491434a7846a596dd1cd165e916889207ded8ab941699a1523ff16630a66e1043f1267bfa71ed2ff810703de8c9d68d829ff1453aae3f651f83ba5a5f32c679ee80a5b15420336347bd8b5fd10fb5a132805172873f9929c11774e4816deea0a52a9c146bcc9b831b2fe1955bd3c6ea62bde01467bf2693dfcbbaa281590b55dd81d3224354234f92d12353ff0ed0fe74802dd306f2790143adb864f3d3bd0583bc10d648a790d3b56a7925960e41f3ecedee38fc1f190926750eea3f7e7ac7f7d893cd20914ede44884490d2b93e3cb43bde7da298453cae1f78c17461f41bc03ff0e593d304717d7483794a1f6b7f986092ed132dbaf819f27f7fbeba80527917e9b4bde3c0c94ee4955bd1ef508257030e928b5cb3df37cbc9616b37d97783dba001ebe3a74423659a58a43df6531f7971a2d62dadcbb36af911b775d1bbfc6fb42384c8f283f5bee4044f2617aef78fa57f3f73fffb55aba64102bd4515b7c8c1b6de9eae284c4945f71031c654af194c4850bb9deed6ad1b4aea3728051a6a98e606c2bd9f8df0aee8e9b64e321895bb990e99c7996a8de8fa32e21b4c16f7389b0219739a643370ce4e7d9e7929a0ad8769eae2949176766ec77712c5cd0179489ca884abfed131ee14434dda7297f9003351b1b8d1fc972139f504b6cb9c0fc0b7659ae1cab8fdaf12a71641d15f642794ab625985918dd205fe759abf93be8271f02cddbd333bebbe1035409f9ddd57e6b4844be8c973591ef7849e6a9aacab7db43c239db55f88c00b374adce5ce92f17e441c9442d44eeafb006e1933eb0b9b9f31401833994c65e1ec508d307b6e1e5404ac8ea09da339c5f7bc304aca1dc5d51add1837018f678b4f4cf4907465dd784000584dbf869d8e420a55d59536ba3deb95ff46eb0404c0b4aa950bafc3944627cd13485afe2ba0203cb2be471fc9420d0f56f5ddc9f9e8835dcc6879cfcaab4334a1d928022c2d1e3393b5b51943f56e0dc4830bc2329e617583bd15d107b33c6477b973b3372fa92b5c45ca4c6456a14489f55096300af38946e96f06c33066ee9f832de172cfac99fde225bcdf358f27c3fec723e057e25288addcba918af95342bc1d7b6a38d82d29335b0de92582c8d42d6a46124d2448da49185f33c2f0da431686d3fab427077acddb527605ffb18127bc2e6e467a98deac10fe2956974b4297b35806f634657876e53941df2d438123fc7f928a585ecf4edd456a79a452a8d1987cb74102d31894a2505984bc6365f29653c483d15183c7786b646809aef0f8689279e67ca11a593f248c96ca2d8c074c9a24335f27bc683d7693c94d62bafd46e0773f0e4b169e2f486e68c39f8de7c04833f281cd5ce00e15d4e1e444badfcdf5f96a937be02c932c93b552ca5526a25d698551b1b117dec8e63be00bd262ff93784b470a807f74612036cacb2200416c6f1138d64aab799f97c1ca109e3a6d8eaaf32dbf53f1f669532636f82474aa31beb8034ab522438e5f9aee54c56b5e944b2703efd4da09cfb4dea4cb9340b5997b10f5f856eef5600dd85f75531ef9b21cd3e13a3c8d2e92fe5624447e8e8371683c46d3f355dedbedd62b161d047d0b672728b2f97bea4b09a6ad4207f86a5887fe9bdfc8d737a3de9da150a64a31715ec4f1ea956ed3140a95b821d28a34de84563709d185b74d88813348de19ba86501bff8f628685f35baeac2db9bc7cae7bc67bf2db9b040cc0ae692bdd3d7e6dc6860cd792e226c843c087e38b95d3d2b6be0538879fe03762cb827602a024ce0d89b2146ff837a81ae33b46f1b02ce98bfba91372fa3f3f0c736b6ca44a026d998d44dc9c4fc4cd8505cf8ea399fca01d0c78a17c79c2fe2c9f8aaeb19827d15157d35f907f7eb7e500ef685a26018eaf3ea04ad933e0cd002bbd344ec122385927baf3ea8cabc4958cf023742a42da0a0f2679e80947c01df7a967009bf9edaa405970174e53b801709f0f43875a9f589b6ff2fc01cb1e0e0a80e0589ecc651caf0616ad9439ada9de5f327862689fc7c96dc096a66d0c6a91d0fab985e23bc4b8bbbf80c6bf092cb5d4b47cca895d00a86acede3fcbf06d0ff14f37322933ff7e9994878deb5d918d01df1e738132e1a7d780af1b4d8b205d6f78dbe4385db9235f1f91b6b47cce3cf90e8d5f4a49015ca16e7c9d7ecb716845e6343890a4288a36cfb1a2429da7d002e954748246601b4aa1bc9a15a9bf694a7a6e618fe60ab07858ce1fa666b38f59efc553f59156a31984677f4854e3d50cb1db49b979d9f64920ba4d951103caf6df44902d914991fdf5af541c33966fad8e5de1a8eddd27ce8a6bde72aaf644efddebaacda895ad9b0e925adcb352efd5647a921b95b65c7b34dd05d18fecb2c614211e28477612976d0592f437860953b24172148563b903aa5dc5395b528ee65f793cf74a680b9cbf055f92acdf47cbf1c8e9d5f074296b543ab87ad5970a520947919aa1328b4e527bbf21c9fb32edb8295fe4d007e3826cff722f5820d87f420300c2bca3f03d30a558f44d0df185c72847d5aa5500ec03f4f290c27a17bdefa2b0e70c6aa48d125ab5bf133c10fbd026d2d258cc6cf2ed83e352696a374cd610423436940ff90fe8be47093236056c8fea22031b18c7898c9f1763382f1c0e72083345757319bc2af98ca1847f379b29570dc71e9e7e8a056421a14955fe41284a81b5fa45d93b043edcaf3a70f3a166137c2f0068fd2b8e0112c1b432582f8a7c10cad466a75478bdd2d1aba9f714d55356816f211671e9a16799c4762cd7dc944c2e949a22ebb3a58557430be5e6eb631a918ac17ba40d5907941d7e571f7913893e8be42c576605c688d017faba9813f6a7503891fbe6a56ccba85a65562a91ffbca975b429135c7e89ea01d338c7e54c87756fafbe07645210f2d2b5f291a194e642cfcfba43c0f2fdda6b66f511cbe4d67af4391490461340904df01a43a805c3f0a3ed91f8d17e72b6c9a028ca489ffd69f32f8ab6ad2b15463b3482cbca33235fcc873426fb6a88cb8e15504702bc5bdfac32cb5e6d97347197688c1fbb9d6de269303b242b0dd10a93c05cb2a8308c7672aea74aaaa5903e9450b9056ba4d2d219fd649ad665f6a6c0f4337943e5eab11d9751a21dded6ac92893ba502e490236d26b5d605e4fe0962047ab98572295663248eca36408bac32d9d181b91bb04f25d01e0eea0c6a83e2d2c1a194b93f9b0718f96d3785b33ba62c1bc8c05b7cc9e7a5a78eeaece2d4fc1cb6c83f276375bd1011ee5cb7d118c0514c65cf3fb493121ea50daa013168ced48edc77a2191fbe240a62ce968a082c74ae86ac7d2761c956a4c3b2001e837e06296a38881db78310ed0428299f5b360bb3298d0543eda733c4d3aafa2916cc026cdaa16488244bd07c36b7c5d4a0896db8012e0f17005cce8d811d70d3557d778f6ee20469cad546c41e768468085769e0aef6eed49c6f72875591b3e7c633f0e0a3276ecfeb99a37a03a239ae15b2cf663bbc895b5dcad9b25b2ebf6345d43da282a2c9f33e91f72c19f7a72e53f7b32cc53b4b7c6f2f9e38cd96d57afc9fe44fe50dd82c294c416e2f21abb0acdc125d4db25f9d96325b91b73009315d22bb017f2f51ca9dd0699f48f684a158f1c3e94b146dbc0d9898d3b773b40aed0eb74cbf8060ca761ec61bfe154e2eafbfde4da265a62e0d3c158a103947769202d70cc28d53cd6ff3b54d5a208db878f8d420bb59f531836bac344982a213a12e6ed3a876048aa38d553b3935cbed0bccbe941e7f87b757f3f6143d29b59040077e8f83f6048a1b39616ec3a45e11214587bb2774b6050db8774f958cf94b31b87024293ee458c7bbea293480a6fa130ac6ccbad64ace82b03000056e3b052c2b030678e81859079096382fe26330faae604d6e2000ac6c7ecd1b4717d8b1b2145465d4f5c7b1ef0dc6e8e36327140f5d58e9bb89d0ba4616b0dc3485184281a10f8b9133ad10bb2d83fdaf8606a5d3e66e500453bf7537c4863f953de48e136d7c8d6ecd3db41f22276309f7ff504db6d038f5db30afe0562cc4f60a8fc20182818fd25b953125262572b1a5fc832cce2eafdfac6fd2bd6aeea37d9a810153bad3f27ad492e82a979cc22262e54a6724bbd05b9b1bb098a7658c0e68d2c3b3bdbcb4b5f53c011d665371ee3520d3c2e18f277ef1f3bf826d882ea58b67cf2c54714d7ba9a13e72c2000b80cdd42eb9bdb61567916e2f6e7f0a5cef14723b32db8e99e31434880f18b5d61e2745a0b5b8ae622dcf3f7299db81a332eb91db8fd1092c04f36cb3da541151952c7a975afd48004dfc111a49cc53e980b48e7e233e0541174b482a9f0adb84efef2c5ef95c8a0188f0f2de56fe172ee0a0373c5c3885c68a31c8ba49ace3bd6af509ef72fbf03206b546ddf759fc21b45be6a1cb2cae13efdf4231e93b6380b7dca2cad749b5d7cf9dcf2ee897fe2e94e43aacd87c54787efac0cd9424ffb1d2c54925dc30b98b3f2a5503a2a0b652de2088236916e49a2dfdf0c1de95d37b061ea22a4a45c093c178828fde7d6a08bf4865ae8c3bda63582a4bf8f115c92452ef0e09d2cd72e021142fb5b9264f5546c9f3901bb58a74b97610f5e6c67300711c3e27cb82e2fd19670a49122a522744e1cba3b1e70e262d5533e5779783f8f2d8789b16c19989503e32411c92100b8ac9bd11916e081edcf8d25bd8d63f21a3f612c9735f69185780335083a69b71bd0fd18f8ff3faea4ef711037ab36ce44a37c81ffe1e5cea3c5f37806c28aaaa964e6820f37249491bb23f17883d70ad0df8e10ef44ccdbdaf8102ef429468f77e5762a970ab201437d3f18ea4106c845e2a122f3aebd9c105edc7fe81bded2aea811d0da559f789c4350595a382f6d327d42b07f56a99761a00499602f3bc08fdc7b49ebd6713ef339e968cad8383055cd78f790130b18a0fc80d0953dfc946cee3e061c4a6cffdb4c40c5a5d55e871c82c046ac4d795d60fc526a9ad5c42716953efe1e5883798f2556827af659c305c65c59e85410e7d182114b652ffc629745a9794ef981f0533016ca5031cada0d95ee866df57836fb03b1840dae3331e46262155a4f1e94c2c9c083269397cb998f2a097483e5628a98e69aadefc669fcfec0357e1074a61dd991301e48d8a3fd710d5b32e4b8287452cdc88e3ec26f1519c77143cf99dd4f8e7ab91ea2e2958e6aab65bf5fabcb9152aa2487cbb4f4d2495667e67c0b25402ce9801ab656b481fe4708ff9958c0e4f0b02fcffafb4bb3f1e85f624938e89455c3232d1767463e590929be8634ee37cf2cd8f24aba217f9978467e555b93084c0859bc46767406bcd28fca28e320f2809c7aefb03a8c6a2504f6d81a961b3c3f097053f80d758800b8e2a37a62bf91174d546a5197e4b88b21451ca6fa46697641a05dc2c24191872646a625278302952b725cb5271e46adcef042c59cc3ce5c130ff0400000000000000006000000bb000000336d52a5cbb50b1ab6496649cc4aaeeb34a4ef43a46127e4664838ded73d14262f5596838772a197a809a901fda3fa3f4990509843000000000000000000"], 0x10d8}}], 0x2, 0x4084401) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r6) write$cgroup_type(r6, &(0x7f0000000000)='threaded\x00', 0x9) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f00000000c0)=ANY=[@ANYRESHEX=0x0]}) 03:44:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xffffffffffffff94, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000000c0)=[0x10001, 0x4]) ptrace$cont(0x9, r3, 0x6ae, 0x4) 03:44:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f00000003c0)={'nat\x00', 0x0, 0x0, 0x0, [], 0x2, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x0, [{}, {}]}, 0x98) [ 2304.806853] binder: 31899:31902 BC_ACQUIRE_DONE u813d364500000000 no match [ 2304.806859] binder: 31899:31902 unknown command 4335586 [ 2304.806867] binder: 31899:31902 ioctl c0306201 20000280 returned -22 [ 2304.914722] binder: 31880:31885 transaction failed 29201/-22, size 104-24 line 3525 [ 2304.924421] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.930300] binder: BINDER_SET_CONTEXT_MGR already set [ 2304.936410] binder: 31880:31892 ioctl 40046207 0 returned -16 03:44:54 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) timerfd_create(0x9, 0x80400) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000100)='./file0\x00', 0x1c1284, 0x80) openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r4, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockname(r4, &(0x7f0000000140)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000000)=0x80) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$TCGETS2(r2, 0x802c542a, &(0x7f00000000c0)) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380), 0xffffffffffffff20, 0x0, 0x0}) [ 2304.985999] binder: BINDER_SET_CONTEXT_MGR already set [ 2304.996859] binder: 31910:31914 ioctl 40046207 0 returned -16 [ 2305.007771] binder: 31916:31919 got transaction with out-of-order buffer fixup 03:44:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000740)=0x6) openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x10c, 0x0, &(0x7f00000004c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000180)={@flat=@handle={0x73682a85, 0x1000, 0x1}, @fda={0x66646185, 0x4, 0x2, 0x9}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/104, 0x68, 0x2, 0x3d}}, &(0x7f0000000280)={0x0, 0x18, 0x38}}, 0x440}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0x14, 0x2}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}, 0x1800}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000400)={@flat=@handle={0x73682a85, 0x100a, 0x2}, @fda={0x66646185, 0x1, 0x0, 0x38}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/29, 0x1d, 0x2, 0x1b}}, &(0x7f0000000480)={0x0, 0x18, 0x38}}}, @release={0x40046306, 0x3}, @enter_looper, @increfs_done={0x40106308, 0x3}, @increfs={0x40046304, 0x2}], 0xc6, 0x0, &(0x7f0000000600)="2434924ea0cb825d0d81392824f3581a5c821e87ebfc9d155dfa695c35a6ee66e25c64530d7a9c07b7f6fd0f5ef25f2d4c0dced241c76a1611dab6f45d7b31073e04e225e5a4ccdac67ce5b5e07e9bb623c7867b7daaf6c445636144cd9ec98496c0865ac53f0d3642edafec96486989c9c3eba7cd7e0b878e1df0587506cef0be913d9ab377dda933a75523138b396f2790c6e914755c80908fbde8b1f11869a443e215818c879c9f38cab1c00ff186d44ac92b3b80f4223abcae87429a1bb170335d15f64c"}) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x3, 0x0, 0x0, 0x0, 0x800000000000}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 03:44:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r4, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$selinux_user(r4, &(0x7f0000000000)={'system_u:object_r:kmsg_device_t:s0', 0x20, 'system_u\x00'}, 0x2c) fchdir(r3) ioctl$TCXONC(r3, 0x540a, 0x1f) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 03:44:54 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r1, r2, 0x0, 0x21, &(0x7f0000000000)='loð0vboxnet1-locgroupvboxnet0\x00', 0xffffffffffffffff}, 0x30) r4 = syz_open_procfs(r3, &(0x7f00000000c0)='\x00\x00\x00\x00\x00\x00\x00\x00f@:\xd6\xfd\xebi\xc5\xef\xa0 rQwwZX]\x9fI\x03*\xa00\x14\xff\bY\x17\x11(\x121]\x1e\x1d\xdf\xfd\x0f\xda\xd5S\xad\xe8z?\xd0\xee\xdf\x92\x8f\x02{\xbc\xbf\xbfo\x86\xf1 \xc1\xc0kk\x9b\xb7\x1b{\xbe\xae\xe5\xc7\x83\xcfM\xcf\xac\xaa\x86O?\xae\xb5\x8e\x91\xd9q\b\x9a\x86\xf2\x8e\x15F\xea\xa5\xaf\x03\xde\xa0\xd7\x8d\x14I\xd1\xa8+@\x12\x84\xc4\x12Z\xb5\xaaZ\xd6\x9b\xea\xa3kS\xf3f\x8c\xdctk\f\xfb\xb0\xac\b\xbes1\x93\x19\xac\x8axd\xb3\x8e&\xce\x18\xd0\x06\xcf\x98\x0e\\\xc5\x96\xbav\xd9\v\xbdlbaV\xdd\xa4\xd8\x99M}OU\xd4\x14\xed\xbb\r\xc7\xa1il1\xe6=S\xfd\xff\x8c\\\xc7\xe2\xb0\xcfa\xc3\v4\x80\xdfY\xc9UAq\xd0\xa0\xeb+\x1b\xb9`0S \x91\xef\r\a.\x81O\xd7') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) sendfile(r0, r4, &(0x7f0000000040)=0x40100060, 0x4000400000000000) [ 2305.007800] binder: 31916:31919 transaction failed 29201/-22, size 104-24 line 3525 [ 2305.008281] binder_alloc: 31909: binder_alloc_buf size 118254241403803080 failed, no address space 03:44:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) 03:44:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4ac04e11}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0xb}, 0x10) socket$inet(0x2, 0x0, 0x0) r1 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="9e", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r1, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000340), &(0x7f0000000380)=0x4) keyctl$get_security(0x11, r1, 0x0, 0x0) r3 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="9e", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r3, 0x0) keyctl$get_security(0x11, r3, 0x0, 0x0) r4 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$instantiate(0xc, r3, &(0x7f0000000240)=ANY=[@ANYBLOB="6c6f616420656362797074667320747275737465643a5c706f7369785f61636c6ac063636573732c776c616e315e203030303030303030308392d1c0e3523930303090798dad30303004003966"], 0x4d, r4) r5 = socket(0xa, 0x80001, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$sock_SIOCGIFBR(r8, 0x8940, &(0x7f0000000300)=@generic={0x2, 0x81, 0x6}) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r9, 0x0) r10 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r10, r9, r6) r11 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="9e", 0x1, 0xfffffffffffffffd) keyctl$setperm(0x5, r11, 0x0) keyctl$get_security(0x11, r11, 0x0, 0x0) keyctl$search(0xa, r11, &(0x7f0000000440)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f00000003c0)={'\x1b\x01~', 0x0}, r4) 03:44:55 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) perf_event_open$cgroup(&(0x7f0000000000)={0x3, 0x70, 0x3, 0x8, 0x8, 0x40, 0x0, 0x9, 0x200, 0x2, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x4, @perf_config_ext={0x4, 0x5}, 0x20600, 0x1, 0xf4f, 0x3, 0x7, 0x7f, 0xf60}, r1, 0xe, r2, 0x0) [ 2305.008287] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2305.008302] binder: 31909:31918 transaction failed 29201/-28, size 99-24 line 3284 [ 2305.008559] binder: undelivered TRANSACTION_ERROR: 29201 [ 2305.009151] binder: undelivered TRANSACTION_ERROR: 29201 [ 2305.027516] binder: 31916:31921 got transaction with out-of-order buffer fixup [ 2305.027546] binder: 31916:31921 transaction failed 29201/-22, size 104-24 line 3525 [ 2305.028750] binder: undelivered TRANSACTION_ERROR: 29201 [ 2305.096558] binder: 31929:31932 got transaction with out-of-order buffer fixup [ 2305.096586] binder: 31929:31932 transaction failed 29201/-22, size 104-24 line 3525 [ 2305.096822] binder: undelivered TRANSACTION_ERROR: 29201 [ 2305.105004] binder: 31929:31935 got transaction with out-of-order buffer fixup [ 2305.105032] binder: 31929:31935 transaction failed 29201/-22, size 104-24 line 3525 [ 2305.105227] binder: undelivered TRANSACTION_ERROR: 29201 [ 2305.160905] binder_alloc: 31933: binder_alloc_buf, no vma [ 2305.160926] binder: 31933:31936 transaction failed 29189/-3, size 99-24 line 3284 [ 2305.161323] binder: undelivered TRANSACTION_ERROR: 29189 [ 2305.184755] binder: 31941:31947 BC_ACQUIRE_DONE node 13802 has no pending acquire request [ 2305.184766] binder: 31941:31947 got reply transaction with no transaction stack [ 2305.184774] binder: 31941:31947 transaction failed 29201/-71, size 0-0 line 3046 [ 2305.184925] binder: undelivered TRANSACTION_ERROR: 29201 [ 2305.497384] binder: BINDER_SET_CONTEXT_MGR already set [ 2305.503157] binder: 31910:31922 ioctl 40046207 0 returned -16 [ 2305.509974] binder: 31910:31922 ioctl 8912 20000040 returned -22 [ 2305.517235] binder: 31910:31922 got transaction with invalid data ptr [ 2305.524527] binder: 31910:31922 transaction failed 29201/-14, size 99-24 line 3316 03:44:55 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") io_setup(0xfffffff8, &(0x7f0000000200)) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00 \x00\x00 \x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) sendmsg$nl_route(r3, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8100000a}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)=@ipv6_getmulticast={0x14, 0x3a, 0x20, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20058401}, 0x20) 03:44:55 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000063000000000000001800"/60, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00000cf5380000000000001200000000e68e17000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) tkill(0x0, 0x3c) 03:44:55 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r3 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) close(r3) r4 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r4, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) ioctl$TIOCSTI(r4, 0x5412, 0x10000) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x4180, 0x0) r6 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/context\x00', 0x2, 0x0) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f0000000040)=0x40100060, 0x4000400000000000) 03:44:55 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000000)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x14}, @ptr={0x70742a85, 0x3, 0x0, 0x0, 0x4}, @flat=@weak_handle}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 03:44:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreqn(r4, 0x0, 0x50, 0x0, &(0x7f0000000140)) r5 = fcntl$dupfd(r4, 0xc0a, 0xffffffffffffffff) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) r7 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(r6, 0x4c81, r7) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r7) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r7) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r7) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r8) r9 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r10 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r10) r11 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r11) accept$packet(r11, &(0x7f0000002280)={0x11, 0x0, 0x0}, &(0x7f00000022c0)=0x14) r13 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r13, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r14 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r14, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") tee(r13, r14, 0x10001, 0x8) [ 2305.536024] binder: undelivered TRANSACTION_ERROR: 29201 sendmmsg$inet6(r10, &(0x7f0000002400)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000400)="114285b3264241ef515abf0588f746e38020e5e1ebf94dd5cb72d4f22bac2ec65d8eb816c2617d724adf5ddb33292619af544b80c321b562833cfd7e9c80a7049fb77bede7769d31d41a0d847f5d829305bd859db4953ea90b4ed94c2318a5f6157c984498fa0feda5ed6e496d02f84be620fab7f011fc4c40cce5f90ff8ae4cc0cd1b61ead1bbb43a4c380b66a397", 0x8f}, {&(0x7f00000000c0)="0b3cad97fc937f4f9a3391b6fe11005b43afedee9eb3171568a74d1de813fc61606604e15fe44805e8986819c28af709330742318f", 0x35}], 0x2}}, {{&(0x7f0000001880)={0xa, 0x4e23, 0x3f, @empty, 0x100}, 0x1c, &(0x7f0000002b80)=[{&(0x7f0000000500)="7fff186fbdb00fa35e1e81d6f1805679b1e8b9e1fa1828c435a455d99fbb88398a9520fe140ca0314ccb12f98dbfc449c45051ff973de43a58d7b96fdb5a27e244838f5c9ef9935a365e5420534631d1fa49b37b2f77648666402e", 0x5b}, {&(0x7f0000000580)="1ecda68c77850903dc448e07c551811eca4c4e437eeab238bbc3f0f22a12c9224ac19c26287f05834385f6a8ad4dee5a0e74b0b079f72a31b1a0295b2155174509ea1c2bbf03833b10ace0c2b7c14ffdd4846bcfd026068d96093d6e60ab337853bad2b55b0b190d0979f5a4b1b670a26c55f472fa54b1a107f23f1cc52903ea232bddc62ee012d1d425c639c17208c376397e3994df460e8eba8115f7a800c287ab579d1c29bec5d2b5f26eefba3b86c2f06fb411057f16200668fe28f74bc30197a0e12f5c0938663f2ef4c7222542aca9d1c432ad8706951082368032e39599aad1f693070b1bcc2a118abe1706db553ce7347451d6eeb206e69b393a", 0xfe}, {&(0x7f0000000680)="b1282bda681249c1b54a814ccf23cd24a276525806ed496248e81e1907d635450c8d3a95d8a9b8c1b30ad4734bf8aa0e430e71f29a53f8aef0b4bc063c05041c70f122fb58550564dbc7430b76a097092a9f7eaefb0002d79154e4616e3c3de44b229ca4ea338a0cf38bd1741e30d12da1931ed874b10f2286123a3cacc55d4859c43ddffd4dfc8727edf60cd625502bef10d7d6278f5f92a1402823932ebcfec2718aa037768d188a7e", 0xaa}, {&(0x7f0000000740)="b43c701fa7ea1c6cc3f15688b3036e4afdeb74b18e23cc276d27643dee7bfb8a57b1c8e2f7842a3544a2a07f02", 0x2d}, {&(0x7f0000000780)="562d85dd39f3f693d1c4c1c94e29fafb5c28dc0e56ea912a327477c69c1660f24af936d43c00a33202e591112568712bbb52745b9ae20dd5813a0ef75aa05aec8aac06ae3896516d138e7bae13fa18a6c79a7f095ddf3a2d168ef2198bc3444ea61f8c52c79dce9094e653e54e09dd598236d517baa59e2acfb98cca1bf5488a74be64afb61703b8ffdd4666981935e38d078a338fa0865623ee4dfde6b5e33d417b92c9c8bb9ddef7f595192ebf872b06d4d2f80a3d340a2efe9db0830f4c231c2e3b471ad0da5a62a00c7263f8ea73910241699242b1a6c40c9656f8dfc1dda607f642d403f63679cc6b4c2d65b9dfed6940692389777dc8751aa359b4a5fe747adda6a926643c0719c767b8c32bf394cc660417cdd23ca2607f42df46d2fabee3d333ac73134ff0052969358cd09b780ce9a5894e05224822ecf90f4d5fbdeebdea143cca3e170de87a3deb21c3802e3655d8736b44d973a89efde5942dfb3b60445000f1e64648e2b804a349db4a29fb5c74863befa57e46ed39818844d9542ce8fe43950eb074916fd64c68c46c579961da020e1ef10261252f84b1210c18d214176d2479300ee4a158d25901dbe850bfa13bba56f1d7a6e549d634fc8d302345c41b0596891093da64f38f85ecba2658dac6c9cbda5c3a316057c56627b1754e6306362de431d10021276cfef1aed3a88a61ad77a8469c537d8669117f3d36c305a60386c5794f9d089a658bca4fa06aee7d7f4df49b99ba0890dc5659b0928fd88eb80449c9baeafe58897487372e027b1ec8dfd641468edd6da4d7ce87edbe77c95575724aac5fdb750ad7b76fb69fe29866ff83baae677cf6d6f219aeb4148ecb69fe159e3571ed27df908923186f9b3a921b19babfa9551a033b254360d09874296df18b0f5713a2f3b3ff2cc88883e0516a90eb8288c977a7544e195e489a71537c31807d10392a9d58e8a797dc72f6a8518fbf01fe2d1b16a7a7fb75a2863f094aebd82a8c3453b38d7ec3053bff69b93066439c5df65a3c19f9ab1fd50ff2ca82cbb8a3a0ca7a8da8f42f3ca9dd048d8d50d27fcfe6d70baa406c419d7146ff8c6f9ddbb5813d0e9518530f2fce43db0eb5c416002117e689a7f98ae784be57d9b094a80c1e017b50e75cf1fc211b3f5ec8565f10e2de19661a8e2e71d67f15ff59a3ac92bb422783c538c856e20040d23de86450b98f1a094c314c5c4808fda3069c8215203f21c987e614b82b5c9da6a0751d775134fada4e6cf74c1b0f4ee20b1ee429dee2eb9fb4322d0559e67a4cb6137709676001b0a1bc17ddc54d1e69777865c074eb3a2783856f36bc05b52defd91f7bf5ce57989449ece7dd63ddee99727805a176f761d1a257e928c22eafc832c6640ebc978de1abac037e94786aa4f7b273aa5e1ea971920dfad81e10bb842dded2257c9c99c1c7435317017ebd9c3574d7a13fd8e792902be2d82b9df0631582258bb63a9bc53b98d44ad3d9651e489e7bf4b09cd343cd5265ae4e8a3236eac50863e367a2025daa55025848248f9a5681384fdc0b15ed36b8d284f6bd45f5f72a192554a6c1fbfccdfde587064c8d856ceb1f1ae558ec9c3bd9c856f13fa0568ba6fc967b7a1975ed47e360e6705b5f1cd0daa881127c6e726be4ee252352adc19683b9ba26a2f0a4ceae5ced966373537e7137b81f585cf9752c4ca12325e0e2b64ade54d53799fe022604cbcb244b0ca3d55ee0bcadb988226f7ff7a8591bcd20a5b21ca53172f05e52301f3ad88ad906017096b9aa342fe4d0fe085627807ceb51b36dc2cfdaa76b2b9a413c023d17fcc2d4844059a4b64abf530d7c9d33a2f2b7e77fe20832b221e27688c98ea2b7783e44b85fcb77983e04043fa8bba694d530c9957e63a3615778d055eada8b8f83f08c5cd23e0788598fe599f70e693c5843f91d78568ba8ffd210655a21aa786827ba6df9d12aca10d8f33dca638da683d1a8c2dee3d320f931a20686e7ac758c214c7ed86b1597088742293dd06c42faea41c20f40ee45f181e348c8d0e46804bd077ef2eff8d2a50f8199d5fab42ce2997b83ea6cb4a50273cf533da53b0022d814653aeaf0c55aa0cca541e99c9d409db0ad4cb3fad49770528b168c82fab00c45674fd237cbd7d89fe633b1e1f13908b11253d087f97c02397681bce7f467257836f3310696ad2058891b5b7e33e6535b69ce2c41811a28aded80f5a3d518ea18b8223af15b744f913fbb8ff2b0740fcb26640bcff62cb66ea9375b2f50f3f3da3b288b5d7b7f67345582c9acb10c1f8a4e2316921e8ad84d81ce6ce60b7c312a8cada43863d39cc3747bdd47352fa2c380a992a5749dea3d128569de81571fa4ec903048826e8364d9f14bf01059f3c44edc82c118ef51abd2c39351a592d7f556b046f9c0c9e83e293dbffbfe8d5863c87aeebcf5b82d16cd275a679f4bfd7ed46f86a78e6d58650ff39430e2fcb8548e7fb0d837a9ba873d00a0056d77e81fc22aba2665b9869576ddc34e187d69c66c094076067a33c5354aa604606371c1d16ab0cafd26c8a45c9c619e9e3f467a4e6e8c2f09bcb1ec24ae676721084434171687b463f1992056469bc2c47bcb07bde9952a50aea46fcb174669f8b1e4a685d0993ab3c62bbfc5d0b7d71aa1a6619c0a0233c8a719a97057c0e0a973e0a3cba7c7ccdddedde6ca1f020ed9c263b10d94e056594649258c021e95bf74735b224b202ae379a229e6cd2cfeb4b221b5234f34919ffb3fd94fb37cdb7301e650968de30b1ba7d4eaa2e12dd0aae88bf46dac3beef992da4e994ae738632548c65d99a4b9cdceac6ae131b401ea71f4c05cb743a7a1c0105febf6a00abc0449372cfa9547e1beebe3c40d6de3ff57b8ab2f03180017e69cce5e46c22c52d685e8b95b02131c16fbcd9a30fed3e7f9dff4ac3e1f55cc71f61ce102d762c07753abb4395e5289a989572d0d4b04a8bfb9f180ca105b4cd4432537e3c89572d0c032568f206001284d8ba37df937a20163f6fa555893b6b5ffa14181b8ac3f401adc54ce1199e0e900a3c5ccd5f3c6fdcf4a72f7e849e6068bca66bfc3d826c3db1bd347863ccaa9d889e11cf4ce09cf3f99c02d1a16569ae84b6041fc7cf1a88c5cddafacb011072f945b18602de7928c3473ad1f0295f3f456b90ec7384cdb1318a211e59fc295554eca77911d6805e8c86fef3f1957b70cbef04a0f36590a16e0518cffc6162424e95037e6b163b0c99813afbbad36326abda7575f1275d74d0f5b76fdd8c90025c50b1e41c1baab3a4e62a817f8cc4a2cc9f4f5989e1ee577b36433e6aec325d605107633b95f79cbe22b651295fb4431c658ce12b87b91df7b1c3bf17614d26aba03fb31e113dc962c3c970627db34ee83d54982599b13c23560ab1f55b97f5a5c3da32057eb85ba694ae1fe1b5692d524522c34f7fc0b31e660f9ac4c3a8026e21001828753f2ca98056871d6eb6e19a4a02785ed80ed76c46a5967cddd8259ad1c1819161e97092967e0e275582ab0a0eb1cf809a1c83657dc3b79fce072d9be76bc1ca0fbb08d20ad83683fe60cbbe251e80c5191db600b138f1a2293f9e1f38b1c48c3e87ac03930851e9fc155fe739ccd135ab349005f25f7bad7550b1d0c9ed52809fb01ccbabc9765f66ba34ebf10f357a5e6027197e80761e5c678b50dfaa9f7830f13a5d46ba8da876ed484c1fcb180efbea9b0f7ddc1acf354e628f5d4c5b11210343c0e7f343b085db1a0c900c62783b899c550873eab233dd70289b4d31c6a537b086e738001ecc6af9c3c5f1505e0ce3f316fa3a93388c5e0e902319d30ddb7b5fdb2b17155f9217ea65dc5d997f5581325212826c973ff38f9bc22995e27efe3e3711ac2ec1e83dd249a2fd4c5585639745ef7797ac35e58ce756cc10fbf077012a84fc48460026c3d3f7d39944363d6cc616833c032e9be959cfe46b71521d17521382ea571bc7b44413588983a6c75d69de8dc362fa7f0e9598bfcfbfbec3f7e740d45fa4fca4962d71b650d75e50f196fcca136278bc1f21836a110bfabcfcbe0872721b89cd336a5580adf508d25f3f7616b6ef1ac92bdd5f9e362e3a08742c4a6986ee226bea4cf4d33d826ea5d4498847c0c04098277ace84287e12ff2e727f89f37776d69a1f67f4c723b4fca2f6da25a2ec4119db4acb292cf655999225dd4b53e2fccf6a742d04456ac6e963119eda2e76acb8b38aa58f6bbabd1ef3f61b82e4da5a8edbccf06a4f3fa3bb119441d3a18a69ede39623e4f2bb1de11a3bf3ff594d056347d20a2a1b90bcb395773a1fc11bfe1284f4e41ffc0e7352d6ed1cad90aaba1026336c3843437039896df7aa0fc83f31628605a4e9eb7d2759f3e7ecb528e5a5891d57584069cc323965ab08641dac2a408d893380608257230c7f234e11c3447a4430143f3a29b0cdadf6fa149b4b17dc6c2c1a1cec8cb4e5f247d7f0b2f46aa055aa30c3d152da1e767bc6170c3ee43cb43a5763cd328b617002fe97278a85741879f3fe86ee4a08acf2f5984feef22779c9f76cf814ef59f9a167ce19c98965fb05d33828d0e0a91ff1e80a99316f4ec7b07825766e1aba5b04d29ab451b6c553970807a7445963fc6a063528a7caa7770a3230e467544208dc51e26df553a1a9977432ffaf00f804668737e59b14037aebed27e70c0c8ec08e5f7f5323e88861428d9f519fa5b4e96f8944d0ae49bbf85d022ac231be70ab0a167bf806017b057351fa7f5f046d396b7f88fb0e629cdfe9785430e0dd6cce51e35e74347ffe38611277b69def1d398fbb267cadbc9e3a28ab8591473102d130d1512062ff6bffb4a5adb3a3ea2eb4800b3afb220300491579e082a55ab16f4adb6b03a0d501be6a9b2eb22e24225e4a26611fe3a9b707829b0ff933daf8011f6501221d126c8cfa77fc75da742ec0006856d8e2f566b5893c017231450cf37988d63cf51bac439afe0a941c32544292c5a2eb4c793193d7cf862a9662cbe3766d7dac0f41da0f6bc155f5d11a5b2c2e7f3e2387c0ae6cc2b47a88993136c54fca7a24a4f588208f3147fec07f1e2d9aacd61c1be7732df0be385c6083abc07c54539f5f7a06ac629c31ce7d4352b27ebba0d5d5e9a79eea761d085069405138c4bc9e5e5634a709f51900e47644a6de130f4c96c964d2586d20fb1974dc39d72055d09cd3e00a626bef05cac09efa7b40a99061c58571a4ae812adb0dde06a1453410a0ab2067a155d3acb4deb05c67bee9173de1528ae1fafbb10941309171983834545dedf71bc1c539a9f188ff0b34005c49f97e88a70754892ab0666697f11b5b43835b00e65d1d644c4fbb88c99085051131cfe6ab0ecb4d1f7db2673139ed3d60c091ab97d64664649f0fcee91ebd5cae36bba406c8c97ae53b03fc83fc9907bcedbbb44ffaed4b79424138ad5a63ab83f3cd48a8a4a7b6098aca12f0356127c2e13b1a25f8557ca5d47015d6a18d0b69f6e100ee93809922cf5c2f145129963987833f132d65bc19487da6e860aa57a261c1208421ec151d7346c2f65d6623351f3aa76ff7beb090ce5e4bb31bf0f41a58cc4d0c8d2e10c43b6ba910f738af91ecdb08c39f1de03f384749762a3032833d8b09eff596c47a219d124fb6232d972c29b3ad69a199a0268ab04ca814d5f0f2880692a1530c7aacc2c9c06c64635ba5f9332e44bb08634974e671c2fc3d5e53dc607ad6dfb2bf0daf0654249435ea22f03a71c9b0e96131cbfc8da259d0d727d82436a7cf8a4f6ca02f33ea3", 0x1000}, {&(0x7f0000001780)="ab3b61bf34e93ef03fb0454ead57c0d23a344f0416d1e907635cab1738768b730475836a338b3e86dcd6ce8a310ad90f47502d9bc12ebef71c7f673445d8c5d44065cd2348961a38dfb8aae4284a156d7f455f38db60efd501dcd7152955f4d3a824061dc20bc843b90d17fcc69720ab84d3b5598541f343c9edaa006bb507e21052ee93e5bab5416fdea54b1cd1e99397bc57ee0976e597f99701e32b89e98c7d4850ef9068b4acec87b254f02c9f6fc0e8210de54cb0e8c5061d09288b1a9e0fcfa7271a71ddd19a74e0a79fcc628e1179dd1af7f96163150163ba5e39cd88ebb7dc65e7394816f5a06b54d4bd2174", 0xf0}, {&(0x7f0000002f80)="57d8aca2aa1c34d94c5e6be2eb51ef3e5fbd1797bd85bbb6334467ac3fd835abd707061ed1985a09d490ea0128d81688459f1ec07740ebe4015234b4e0dc33655591388b22047fc5c4ac5d2099570a6cca0250f44e8de087d30ffb47e57537e8d03c036f910e2e9ae94c01a0b508da360a2a2443db34ded794cbe7f3c8a6a1ee015966f06af61343419d98a72ee3ad1c0d8af5e9ef68e1c93c78fa09d3cc1816fbd90c130448739aafff5ba7b559ec13d39755d63dc7019b9bebb55675260d825b9b23d1e4fdda62966ec98857e722865a9df94e4fffc115c71beb4d762257270f3458b6835133ba2e7d51e62ddc296d04b02c51647e72c3d4d8b8df6e0dec70524ab5c84b103e", 0x107}, {&(0x7f00000018c0)="57a83057036190f582499920da5b95e5bff0f5b4688a8aa8726e256f1e058319ac50e96d5d0817e32a01cd92010878aff30a10520a0fbb308e80d259baf6e9ca77a8f77375", 0x45}, {&(0x7f0000001940)="28c3450d0c92f413e88cb17d4fe29530a733af509822a374e4e9106d0e43c5345c26323bb14f9f3b452657c2d1215476f31e3c269d78e7ab036023b7e4806962c789ee2e4acb0a6c72671d0c88a6af059f868b6eb0e13fe8181bec89b7247d921a36e79df8ef5996cc8138dd196a30a762df987a0827b5948b2b84543298ea2f3f9eb2cff9faede5d8ac6306be876da6398ab636d12fdc62e71a9cce86ad30e41006b4bd7073ae0b5521ff5a99bd7b0a6bba19539084c164e922c27c7a79220cd20a1af7878efc2b94bfc55f1ad947cdbc8af7071b054b70d525323ff7c72db9ab198bc17db5189fd9752b0f0a6a7a94", 0xf0}], 0x9, &(0x7f0000002c40)=ANY=[], 0x318}}, {{&(0x7f0000001dc0)={0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x65a4}, 0x1c, &(0x7f0000002200)=[{&(0x7f0000001e00)="f5e70c2c29980b42bc7e287849db3953c4e7983f5f367610f61c696c8595e95c208f7ef30bda", 0x26}, {&(0x7f0000001e40)="504b044e9ae518353fadb47179f92a28de6df4e4d62326b078b83727b4cf0c8863b728f649504491165cbe6a728dea5b7b01e1875d1efcfa340c46d2387f1e0cdecec9be90fd38ac068e9bbd3ccfc10e1dc6045bad0fffb42dfe4bff4b8be1d71c2bb556d30d5b46f5f7c1879df85dad23864ca6c0e594073f18c3e3b60e4ed6ca03d2fe970a2fd2", 0x88}, {&(0x7f0000001f00)="8395c5b3a803e4b17e7ba540d4a2372fe2938e177200ffcaccfb442b3bc42531eb799da769fb25d2200f7f5e17adbd327356b45df563cefee665ffecf16570108e744911c4f6dcbd1c3ce4bba77f90554b29bcd2141a9d39bc5748170f48f491b7eb8d75b3033ae224a478d4eaba7c7400a1bb33c9a7e3cd19cbe0eb560e772619cda55410285c944ecce04795af97d85915c772a34dd76324fd8844fe807a1e07b821aef9bc863b9f78ede366dd56560edeefc2a9c4a07312fefd441727b7f8dd5ff4c5fd9ec54aa34e208de0c0f17d2536836d47e9e5b09ec93a0a25d11ecb7e12e5950233913d", 0xe8}, {&(0x7f0000002000)="f310a280d1d469d1bdca037f5f1670222f710f739d7408c8ff37c8db30c978bba3183480af8273740618c544f5f2f782a25a0f9bcefd52f7fb38d236d37d8d84bf179190a8d5b9a2fec9cc80243a3a9d9c6b0786594a3a9f823534a2a0a9fb5f05481d5d0fcf26170186a04f2524654859392b479821e5e5a43105706d6ddd2893a7dac603e3d4ae8a57d33d00ae230a252ab13d92221a9d37d94cd053283b86cf07422424134d9b01d75db1f48e16980a3d43d023b1505238909256bb6ac2247e2c0aada3b713fbde2c2134d016d9ccb2cafe1db68c85efe6df13302608fc5a1ed3961ac3d3a3367d1548a314e4886655cd8e7462f61e60ac4b", 0xfa}, {&(0x7f0000002100)="86c2efeb82de08467f4d1f6ef9b95b878779c68c096c61eb4362542d39cce506bc356c1d637d5646d5f327d5de059299c1c7b167a9a6cf3deb51348223dfc99fa302f736d0585b9a1a8934cf1864878da78ae9cbb40f521846cd165021501827e420cfa4db83cb69105888754c3906a137b42b32527205e1a495dabf046a51cea0caa61cfb715a292cb0fd58a430cf3c68b2086457cc0cb17d817c17867da55e102e8221d3e8e4b1e8d678939aa84ab6b8272777357852b3985d5f60f7b41bce3073d24089ce991b4c6d", 0xca}], 0x5, &(0x7f0000001a40)=[@dstopts_2292={{0x30, 0x29, 0x4, {0x7, 0x2000000000000137, [], [@enc_lim={0x4, 0x1, 0x6}, @hao={0xc9, 0x10, @dev={0xfe, 0x80, [], 0x15}}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@empty, r12}}}, @rthdr={{0x28, 0x29, 0x39, {0x2e, 0x2, 0xa9d6a29c4d319858, 0x1f, 0x0, [@ipv4={[], [], @multicast1}]}}}, @tclass={{0x14, 0x29, 0x43, 0xd86}}, @tclass={{0x14, 0x29, 0x43, 0x68}}], 0xb0}}], 0x3, 0x4000000) openat$cgroup_procs(r9, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r15 = perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x70, 0x9, 0x0, 0x4, 0x5f, 0x0, 0xe958, 0x20102, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x5, 0x5, @perf_bp={&(0x7f0000000000), 0x4}, 0xa9, 0x7, 0x4f0deb4a, 0x7, 0xaf, 0x7f, 0x3f}, r9, 0x0, 0xffffffffffffffff, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r15, 0x8912, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000300)=[@acquire_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2305.590251] binder_alloc: binder_alloc_mmap_handler: 31959 20ffc000-21000000 already mapped failed -16 [ 2305.593174] ------------[ cut here ]------------ [ 2305.593180] kernel BUG at drivers/android/binder_alloc.c:1108! [ 2305.593187] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 2305.593192] Modules linked in: [ 2305.593200] CPU: 0 PID: 31967 Comm: syz-executor.2 Not tainted 4.9.194+ #0 [ 2305.593211] task: 00000000b06a7795 task.stack: 00000000f8f23d89 [ 2305.593229] RIP: 0010:[] [<0000000048c3e777>] binder_alloc_do_buffer_copy+0xcb/0x500 [ 2305.593234] RSP: 0018:ffff8801a86274a8 EFLAGS: 00010216 [ 2305.593240] RAX: 0000000000040000 RBX: 0000000020ffc000 RCX: ffffc90008293000 [ 2305.593245] RDX: 0000000000000367 RSI: ffffffff8223a8fb RDI: ffff8801d4d102d8 [ 2305.593251] RBP: ffff8801a8627528 R08: ffff8801a86275a8 R09: 0000000000000008 [ 2305.593256] R10: ffffed00350c4f12 R11: ffff8801a8627897 R12: 0000000000000078 [ 2305.593261] R13: 0000000000000088 R14: 0000000000000008 R15: ffff8801a86275a8 [ 2305.593268] FS: 00007f5db4e6a700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 2305.593274] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2305.593279] CR2: 0000001b2e622000 CR3: 00000001a9793000 CR4: 00000000001606b0 [ 2305.593287] DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2305.593292] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 2305.593293] Stack: [ 2305.593323] ffffffff81249811 ffff8801a8627568 0000000000000246 00000000200000c0 [ 2305.593339] ffff88019f61e028 ffff8801d4d10658 00ff8801a8627870 ffff8801d4d10600 [ 2305.593350] ffffffff814fdcb6 ffff8801a7f65880 0000000000000088 ffff8801a86275a8 [ 2305.593352] Call Trace: [ 2305.593364] [<0000000076f9d5b9>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 2305.593372] [<000000001e4f9e81>] ? memcpy+0x46/0x50 [ 2305.593381] [<0000000041c2a9fe>] binder_alloc_copy_from_buffer+0x37/0x42 [ 2305.593391] [<000000009bf2fa6c>] binder_validate_ptr+0xc5/0x1b0 [ 2305.593401] [<00000000d010a060>] ? binder_get_object+0x1b0/0x1b0 [ 2305.593410] [<00000000ea1f9b64>] ? binder_alloc_copy_user_to_buffer+0x2c1/0x440 [ 2305.593419] [<00000000a19272f7>] ? binder_get_object+0x12f/0x1b0 [ 2305.593426] [<00000000f00abd2e>] binder_transaction+0x3895/0x5890 [ 2305.593435] [<000000009996f166>] ? binder_inc_ref_for_node+0xba0/0xba0 [ 2305.593445] [<00000000e796161d>] ? __save_stack_trace+0x7a/0xf0 [ 2305.593455] [<000000006b238b5b>] ? depot_save_stack+0x13c/0x4a0 [ 2305.593463] [<0000000076f9d5b9>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 2305.593471] [<00000000c17cd7e5>] ? __might_fault+0x114/0x1d0 [ 2305.593479] [<00000000712e4ae9>] binder_thread_write+0x730/0x20e0 [ 2305.593487] [<000000009ddcf1ef>] ? trace_hardirqs_on+0x10/0x10 [ 2305.593499] [<00000000bbc0f1c7>] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 2305.593507] [<00000000bddd4a90>] ? binder_transaction+0x5890/0x5890 [ 2305.593515] [<0000000076f9d5b9>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 2305.593523] [<00000000b34816ca>] binder_ioctl+0xecd/0x1720 [ 2305.593530] [<0000000076f9d5b9>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 2305.593537] [<0000000004960bc8>] ? binder_poll+0x240/0x240 [ 2305.593544] [<0000000075d4e7d4>] ? __lock_acquire+0x5e0/0x4390 [ 2305.593555] [<00000000697aa0e2>] ? __might_sleep+0x95/0x1a0 [ 2305.593563] [<0000000004960bc8>] ? binder_poll+0x240/0x240 [ 2305.593574] [<00000000b096836f>] do_vfs_ioctl+0xb87/0x11d0 [ 2305.593588] [<00000000cc3f0688>] ? selinux_file_ioctl+0x103/0x550 [ 2305.593601] [<00000000e290fded>] ? ioctl_preallocate+0x210/0x210 [ 2305.593610] [<00000000b7da6298>] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 2305.593618] [<000000002ed1411a>] ? __fget+0x208/0x370 [ 2305.593626] [<000000003b6dca8c>] ? __fget+0x22f/0x370 [ 2305.593633] [<000000000b198b62>] ? __fget+0x47/0x370 [ 2305.593645] [<000000005800acde>] ? security_file_ioctl+0x8f/0xc0 [ 2305.593655] [<00000000ed147d7e>] SyS_ioctl+0x8f/0xc0 [ 2305.593665] [<0000000035561cf5>] ? do_vfs_ioctl+0x11d0/0x11d0 [ 2305.593674] [<00000000076f5313>] do_syscall_64+0x1ad/0x5c0 [ 2305.593683] [<000000004a1992d3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 2305.593822] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0a 04 00 00 4d 8b 64 24 58 49 29 dc e8 0f 7e 0e ff 4d 39 e6 76 07 e8 05 7e 0e ff <0f> 0b e8 fe 7d 0e ff 4c 8b 6d d0 4d 29 f4 4d 39 e5 77 e8 e8 ed [ 2305.593832] RIP [<0000000048c3e777>] binder_alloc_do_buffer_copy+0xcb/0x500 [ 2305.593834] RSP [ 2305.594193] ---[ end trace a0e98959dc1fc1a9 ]--- [ 2305.594198] Kernel panic - not syncing: Fatal exception [ 2305.599939] Kernel Offset: disabled [ 2306.021582] Rebooting in 86400 seconds..