6712262d0fa6603d674cb892897e57a4b33ab4a9785d2c0732bddf4834cf3d0246ec71deedb4dc092f911762b063f58275bc9c840f87fe743ed6eff5776a7e76601c5be4b5fcd4c67add29241c9e933c80ae6c3d9cc92026dec0c78c01547e8c15a9ebffbc5855142fea0c4ff1f71488ec249574094a3e8a3c4401cbcbf52466b6c624c1aa3fbf8df16ee36c8fcea8877ed894c0da6d323b180ff3940976bf3c0e069a0b86a4edb016df6a0da9163057fa23aef78e19d1e050911ea9a93f9f3bdfc72d9d36bdaa89540c340bbbd19e64959c90b51580bd5b91d583665ad2a8bfe5f187a02dfda997785bfcf84399c07aa6172e13a051351445b21d4928334cc3c48570322583767dddd3550eb3ae9e2c691338ed0d904b7474d5156e1252cf6b838587a1fc720727867876fc6c5308481c08683af797e8c1528259d30dc769c27c0f95dd7570c9a39bd4fe90e34b5520f771a9b1ba0e5af08e0115488293316386e592196a8f8c46254b57688671f368132b4e348cd46a87d8babcc99e7d3651baba3acad48779d8b799e74af0d5bcb5a5c5cf853280edc63c619aef35adadb21781f30b66da00b1daf4aa10c611e994b0bb69c75d214873934d33353ae569719d0f002e27afb4e82ce9d43ddf7f636079d28b5972ada4815ff1853ec445716f348c7f17feed4430ff5e52b6ed39b70bdf9bb6cbcf5c454e7977b0729902287af6728e4a879786dc6c661b323a1e576abb452ddb35ba941b6cf7476fb5063d481c1e2cd4b6223092352f0d669cb792fa6f33e59f2b0bcf519894bf68ba32ffeadd1730703c79d07a62df57a94a02d54c26c7a8148a3f69521c16787d9a488ebc432d9ea9581a3bb24d3693aec6ea37f49e4b8f1a768696bf03f4838c37b3844a4494fa2be968dd8a28f01d7d2d840fbc0e574e4a42d30bb8bf978f6ea56f5c2cc201ba8572175758936585a77dd8ea2e5083cf9fc496f0df82a270bb75349e0f4e9cab262fb235785daf9d253c4f6e5596227309685639f12c3eb59032f3d62a269ea42589223b95e0436e14fd6cccf047d94d497521185c30f2f26c2dac75b51269973d60bd0c6c2dd3755988d96a22aea57a1c646987d77d7b0fb471d94a3731e8d26488e043f82791030341536ad2e4bcd34265638dc267c8855849456778ebe6d4039cd49337ad859cf2f27abd96020b2ad0c1618e163c70188fec96d699d1a709dda7f0ad473561152c2c3864f7df7c1aac39a39eb09752a4b5f18655cb7a15fd8b9c7dbe1d378af0efef300ba052bccfe1c3d22a201c72c32b3487567bbb9424b3bb1c76979dae3872aa0a90439e6bb37493dd07d559a8ae184abf3c7103f29d2a1") sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) 13:54:43 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000380)=""/149, &(0x7f0000000100)=0x187) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000300)) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x40e00, 0x0) stat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000005c0), &(0x7f0000000600)=0x0, &(0x7f0000000640)) write$FUSE_ENTRY(r1, &(0x7f0000000680)={0x90, 0xfffffffffffffffe, 0x2, {0x3, 0x0, 0x9, 0x1, 0x0, 0x1, {0x1, 0x8, 0x6, 0x4, 0x7, 0x0, 0x89, 0x0, 0x9, 0x100000001, 0xd6b4, r2, r3, 0x20}}}, 0x90) sendto$inet(r0, &(0x7f00000001c0), 0xffffffffffffffa5, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10) sendfile(r1, r0, &(0x7f0000000740), 0x5) sendmsg$nl_route_sched(r0, &(0x7f0000000480)={&(0x7f0000000180), 0xc, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="8400000000000000010000000000000000000000f5d881aecce642899754788f884b41b5fabd6503a330ecac01d9ca668e90dd1f1a1e9b4988396b82ee59a10ac75219c926bedfa9f7f0166225193c5ba4a256e7b0f8134b65add270ad53332ba46bad6909d7db95697fe94dc75932513fc9d669325f7e7eb42d91dc66746216d36de9", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000c0001006367726f7570000054000200500003004c0000000000000000003b5e6ebe1c2e657eadf10c4061406e2aa3e6c32f4826bba3465d822828f2187a13bdfe80db298ef2dbdb59bae8f38d6d9afe040f0500000000000000000000000000"], 0x84}}, 0x0) readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000440)=""/28, 0x1c}], 0x1) readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1) close(r0) 13:54:43 executing program 4: r0 = inotify_init1(0x0) flock(r0, 0xfffffffffffffffd) inotify_init1(0x200000000000800) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xef6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x20, 0x4) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e23, @broadcast}, 0x10) get_thread_area(&(0x7f0000000180)={0xfffffffffffffffc, 0xffffffffffffffff, 0x1000, 0x4, 0x7, 0x800005, 0x2, 0x8, 0x1f, 0xd41}) setsockopt$inet_tcp_int(r2, 0x6, 0xa, &(0x7f0000000000)=0x8000000000003f8, 0x4) add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffa) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='illinois\x00', 0xd470041877f0fcc9) sendto$inet(r2, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000400)='fou\x00') r3 = memfd_create(&(0x7f0000000340)='md5sum&@\x00', 0xffffffffffffffff) shutdown(r2, 0x1) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r3, &(0x7f00000003c0)={0x20000002}) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo/3\x00') preadv(r4, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/246, 0xf6}], 0x1, 0x0) fcntl$F_GET_RW_HINT(r4, 0x40b, &(0x7f0000000140)) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f00000002c0)={0x0, 0x26c5, 0x2}, 0xc) [ 360.308490] IPVS: length: 391 != 8 [ 360.321927] IPVS: length: 391 != 8 13:54:43 executing program 5: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4000, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) r0 = fanotify_init(0x40, 0x41000) signalfd4(r0, &(0x7f0000000440)={0xffff}, 0x8, 0x80000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = open$dir(&(0x7f00000003c0)='./file0\x00', 0x200, 0x4) write(r1, &(0x7f00000015c0)="991525732b32c000e65d4b349f3489b47ef17912b5e8789703886f0719c40253728fc90e6f62a84a97ea7fac42e33d0f81ec78292151134c04a7a1e4c22f67ff5a375c4eff70bdc148e6be05f57cc6b04915ec755db254e2a69853175b299eb5", 0x60) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0xfffffffffffffcbf, &(0x7f00000000c0)=0x8000009) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='tunl0\x00', 0x10) sendto$inet(r3, &(0x7f0000000100), 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0)={0x2, 0x0, @rand_addr}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000640)={{{@in6=@mcast2, @in=@remote}}, {{@in=@rand_addr}, 0x0, @in6}}, &(0x7f0000000740)=0xe8) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000100)='.', &(0x7f00000001c0)='loefs\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f000095bffc), 0x4) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000140)={{{@in, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@multicast1}}, &(0x7f0000000240)=0xe8) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)) preadv(r5, &(0x7f0000001580)=[{&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/141, 0x8d}, {&(0x7f0000001500)=""/82, 0x52}], 0x3, 0x0) fchown(r4, r6, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") sendmsg$nl_route(r4, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001780)={&(0x7f0000001700)=ANY=[@ANYBLOB="4c000000520000082dbd7000fcdbdf250a00000008000200080000000800030069ffffff0800020005000000080002001a00000088000500ffffffff08000300800000000800020000000080"], 0x1}, 0x1, 0x0, 0x0, 0x44000}, 0x0) socket$inet6(0xa, 0x2, 0x88) 13:54:43 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)="6d656d0072407d16357a93baffc761c4d2792e65764d6e747300", 0x26e1, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000001280)={0x0, 0x0, 0x100002, 0x20000002}) read(r0, &(0x7f00000000c0)=""/229, 0xe5) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x40000002}) 13:54:43 executing program 2: sched_setaffinity(0x0, 0xfffffffffffffecd, &(0x7f00000000c0)=0x9) mmap(&(0x7f0000008000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000380)) read(r0, &(0x7f00000017c0)=""/207, 0x9a) getpid() syz_genetlink_get_family_id$ipvs(&(0x7f0000001900)='IPVS\x00') getpgid(0x0) mq_timedsend(0xffffffffffffffff, &(0x7f00000e6000), 0x0, 0x0, &(0x7f0000e0b000)) r2 = socket$packet(0x11, 0x1, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) ioctl$IOC_PR_RESERVE(r1, 0x401070c9, &(0x7f0000000240)={0x1, 0x7}) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x11011, r2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001740)=[{{&(0x7f0000000140)=@hci, 0x80, &(0x7f00000016c0)=[{&(0x7f0000000280)=""/124, 0x7c}, {&(0x7f0000000500)=""/180, 0xb4}, {&(0x7f00000015c0)=""/215, 0xd7}, {&(0x7f0000000340)=""/27, 0x1b}], 0x4, 0x0, 0x0, 0x1f}}], 0x1, 0x40010002, &(0x7f0000001780)={0x77359400}) socket$inet6(0xa, 0x1000000000002, 0x0) mkdir(&(0x7f00000013c0)='./file0\x00', 0x0) mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000000140)='./file0\x00') getcwd(&(0x7f00000001c0)=""/102, 0x66) 13:54:43 executing program 3: ioctl$PPPIOCSFLAGS(0xffffffffffffffff, 0x40047459, &(0x7f0000000340)) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2, 0x80010, r0, 0x0) ioctl$fiemap(r1, 0x40086602, &(0x7f0000000140)=ANY=[]) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x103) write$binfmt_elf64(r1, &(0x7f0000000080)=ANY=[], 0xff01) fcntl$setstatus(r2, 0x4, 0x4000) write$selinux_access(r2, &(0x7f0000000000)={'system_u:object_r:etc_t:s0', 0x20, '/usr/sbin/ntpd'}, 0xfffffeff) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f00000000c0), 0x4) socket$inet6(0xa, 0x4, 0x20000) ptrace$peekuser(0x3, 0x0, 0x0) sendto$inet(r2, &(0x7f0000001680)="4a14b76530bce41757511acb061a81524bcdcb59b8dfaff2314a43b5b404e0fbb2a202111efc37c3bed73844", 0x2c, 0x0, 0x0, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) prctl$setname(0xf, &(0x7f00000002c0)='/selinux/avc/cache_stats\x00') timer_create(0x3, &(0x7f00000003c0), &(0x7f0000000540)) timer_delete(0x0) add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180), &(0x7f0000000580), 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000001580), 0x0) r3 = add_key(&(0x7f0000000200)='ceph\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000400)="9420bb8c2892514ae6df970d9aaf5895757e4a12f5e3bf8dfed01f3123ddf03fa7812f10ca42faac0d8af0c0d65b8882199d52ea45c4352ed3556ca59bc6aebbc0448beccd1e8da2edb154235ed0d0d27df5bce8cdc5d8ed4364b0f14447", 0x5e, 0xfffffffffffffffe) keyctl$link(0x8, 0x0, r3) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vga_arbiter\x00', 0x0, 0x0) 13:54:43 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000f40)="0a5cc80700315f85715070") mkdir(&(0x7f0000000300)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000c40)='/dev/ptmx\x00', 0xecf13a9eb1ad160, 0x0) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f0000000c80)="0c609ad079498cdb10e0dff8f3c696e6698b7211118e34b8b986c75ccc70e14d8070d466d4f2d1954e0a09370c4e216adfd68d1b4bebad919efb869fb6d8ff4a4760bcc2012a1d4f0c9473b070a86283a61d23d20aa01e2c36554a72093a01ae68d2b8dddc") r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000480)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) unlink(&(0x7f0000000180)='./control/file0\x00') write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x3eb) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000100)={0x5, 0x1ff, 0x8, 0x101, 0x8, 0x14b, 0x3, 0x7, 0x81, 0xd35d, 0x8, 0x6}) r4 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x0) ftruncate(r3, 0x3eb) r5 = getpgid(0x0) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000a40)={{{@in6=@mcast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000002c0)=0xe8) r7 = getegid() sendmsg$unix(r4, &(0x7f0000000c00)={&(0x7f0000000240)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000000980)=[{&(0x7f0000000340)="0c218d1b0d441fbbdf74128b84d0e84cfd1b9ff8cbf6231cd59f3bbda2e745bb5a2a71f2b1f5b6f6c096a75ffdf3668bb504967367c1e8923fa6f884bee91127cfc479d26c28b10eacd8f111fc640694aae031e37784d3c6d0ea838485c438635c1721396abf0ae812124b6d3126c678ee6efd2c38c89bfa706d4981cc089176332378ab8f1b10b56e2542a8b0726985de12d0f277363f1c6eea73ef966e70506c356cd0ddad788907054d24498d572df8e21fbb", 0xb4}, {&(0x7f0000000140)="3424c8c60cc548cd0d7bdd6bf5760da3da8c", 0x12}, {&(0x7f00000004c0)="60d0d76e4235e662cbbf6dc4aa66899c466e346800260ae1b88b40547657c0905245aa210282a85056edc4ab112a61feb326ddb10f735d66d84bf7ca6c8de9ef7ef8959773c5902b93f93e3ad1dbb96ca6ece4d629bbef49baf4af3b5e81eeda40415d4b36614cea6ca9d0bdd4b7edb271c9f4cc88f6604a3b22bec5a0d9afd1ea2e1df2af", 0x85}, {&(0x7f0000000400)="c654316b0a89f905fd6e1f2176d4228cce27706e81ef5976663dafc258002bbdcd8a2043115199b6e2a608ca629e6e859bef66766223dcf556b851df6b47c891c40ba6b839ea6ef60ea50d594dd2a090d34d08ee9d94a1ce1da16b19269032f5e2d438f6b967bd48bb1cf63b4594b3487aa379e24cc5b3", 0x77}, {&(0x7f0000000580)="54da88bd024a683f4b3105093e9eca265211f92dc6dd904be607772941879d060a993d2d03b41012f7d7dc0dc2c57fc95b8bcb3e7597b57e3f570ef7db086664b53d82841da2f4d2c871f03d4b04b105b3d6d25de0feeed0839947733015ef73ff", 0x61}, {&(0x7f0000000600)="c417892342eeaa8251b8371c5fa778ae0d4d455bcddc404850d28097259819aefe40ab2b01d432fe46720757b74acaa0dea7bb7d05e261758ac5686e1889f3ef0ac2d23e2bc6f266929dc5f8b123df9607135b562ec03b15fa08122f5e42a4fb30ed53721c0f57285ff56382eeda773af193168c0b9778cf69479647e820a2715fe17c80c1b6c58cc264648c52a12630518aec4a171c3ef800a27ad094294e1d02bd822246a7db427d4636214ce221e31934356de1eadb4d16beadc30ccf038463b2a5f0603d5e3db645af7211f6a008ae7d70ea7ce3d4855497", 0xda}, {&(0x7f0000000700)="cdeda419226b6e79d53a0b69431ba4cf7329fd0b8ffffb0eea48d514cbcabb8a12d58a441592c761b98ff05ef2d9bab135e133bfdbeb226adcce2efef9a979c76fa55299b090f696b1baa0eb597b347f4a4b76cabd719e12034dcbfd6bd35bf7d5b0e06213a337e610ff219c46667ed414046dc919c5b21bf820762dc4148c9f39f3812bcd696045c2d890f9eab2f5c4a027377183274d9eae3fcd1cc938a5356d1df76aea4d0bdde13c028258634c94b608411846826d4aa83125467c1bdacbc901647e307c47bad437", 0xca}, {&(0x7f0000000800)="4a99585d779cf3b0bb70421e12ad1e3e66593c8dda9dc28c2ae1c5fa7988a3143785b5bb681a2850560342793d682cfbd15814cc137c0fc798e07252beb5d98eed12df84e7c328e9add6b4e81c4f1c57", 0x50}, {&(0x7f0000000880)="1e05234eb1bb0dda683b591c4edf536994e1dd24cfb80bf3231248c0061a9f7977c0bbce1f61c390fb3562b4aa3cc0be294223fa70900f474574d608c998c762e2983488cdfae85f6670da753e0948708561abac823d4312910769aa4794cd5c55f2d46bde32e1a2e8f50aa2a2c7e6fb30ec47b1a18f7813c42e220320e0cb6b491a5dbad635b22f524f72e03e138ed1905c8038bdd612a5ca10bf42b18d47c1d1651da9f84bdb19c099109a98b7e441138ceea8986b928cd3767a104d5a585cc9b79f1b97249d0fe35f2d69d57d33cadc2a6851d8b31f406ed092f1570c5ccecc9ddb0a8b8832d384043003f5ee5f36e4666e39ad6051", 0xf7}, {&(0x7f00000001c0)="896efdadd93067e273ae36e12aa630f8fa90f891999e66186ae84431cbef424849253569649d002ca1b1e0", 0x2b}], 0xa, &(0x7f0000000b40)=[@rights={0x18, 0x1, 0x1, [r4]}, @rights={0x10}, @rights={0x38, 0x1, 0x1, [r2, r0, r0, r3, r4, r2, r4, r4, r2, r4]}, @rights={0x38, 0x1, 0x1, [r2, r2, r4, r4, r2, r2, r2, r3, r2, r2]}, @cred={0x20, 0x1, 0x2, r5, r6, r7}], 0xb8, 0x4040040}, 0x20000000) rmdir(&(0x7f0000000040)='./control\x00') ioctl$RTC_VL_READ(r4, 0x80047013, &(0x7f0000000080)) dup2(r4, r3) close(r2) 13:54:43 executing program 6: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000580)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x0, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r5 = dup3(r1, r0, 0x80000) faccessat(r5, &(0x7f0000000800)='./file0\x00', 0x41, 0x300) write$P9_RUNLINKAT(r4, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@version_9p2000='version=9p2000'}]}}) write$P9_RREADDIR(r4, &(0x7f0000000400)=ANY=[@ANYBLOB="2a00000029010000000000000000000000000000000000000000007bafc5328318fe07193a00000000000007002e2f66696c6530"], 0x34) write$P9_RGETATTR(r4, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) r6 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x59, 0x201) getsockopt$IPT_SO_GET_ENTRIES(r6, 0x0, 0x41, &(0x7f00000005c0)={'raw\x00', 0x8c, "92728029f3711e78fe84155ae54bfeb5a4848bf3c85b4d3f55c8fe47c0fefa03e4c2f503b779225803a23ffe5bcaa05bc6dfb241b9b75c90758120de3d56fc0dbc651949636960e740cebdfbebe01ea10789acef60cf11015adb271b8442d0d7253ff8ac764c88e970a415f5f5a6fb5d3ad758ca1425d0b083fdec5a2da58da6ab97d535295e758c483a254f"}, &(0x7f00000001c0)=0xb0) write$P9_RREADDIR(r4, &(0x7f00000003c0)={0xb, 0x29, 0x1}, 0xb) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x2, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}}) getresuid(&(0x7f0000000300), &(0x7f0000000380), &(0x7f0000000440)) getsockopt$inet_IP_IPSEC_POLICY(r6, 0x0, 0x10, &(0x7f0000000680)={{{@in=@broadcast, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f0000000480)=0xe8) fstat(r2, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000a40)={{{@in=@multicast2, @in6=@local}}, {{@in6=@mcast1}, 0x0, @in=@local}}, &(0x7f0000000880)=0xe8) lchown(&(0x7f00000002c0)='./file0\x00', r7, r8) sendto$inet(r6, &(0x7f0000000940)="51caa7f7cf8f46b8cb94108432df7e94832e83cc389d73144d087287f973e516b24c6049a0f4a7a43446fdfcacff58030b1784812c9ac7d2ab7b6eab14e4e835ed9afcaa2c1066c72f67eb21d41ed7aa7006e37abbb03e91476ee3735233ba657650e175f0802482ed3859f820371035a8bbd31d9232f6994a98ffff3f874dd44c7421a4735b51eea8b4253557587c8608d3bd455925df51620ddfeb4f3667c731c65dcef6bffe9644d989b6fd7c7fc88680b074ee6e284945a65d9ae73528cf628df73fc52d6ef6f6c4a955ce718f4f28c3420f0b3e5db7f636f7583873b1c450d36ae7a3db67c5fafc3e", 0xeb, 0x8004, &(0x7f0000000540)={0x2, 0x4e24, @multicast1}, 0x10) r9 = fcntl$dupfd(r4, 0x406, r1) ioctl$RTC_PIE_OFF(r9, 0x7006) 13:54:43 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/loop-control\x00', 0x2000, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000440)=ANY=[], 0x0) clone(0x0, &(0x7f0000659ffe), &(0x7f00003c6ffc), &(0x7f0000a4a000), &(0x7f00007c4000)) clone(0x0, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140), &(0x7f00000000c0)) wait4(0x0, 0x0, 0x80000000, &(0x7f0000a94f70)) r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r1) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000400)='/dev/full\x00', 0x401, 0x0) getsockname(r2, &(0x7f0000000640)=@vsock={0x28, 0x0, 0x0, @reserved}, &(0x7f0000000440)=0x80) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockname(r3, &(0x7f0000000300)=@alg, &(0x7f0000000380)=0x80) wait4(0x0, &(0x7f0000000100), 0x0, 0x0) socket(0x2, 0x80000000000001, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000200)=""/117, &(0x7f0000000280)=0x8) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r3, 0x8004e500, &(0x7f0000000480)=r3) ioctl$EVIOCREVOKE(r3, 0x40044591, &(0x7f00000003c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$LOOP_CTL_ADD(r4, 0x4c80, 0x0) ftruncate(r0, 0x6ef) ioctl$EVIOCGMTSLOTS(r3, 0x8040450a, &(0x7f0000000540)=""/193) 13:54:43 executing program 2: r0 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000100)='/dev/pktcdvd/control\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSTAT(r0, &(0x7f0000000280)={0x7c, 0x7d, 0x1, {0x0, 0x75, 0x1e5, 0xf12, {0x42, 0x3, 0x1}, 0x80010000, 0x6, 0x2, 0x20, 0x15, '/dev/pktcdvd/control\x00', 0x15, '/dev/pktcdvd/control\x00', 0x3, 'em1', 0x15, '/dev/pktcdvd/control\x00'}}, 0x7c) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0xf11f00, &(0x7f0000000000), &(0x7f0000e32000), &(0x7f0000000040), &(0x7f0000000000)) r3 = fcntl$getown(r1, 0x9) socketpair(0x9, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x7, 0x0, 0x0, 0xc93, 0x0, 0x6, 0x7, 0xfffffffffffffffe, 0x9, 0x5, 0x100, 0x0, 0x16b9, 0x9, 0x81, 0x7ff, 0x5, 0x0, 0x7, 0x8, 0x1, 0xae, 0x2, 0x4, 0x0, 0x9, 0x4, @perf_config_ext={0x101}, 0x40, 0x40, 0xcc2, 0x7, 0x2, 0x10000, 0x8}, r3, 0x3, r4, 0x9) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)) 13:54:43 executing program 7: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x1, &(0x7f0000000140)) fcntl$getflags(0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) umount2(&(0x7f0000000200)='./file0\x00', 0x2) mkdir(&(0x7f0000000300)='./control\x00', 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000480)) creat(&(0x7f0000000000)='./control/file0\x00', 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./control/file0/file0\x00', 0x9, 0x1, &(0x7f00000001c0)=[{&(0x7f00000004c0)="8892f396bf774fdc5462aee25b8371ee699eb8070eb587273b1b7b3c6e4df86babadc8142527730c0aba68c2f59278c89e3ae06cd68d77d94ae722cd11d4deee57372160838c88bf7110ca7d1a04d461bf68f94ba371f013b084b623d55e67b8ed2784d30f9ce873c09992fc5c504723caf19b95da22d3ba615ab7c37affb7dc6542987228da38fb6a559bbc5bec1ed994ff7ca94925422a70bc42a644b99a40407829", 0xa3, 0x1000}], 0x1001080, &(0x7f00000002c0)) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000240)={0x6, 0x1, 0x5, 0xff2, 0x3}, 0xc) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$binfmt_script(r4, &(0x7f00000003c0)={'#! ', '.', [{0x20, '\x00'}, {0x20, '\x00'}, {0x20, '\x00'}, {}, {0x20, '/dev/snd/seq\x00'}], 0xa, "6d9a4cce9c164e6e65cc04c01f2ad684234d81ab7e5aaf335d1a111a7e8b1b90aafb3043a2cd6383bdb6d63e7d8f2a452b3f5a9d45f257f2fec516f0bb7b16f25f254db8655208edc609411f6e3d66395afca32c36c980a76acc05b957415ac367c68b3dd6c0ff82dbba38dd002a3dc20463b5a0bfcf94621287906a9cf3"}, 0x98) setsockopt$inet_msfilter(r4, 0x0, 0x29, &(0x7f0000000340)=ANY=[@ANYBLOB="a4141420000000400100000003000000ac1414bbac1414167f000001f7e0df1d272aa4145767e54d3a996ac49a94e564304cb70284591bf8a34fc2f70c5cc72f3c507f7a01549175e4f9e399cee107a6c29c02bdb24429276e27a1a9d365aba200ea0f75bc181fc4130403763b8b8e2b6b2fa0420501eebe9812"], 0x1) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r5 = memfd_create(&(0x7f0000000180)='\x00', 0x3) r6 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) dup2(r6, r0) ioctl$EVIOCSREP(r5, 0x40084503, &(0x7f0000000140)=[0x4, 0x80]) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) 13:54:44 executing program 2: r0 = socket$inet6(0xa, 0x800, 0xfffffffffffffffd) r1 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000480)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r2 = creat(&(0x7f00000001c0)='./file0\x00', 0x40) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0xb) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000004c0)={0x0, 0x0}, &(0x7f0000000500)=0xc) keyctl$chown(0x4, r1, r4, 0x0) get_robust_list(r3, &(0x7f0000000100)=&(0x7f00000000c0)={&(0x7f0000000040)={&(0x7f0000000000)}, 0x0, &(0x7f0000000080)}, &(0x7f0000000140)=0x18) 13:54:44 executing program 5: mkdir(&(0x7f0000578000)='./file0\x00', 0x0) lsetxattr(&(0x7f0000000300)='./file0\x00', &(0x7f0000000440)=@known='system.posix_acl_default\x00', &(0x7f00000003c0)="0200000008000000000000000200f30000000000", 0xfffffffffffffec0, 0x400000000) mkdir(&(0x7f0000000100)='./file0\x00', 0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@nl=@proc, &(0x7f0000000080)=0x80, 0x800) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f00000000c0)) 13:54:44 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000000140)) ioctl$PIO_UNISCRNMAP(0xffffffffffffffff, 0x4b6a, &(0x7f00000001c0)) recvmsg(r0, &(0x7f0000000100)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000000)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x200000100) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x800, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f0000000480)={0x0, {{0xa, 0x4e20, 0x5, @mcast2, 0x20}}, {{0xa, 0x4e20, 0x5, @ipv4={[], [], @remote}, 0x7fff}}}, 0x108) pwrite64(r1, &(0x7f0000000300)="c0fcd2473754044cdd4719d7c28d11789e88ae1c8f0cc6f968f353788d85eb9af9d758ce108913645985c853cad7eb39e7a0953e7050d2ebc5da1142667568bbef8657c646279b4bed4ddf6f0ffe272b34fcc8ab1848f8e998ce5d731a23136538218159d49f9bed00fce1583c01334343b094db60b71dd2018b754780d726d0b4d3e66a8977206a9123f4d3cd4dce30cf20436023b5d323a23e57c3bda852c42056c23964266b4ba9b6a95a4bae78f0acee858e9556a58d3092285ecb57e3cbbb78962bff3bb10d25", 0xc9, 0x0) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000440)=0x4, 0x4) write$FUSE_GETXATTR(r1, &(0x7f00000002c0)={0x18, 0xffffffffffffffda, 0x2, {0x679}}, 0x18) r2 = open(&(0x7f0000000280)='./file0\x00', 0x140042, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000240)={0x7, 0x4d, 0x1}, 0x7) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$void(r2, 0xc0045878) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000400)='/dev/loop-control\x00', 0x191000, 0x0) 13:54:44 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) pwritev(r0, &(0x7f0000000300)=[{&(0x7f0000000280)="cedf699688aaa782ec9bb947e4f4d81d549bf417f1a25aad3e67e5e45b51", 0x1e}], 0x1, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000200)={0x0, &(0x7f00000001c0)}, 0xfffffffffffffe89) setsockopt$sock_void(r0, 0x1, 0x3f, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000500), &(0x7f0000000540)=0xc) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x100040a0}, 0xc, &(0x7f0000000640)={&(0x7f0000000840)=ANY=[@ANYBLOB="78000000000000000300000000000000a99a324fc85ec718a2811d0201230615dfd30e070000000000000100000000000000070049903d4c3dcf0a9761ba53700000000000000700000000000000010000000000000003000000000000007f000000000000000800000000000020df0f00000000000008000000"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$sock_netdev_private(r0, 0x0, &(0x7f0000000580)="f798494ae8e0e450025309e90caf551040a52d458d836a735a8a628b1c0982b857b7e77b78a6577890d7a0638a486f1e9b8667addd32195ab2fa7e3fc69c37500d21d6f3c15f827e048ea9be132b6864271bd14cd6361b18cffffe8ed1c8d286b5deef0161626b9321a46b133bf1b1970e78d9cba7029686f4f659c243200017") r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x80, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x181000, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r4 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, &(0x7f00000002c0)={'bridge_slave_0\x00'}) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") pread64(r3, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="030e71fcfff76fae0400392dffffffffff001b000000"], 0x28}}, 0x0) socket$packet(0x11, 0x3, 0x300) dup2(r1, r3) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000080)=0x8) 13:54:44 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0x0) creat(&(0x7f0000000000)='./file0\x00', 0x100) 13:54:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'vcan0\x00', 0x2001}) mlockall(0x5) 13:54:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCDELDLCI(0xffffffffffffffff, 0x8981, &(0x7f0000000480)={'team_slave_0\x00'}) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x2, 0x12004) ioctl$VT_RELDISP(r1, 0x5605) unshare(0x78000000) r2 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000440)='/dev/pktcdvd/control\x00', 0x400002, 0x0) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f00000003c0)) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)="38c13251726176dc15777f14fe4b041fd46e18db67b85b9978d7d5676629992115876884131176d43b71b71f216c65b7138fd337b5a54dc8ecd138a3e7b8e5e9dbed", 0x42) ioctl$TCSBRK(r2, 0x5409, 0x84) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f00000002c0), 0x4) r3 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000040)={{0x1}}) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000500)=""/99) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x410000, 0x0) ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000400)) r6 = memfd_create(&(0x7f0000034ffe)='\x00 ', 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000280)={@mcast1, 0x0}, &(0x7f0000000340)=0x14) r8 = getuid() sendmsg$nl_xfrm(r5, &(0x7f00000019c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000680)=@newsa={0x1318, 0x10, 0x100, 0x70bd28, 0x25dfdbff, {{@in=@rand_addr=0x1ff, @in=@remote, 0x4e21, 0x5, 0x4e20, 0x84dd, 0xa, 0xa0, 0x80, 0xff, r7, r8}, {@in=@loopback, 0x4d3, 0xff}, @in=@dev={0xac, 0x14, 0x14, 0x1e}, {0x6d136e4d, 0x9, 0x7, 0x7, 0x80, 0x7ff, 0x8, 0x110}, {0x8, 0x81, 0x7, 0x3ff}, {0x80000000, 0x4e, 0x4}, 0x70bd2a, 0x0, 0x2, 0x3, 0x1000, 0x80}, [@output_mark={0x8, 0x1d, 0xffff}, @ipv6_hthresh={0x8, 0x4, {0x5e, 0x2a}}, @replay_esn_val={0x2c, 0x17, {0x4, 0x70bd25, 0x70bd2d, 0x70bd26, 0xfff, 0x8, [0x200, 0x9, 0xd850, 0x2]}}, @algo_auth_trunc={0x8c, 0x14, {{'speck128\x00'}, 0x200, 0x1e0, "8104d72daa92c5f4f9641840c0113cb891a71324b31ebb420b861490453e6713bf82ebeb1eec728616228a982659dc75747312a97ef19de02f74da18f03869d0"}}, @address_filter={0x28, 0x1a, {@in6=@ipv4={[], [], @broadcast}, @in6=@local, 0x0, 0x5, 0x80000000}}, @replay_val={0x10, 0xa, {0x70bd26, 0x70bd2b, 0x8000}}, @migrate={0xe0, 0x11, [{@in6=@ipv4={[], [], @rand_addr=0x3000000000}, @in6, 0x32, 0x3, 0x0, 0x34ff, 0x2, 0xa}, {@in=@loopback, @in6=@ipv4, 0x3b, 0x0, 0x0, 0x3504, 0xa, 0x2}, {@in=@multicast1, @in=@dev={0xac, 0x14, 0x14, 0x10}, 0x3c, 0x5, 0x0, 0x3502, 0x2, 0xa}, {@in=@broadcast, @in=@remote, 0x6f, 0x7, 0x0, 0x3504}, {@in=@remote, @in=@broadcast, 0x7f, 0x0, 0x0, 0x3507, 0xa}]}, @algo_comp={0x1048, 0x3, {{'deflate\x00'}, 0x8000, "7fe01f5325a2f4bbc4e4bdc13583a30a205d14ddb5bfc6723df69a22cc78042899dac062d56ab4afca32e3d4cfd5ec81a99639a27a642f23918f4e4837884e077311f64f612cea94230005449c7c6b332047a615de7c1d294599e0b448f1a48ab5acd3642b8cfbadecc09c36600a923c9ad154acb435d2200f77c50f24be31345dbce9d91fb4ebee758afa94c97a61d351920bcb0d2abcb2e536644342016a0b10517df3af29285730ac7e5cca56d64ca001621afcfeb7b24ce056b91d2831ffb0f158cb68c949d3ecddda14c3b55503031278808560d8dcfacd7874bd449ba87974f38d1816501d309ee2155d502202d55edbc820500125b62873f4b93812fb3040ff148873caaadd4ad20777cc85a0621abb39d946a75a1e4b1500ea98ac20bad93dd9f555ff4877152345b5926dfe8cb11b817312224656dd5797f38b17f807be277fe0e177eea57d7b6c34aa0e6429fea91ca93ea25e0836a98436395d9ba7fb60974d474da5bd9bede6cb194a349c21402784b20652a7171b24dbd7b4539f4de66400950a7b2e22bd784d21c5412db103f68de90d94d2b79935c77fa2df9f0f3c2a89f64dd324d645c3c33ed858979b468b8220076913c5ff1c276e393d0f839aec1cff3e72d83fcb603b95643a309ac7bbcf95d5ff15a096784e0f3a64fb1a2ff3e822d70d5ae966fdf010b62c248c9b9c3c34516b8174466f6143a42f291a368fb6cd0d24f0df36de8eee8d7d93d12f1727b59439b64e2963de1bc3be2212305f1a0f9b67d7768f165039e9c1ed9bfe334d32b56a06645abe36130d5392558d5b2bb36f01f6ca78e670baa9809b61e7528d0eb3eaec3381f244f3bc8e444951cfbe9df96642c5f7df07d9447df8bcd8165613ba8a9b57beba5fd041e30f5d8315923861d0848bebebf9c7595dead9ef60c830b89b0b7c6af5009b29385323016523777d3094d8fb35b133b3c32746241aa6a61f926c058b8db468c88d056bff71177ecef32ab0fb6026b9aad30e63304e21ee204dea9e4ff01f6dc9c1f61974e670bb844a890f3560f3b0e38cf706e53d1da4d5bc43bf2ca8ff5a1cc77ea2804bc6648c811700d110c6389045318b34328d6d7f590447985306c0ee3d6fec9c97e0708880169163ed18341ec6d19a93b5c0f2ec96344feb4d5aebe16335e02917499d50e609e979b80f5915e2b16e1eaeac2dd926296abe321e82b6d9c19a756fc558b89034be3bf9beca941fa800822b1666f717b258c5e277b3f9fe573596ce6c565c31a0be9d734ccccece952bdff727b47fb8aedb22df7610bf611b1159cf41401e5e1986e99f9f0f005337fd40aaa3c5d585663e5c316f0ece5abe88de7262f34cdc2d5aeb57a7ff9d65ae469383231dd0760b46d4d737db0d4a20f5c830e42b6a4e70a7169c12e4aff772fa1001d07d4f57012345fde09690829b34306e336a78f9938883f0e6d8b3b362c42d036ccece9f47171cf97fff75a0c8cb785032cce05899d0a8d4e96afb1ed836a86c2db66f9e20ad09b1fc539919e1008e7bd897ff467f9a4ddb5d111806efd17d654b9a08d25a4f59dbfcb3893ffce8fed47bb951c90560484d21abff49abf0b29d2559916edf5d2119158288b631d9609d3bb2cdce8e426e161b6175e7995669e30021c16295fa7dd486591f612423860aab97b5758227c1939920915bc30263e7def52a0b919a782d935b9d459c88cdff479c2c184a5e1d630ab38cc716969e35861d7ee734eb144b27e8e3acc3325b25bc84ee5402f732ce9f9138f7240f5590619dc775cadb9c17383b1d031b735f33784eaee42ffd58f7309359b7c9c04fd71553fde4fe1f163859af65b91f613545813ac2f950437743b22ad28403f91a993f5219caf7e8c1c742b22cf2384c1d1827b201f9ae560dfd62e0df9020c63dac20ad544306ac424c3579d897a8701c44cad71c20d22c601f138cf9bacb301a8b42fb1356119eb34f0d0fe86f354888930daedaa8ff434a3a4e33485951c48e20902748011e798fc902fcc4abc7c26db2815007ca4c0fb28c2e9c3cd1d042d1333784bddfe04159e01550f953f53972293f96865ec9cc9437f8277b46451fb4e4653fb3df701040941704b1e4fcac650a8ce24f1ea6d25f6117f6b778d7a32983da3b3d9c3024d6a9de5ef254097ddf97d17ffbe0fcb37a3c26398e54015b1e02f94ed414228c2fc806ffed173fa733b2cb612f2b3eea76bd37f61514ffb3e5586352b1cd3f241aaf1ec074f379cc2afec5aaa08a720d85d3abf1aa9eec484eed95770a031cf353ed93f2627bc45135711798a6e8cb899c2825e92d3a5cd673881298776437ef25df1e892cc28543814d572254ac26b9729db9082dc0a5ddb4b6497d4cfb5509f5478ee74d295adf4066b88f6ec79b6b54edda1a03b47c4528b94d8922621aa5ebae40b7db38b9ce174dec894ec33f288e7a8b1599a444a8d69883d10565bcebe6a9b981ddac1fa5bcef96320e4221df275bf68deb4b3a668f652c4d45e51923a6e6bb3758dc9b5eaed41a90b1c0c3f2b870c970bab5576c64bd8cfb8b8d7b75e10e98c37e2bddce5a669f25661f733ff03a7b93c604aededcbacf4a49641752359ea61aa2d9465bd9a1dd52a7b3c471f2b94057b89802cf5c8b9c8d1f6b650f25be0fc9f5c5124c7cc63b435b390075ea8381ecaa2c3c13294ac4157ca507e1c1f6d88aa24d9c911cf5c3d592c8a7af33d809f10e30bb9fddc0a071ed4b95e780b44fe5fb660dc2f5db684b77fa51630757276d786ef0988b61140cd27474deb88a67b3b2ab249989f2916aaaf58f7ac4ff3b3971a669d459594800df5f61f3779c8a7484cfeccc3be4465d7a05a8062634dd02db2f71aec64c17df332cbbb1a82958bb38b30ea81810b6331892f4cbafd482f708281e6d91e658d76f91011dd2cdc0c2c4afeec996a454125a55590facd9351309c44a92b3bfa55204d62fb3d4083e2c77c3b013e9689c1e68ef3677b44d955d937a7c6fdeb3dc1beed7d79a1ad11832acc116e2662d0b986d1c1ee04b4bf79e1ef620304f75150f587dc62f3ef1826e04ead36fc5f4acf440ba907e9ff9eced9fa20081ea7f4774a2d1edc15e51987ee488fce69ea36a40fc5f591abb2ca6f984e8ae5bb08b52724e94eea4519a4a8ae83cc02509a3f9bbf59efd1007dd7395ee0e8298219c8b09cee1e4b45ae38968fbf6eaea22b17c9dad0518d49031a5b8352aaca18385619258cf0f9e4eb41c2a2c350eb1157edc85a7cf97109e83445b6fb4f83661669ad9953237e07aef8c5e30c2f636ba7e6fa69aaeb990985ee359670857c56219765a7817403fb8655b13bf296a07814af2b39426b6570fcb952a78b229407915b6e2038212dd5d6f85ed392ed82b44f8438ddbb2c9900ae342d2e8032e7ba0f3299625e991ffeee30f76c9fbc57b96ee9a7b2ecbbdb66ab9844973b3c9b029953ef558580dc51c45138fc6e6fdda22c8d1ee276643df7b9ea95017e75859713b308aab616e7ed9caf69cbf97342b22eccfaeac4f0ad928d287f5b62450e970cdb87660fd80bf07df6816e38aa09e8de4721dd17591178d64d49898b796c7abc22369e842ed9989e017a01e42eda27debd0d88da93316f5752294991cce9a12298baff91bad4f9a0636f607944d8229f3d045ce24adfcdfb528fd049a974f8f037f4e05fca2312d22d2682854d593a9a876f05f211e67749567364231d73053982925df50d75e806886cddd865a42512f48ce75f84dc2b2df678e15589b6a119cd0b21fddd09c5dcba60682d6cdc41ff40684eb7ef83dd924f7193a148d793b3c419f525e7f92bea8e6fc0c24c7b218c6b4a7e58fcfc113b2a3a7094356dc8dffe3c0c6ff015eb194d056122dc9be877dd39ea7ca42b9cad0681492e0c783a037fc272c727f48caab408be0899416de1cc1f931f07b1fb8f3cd07b9e40b8a1ed55914efbe37ef6926e2b820959d356a16021fc8425da8c530da9c88cd9e9d2dcf5e1e6d7b4e84b140ff0bd15941d73d0ce4804ef72cb42d0e9c24048a2c6f1fb4fc9e27b3d908df691d24f4ee85b9010ca02c541ed03262d2da0892d5f558180a3acfc06fbf6c1c90c0936c51e2ecae301ed0f4776076e1c4c4f581d5bdbca8ec08de01acd8c8b13e3d97500b8e56e980436b61d96d68fa41250d0fda9c2fdd964f7e9b2cbeb1a33538b742a41b0fc32defd6c508b58f5d53d25fae356441c7cfa9b729f76d2d31989fdcd5e26e9ad5d08dbf73908f0c42f467b85a40a869b2b113f88738ca319dd946320f585b5e713bb22bf3e929e9024ff4b43fa939beac1c121a513fb69865cc8293edb7be2e53f0c3807b339eb28d1377f99f78ef0e709ba1ae8137c03672bbcc9933bdf8c08afc7e0b6e775477563835b62f2242b2a5f682447eceb6339495257fafa429ba5491d2cd13b8cb666cb401b6db8bb6307b2475896f41b75a127a73f84b7f777244e8e3c779f386b5e13e255ab03aebf5153adf17eba2c7fb7d18bacc8acf58e6af7831d703aea9b87dda3c4231e75b1e5968ce4967030a9a8acda94e61e46d45d75486aea0b99432470b6b7ae819d46fa8ed53cf269c6735f8e320b0e50977b6700f9d1eb077b9200c9826b435714d7f36a583ac9c432cedd7e8fbea8f2804c85eb835ff778076a45594f381469dd1979ab2da058a737be792e84b00d8065b528460c4f7aa2100c94a08738bd743934b2d37b18a807d9150475e6a89276937768c44394879c3f18b07dbcf5f79fb4098f88624aa7dedbf1f2297c3153fc43820cf67efb435faee6f26619dde63bb2f478fada5c18b4aa7358d4f6d224c78c021477e433ecbcdea7c8aec16fbc5e91da542a2075043c77737f5e149f6b3f2122901f9bb2d0f1857f40a193dbf56b73f779aac17598addb789229bfe3031b6a05c2af995226738356d6d64d53c23573d86501223461e6026b1c3079fd8ccca05839fc6be4846871349fabdd9a285a2c620a379ee9fcb89406b5f4a2f76bfc4c736ff7a10e4850aab262efcf60ac52c57e25ead37d12c35321ad98d4b352562ac94c58a899f0d3f03d83b6547f9363c4722212d17eeef174e3161eae5496e45dd681bbbf6241a0f89d444ae17c4c9d0d3e9279f3dc18143f48e644e0ddfb7d559b2d4abb11894a7d7c16e164b03be7982e43de18241f3eb92533ba8f58a9621e98238532d21f42afd354904480d9a3b8731bce92cc4758c045d38578549b9beaaa7a2c0ad75c7983ece6f2b977918f6a4b820833e39fcc64beb8a3098ec637f7193096d792a115644233d2352dabbe7e71c81a08205641e9348e7e05d20bc9bc9816e34da9c3aa41507efe8624f12b7bf1bbd7fdeaaea0e839061b4896372de897699d551f14e7442bd459b8d615e1be2209fcec378e790a436f3d84a58ef33712f36e55cd78bc06879254508344ff9d15582185aaf3c7475fcbc5c152d03aef3b832bf4cc866a9375bca889e1ababbc5140e9e68926846fc61bc4099a7eccd9832a15d9fb442f7e74a2358cf547d886cf465aeb03b8c0f8f69aab917230a1acc074402d92c63f4b5dd5cae34ccce296c17b9e9ddad9e867a4593b38d7076d2b21375f631a58866170b3808b6ff44f957a22dc76b2b6387b760653341d73e5117731f10387333eb35714c270efba793c70040af2e0575b98cd172aa459f537c082e9ac4df4ed24e9b1d34fddc220ada400c2475851e64b2db0be939df164225e1c01479adedc241038ea99f73df1ab1562422b02edccf05fe645944ccbe17ff"}}]}, 0x1318}, 0x1, 0x0, 0x0, 0x4000}, 0x1) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000000)={'lo\x00'}) r9 = syz_open_dev$sndseq(&(0x7f0000053ff3)='/dev/snd/seq\x00', 0x0, 0x101802) r10 = dup2(r9, r6) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000240)) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f0000000100)={0x0, 0x0, 0x7, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x4) dup3(r10, r3, 0x80000) write$sndseq(r10, &(0x7f0000048fe4)=[{0x0, 0x1fd, 0x0, 0x0, @time={0x77359400}, {}, {0x800}, @queue={0x0, {0x100000001}}}], 0xfffffec3) ioctl$PERF_EVENT_IOC_QUERY_BPF(r4, 0xc008240a, &(0x7f0000000580)=ANY=[@ANYBLOB="01009c5c98d94bea67c9bce2e53aaf855bac100013e4bea810dcaa300794b0779df726d243ec2f6a89351faa8170e919c1c83e4f909bd8b7368259ecdea853503f01381914e290ac56ca96e7cf3e8b6b306e8f35cdc38da30fc3f9175037564a2a4e94f07cd86d4c8d3e33ed0d9bf0cf56d0159a405637e5aa338f1449b7a427d91341fab61e70225f757dd2352916cb0aa3969b368d1a6e332954faed94404b94f5394c3a73e0b4263e0f11b28832ea89fe3e3ae452fb9d1df6e580dfcd1ce40bac253383746bf5fb7a9c0fc516b93d2ffc3c4e69c8545eb51df94410a6ce231d474bff4733e9d8bb000000"]) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) pselect6(0x40, &(0x7f0000f33fc0), &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f00000000c0), 0x8}) [ 361.226610] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'. 13:54:44 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x80086601, &(0x7f0000000040)={0xf58, 0x80, 0x5, 0x0, 0x80000000000000}) [ 361.290336] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'. 13:54:44 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='environ\x00') ioctl$fiemap(r0, 0xc020660b, &(0x7f0000000280)={0xe29, 0x8, 0x4, 0x6, 0x6, [{0xcc, 0x2, 0xfffffffffffffeaa, 0x0, 0x0, 0x1000}, {0xf10, 0x43, 0x0, 0x0, 0x0, 0x800}, {0x5, 0x198, 0x9, 0x0, 0x0, 0x8}, {0x4, 0xae56, 0x3, 0x0, 0x0, 0x1000}, {0x6, 0xfff, 0x7, 0x0, 0x0, 0x4}, {0x6, 0x200, 0x7b, 0x0, 0x0, 0x8}]}) read(r0, &(0x7f00000001c0)=""/171, 0xab) openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) 13:54:44 executing program 4: r0 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000b40)='/dev/usbmon#\x00', 0x0, 0x10108) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000780)={{{@in6=@mcast1, @in6=@local}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000680)='IPVS\x00') ioctl$RTC_PIE_OFF(r0, 0x7006) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000200)={0x1}, 0x4) ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000340)=""/150) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffff8) fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f00000001c0)=0x6) setsockopt$inet_mreq(r2, 0x0, 0x27, &(0x7f00000002c0)={@multicast1, @multicast2}, 0x8) fcntl$getown(r0, 0x9) pipe(&(0x7f0000000280)) perf_event_open(&(0x7f0000000ac0)={0x2, 0x70, 0x6, 0x7, 0x595, 0x0, 0x0, 0x8, 0x21, 0x0, 0x2, 0x4, 0x8000, 0xc3, 0x80000001, 0x3, 0x3, 0x6, 0x101, 0x3, 0x20000, 0x8, 0xfffffffffffffffe, 0x0, 0x0, 0xffff, 0x7, 0x7fffffff, 0x0, 0x3, 0x7, 0xffffffff00000000, 0x0, 0x4, 0x0, 0x5, 0xfffffffffffffefb, 0x0, 0x0, 0x3, 0x1, @perf_config_ext={0x1, 0x284}, 0x80, 0x1, 0xffffffff80000000, 0x0, 0x4, 0x7, 0xfff}, 0x0, 0xf, r1, 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, @perf_bp, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000000) ioctl$VT_SETMODE(0xffffffffffffffff, 0x5602, &(0x7f0000000240)={0x81, 0x10000, 0x0, 0x7bab, 0x6}) msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xffffffffffffffff) [ 361.458038] IPVS: Creating netns size=2536 id=43 [ 361.533319] IPVS: Creating netns size=2536 id=44 13:54:45 executing program 3: r0 = open(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, &(0x7f0000000500)=""/246) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)="636c6561725f72656673000e26f4219411c8d7870771d49f76") r3 = getpgrp(0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)=0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000002c0)={0x0, 0x0}) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f0000000340)=r4) prctl$seccomp(0x16, 0x1, &(0x7f0000000440)={0x1, &(0x7f0000000400)=[{0x6, 0x5, 0x6, 0x1f}]}) r6 = syz_open_procfs(r5, &(0x7f0000000140)="736368656473746174007175ffaed85ef4c646fec2ac4f5df9449c1cf5efa7272d") perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f0000000100)={0x4}, &(0x7f0000000240)={0x5}, &(0x7f0000000280), &(0x7f00000006c0)={0x77359400}, &(0x7f0000001b00)={&(0x7f0000000740), 0x8}) sendfile(r2, r6, &(0x7f0000000700), 0x1) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="0b00000073797a310000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009000000ffffff7f0000000000000000"], 0x118) alarm(0x0) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xd43f58e118afee75}, 0x4) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f00000003c0)) accept(r0, &(0x7f0000000600)=@hci, &(0x7f0000000180)=0x80) ioctl$GIO_FONT(r1, 0x4b60, &(0x7f00000000c0)=""/6) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = socket(0x18, 0x0, 0x1) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r3, 0x6, &(0x7f0000000380)=""/41) connect(r8, &(0x7f0000dcd000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}}}, 0x2e) 13:54:45 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85714070") ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000200)={'bpq0\x00', 0x5}) ioctl$SG_GET_SCSI_ID(0xffffffffffffffff, 0x2276, &(0x7f00000000c0)) unshare(0x8000400) r1 = mq_open(&(0x7f0000000000)='-$\x00', 0x6e93ebbbc80884f2, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x2}) mq_getsetattr(r1, &(0x7f0000738fc0)={0x800, 0x4000}, &(0x7f0000001140)) 13:54:45 executing program 2: socket$inet6(0x10, 0x3, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x101000, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x58040) write$P9_RLOPEN(r0, &(0x7f0000000000)={0x18, 0xd, 0x2, {{0x41, 0x3, 0x7}, 0x1e}}, 0x18) 13:54:45 executing program 5: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vga_arbiter\x00', 0x80000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000000600)={{0x7ff, 0xd8e}, {0x40, 0x7}, 0x1ff, 0x7ccdf13147df7b60, 0x3}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) fchmod(r0, 0x4c) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000180)={0x4e3, 0xffffffffffffff6b}) mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='9p\x00', 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX, @ANYBLOB="2c706f73697861636c2c76657273696f6e3d3970323030302e4c2c76657273696f6e3d3970323030302e752c6c6f6f73652c63616368657461673d7472616e733d66642c2c6163636573733d757365722c00482677b1360050c0365555a2512b5fc63f701a41b2a51d9115ff536ed0232f73eed5d5bbb8e0dbdbadc418c68954dad6abd474ba4695e1b581e2ccd2eb4db6a2804a3781b3f80de6dd014453b2aab30d2d8dbe428cd75f8c445f919bdb3f3213283c88ac1f87a5ff1bf9ae9d3a55494465e4f2f8ead10979ae27f61df6671f4db96113e315308cbe703b"]) renameat2(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x1) umount2(&(0x7f0000000500)='./file0\x00', 0x0) 13:54:45 executing program 4: socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket(0x18, 0x80000, 0x80) r1 = accept4(r0, &(0x7f0000000500)=@ethernet={0x0, @remote}, &(0x7f00000002c0)=0x210, 0x80800) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x400000005c831, r1, 0x2000000) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$UHID_CREATE(r2, &(0x7f0000000100)={0x0, 'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000040)=""/183, 0xb7, 0xb6, 0x0, 0x1f, 0x3f, 0x3}, 0x120) getrandom(&(0x7f0000000240)=""/71, 0x47, 0x1) remap_file_pages(&(0x7f0000600000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0) 13:54:45 executing program 6: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000a00000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000e0ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bf6edd0999ef20cfe895c71e1e3049927f20b1176844d02cd925c9593aa981106a867a3862ead004b2233c947a273cd39f"], 0x110) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000a83000)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000340)={0x9d, {{0xa, 0x4e23, 0x100000001, @mcast1, 0x20}}, 0x1, 0x3, [{{0xa, 0x4e20, 0x7fffffff, @loopback, 0xffffffffffff5047}}, {{0xa, 0x4e22, 0x100000000, @local, 0x6}}, {{0xa, 0x4e23, 0x8, @mcast2, 0x74}}]}, 0x210) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000180)={0x4, 0x1, {0xffffffffffffffff, 0x1, 0x8, 0x2, 0x10000}}) getpeername$inet(r1, &(0x7f0000000580)={0x2, 0x0, @local}, &(0x7f00000005c0)=0x10) 13:54:45 executing program 7: syz_mount_image$f2fs(&(0x7f00000004c0)='f2fs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000140)="1020f5f20100070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000016000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0000e5ad079590b8e49e800000004d6b55a0f3cd5500", @ANYRESHEX=0x0]) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x82, 0x0) 13:54:45 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0a5cc80700315f85715070") getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000300)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000340)={@local, 0x3f, r1}) seccomp(0x1, 0x0, &(0x7f0000001980)={0x2, &(0x7f0000000580)=[{0xa4}, {0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) 13:54:45 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') sendto$inet6(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) sendto$inet(r2, &(0x7f0000000240)="2590e75c412f44bec81babcbe5d57f41388c", 0x12, 0x4004040, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000340)={0x60002004}) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$TIOCGWINSZ(0xffffffffffffffff, 0x5413, &(0x7f0000000280)) ioctl$SG_GET_ACCESS_COUNT(r1, 0x2289, &(0x7f00000004c0)) ioctl$KDSETMODE(r1, 0x4b3a, 0x3f) syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x109040) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000540), &(0x7f0000000580)=0x4) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000002c0), &(0x7f0000000300)=0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) write$9p(r1, &(0x7f0000000400)="f6110892f57227e4f3246e09436754dfcdfc59f4af88e13a614e4aea845a3f1d06c2cf1141e5bfa6fa07a5bc1d47ea712bcd4b6ebc92ef0295586c8ae71cb96da96474613fada784e297725e751bbc9cd26ddfadf9feb49e5ea2173732ec541ff4e4", 0x62) r4 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x0}, &(0x7f00000003c0), 0x0, 0xfffffffffffffffb) keyctl$search(0xa, r4, &(0x7f0000000480)='cifs.idmap\x00', &(0x7f0000000500)={0x73, 0x79, 0x7a, 0x2}, 0x0) sendto$inet(r3, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) writev(r3, &(0x7f0000001400)=[{&(0x7f00000013c0)='8', 0x1}], 0x1) sendmsg(r3, &(0x7f0000000700)={&(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000002600)}, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10) connect$inet(r1, &(0x7f00000003c0)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000680)={0xff, 0x4, 0x1000, 0x7, 0x9b0a, 0x6, 0x0, 0x3, 0x81, 0x0, 0x8}) sendto$inet(r3, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) 13:54:45 executing program 7: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000000)="0a5cc9cf1eb6f2e6b637c9c84c754fdc910c523c3affdc8666b87e3187084a91b6c1b58f4691cc46f749b451945f8bae73812f") ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000080)={r2, 0x1, 0x6, @remote}, 0x10) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/mls\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f0000000300)=""/4096) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000040)={r2, 0x1, 0x6, @local}, 0x10) r4 = memfd_create(&(0x7f00000000c0)='bdevloeth1eth1!vboxnet0ppp0cgroup\x00', 0x2) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffd) ioctl$EVIOCSMASK(r4, 0x40104593, &(0x7f0000000140)={0x4, 0x12, &(0x7f0000000100)="5c54733199f5772c4fb874477801ceda1f40"}) dup3(r1, r0, 0x0) 13:54:45 executing program 6: syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') r0 = add_key$keyring(&(0x7f0000000780)='keyring\x00', &(0x7f00000007c0)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$describe(0x6, r0, &(0x7f0000000800), 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r1 = creat(&(0x7f00000000c0)='./file0/file0\x00', 0x0) getcwd(&(0x7f0000000440)=""/91, 0x5b) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4, 0x811, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000840)={r2}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f0000000640)={0x0, 0x2, 'client0\x00', 0x1, "32c75c8786305ca2", "f650718098258b6070221cf1528486e2c5bebb4fca4873a0be01e873ca0180fa"}) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_out(r1, 0x2, &(0x7f0000000100)) mq_timedreceive(r1, &(0x7f0000000380)=""/74, 0x4a, 0x3, 0x0) fallocate(r1, 0x1, 0x800000, 0x8) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000980)='fou\x00') write$P9_RXATTRCREATE(r1, &(0x7f0000000880)={0x7, 0x21, 0x2}, 0x7) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYRES16=r4], 0x1}}, 0x4) ioctl$SG_GET_ACCESS_COUNT(r1, 0x2289, &(0x7f0000000700)) statfs(&(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000200)=""/229) rmdir(&(0x7f0000000740)='./file0\x00') fcntl$getownex(r1, 0x10, &(0x7f0000000800)={0x0, 0x0}) ptrace$poke(0x4, r5, &(0x7f0000000540), 0xfff) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000180)=ANY=[@ANYBLOB="736563757269747900000000000000000000000000000010b6e123dc0819a2000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1) fcntl$setown(r3, 0x8, r5) 13:54:45 executing program 1: r0 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)='cgroup.subtree_control\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x10, 0x1, 0x9, &(0x7f0000000100)={0xffffffffffffffff}) r2 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000300)="a1e69a02295a9a65e37f7eb25bb6dd3e981f1d34cf6cf30dc01bcbdb48261a6c4b73128f9edde20b51f6855774ad5449b86a5148be53b4f9843e5a5c4eae58fc5d28fe21ff4c799921f4996febd5a356697f24b50b3f4a9e3b2072dc0e1470463580820436ce67cb3bdd92be22bb71420e802c9e68feebca392ec7ce0d2eb31dc7f057003e4a69b00fba110e28a6543c406475a7c584ac7e48", 0x99, 0xfffffffffffffffa) keyctl$update(0x2, r2, &(0x7f0000000400)="df5ef19c1a85cfb328d5a56fb6f0989f476163d2bbb25a24e26b0106fada8a38b22575f5dadbf436dacbf68ef327bca79b8357f262abf6d5fb64d7071e3c599ad53fdde3", 0x44) ioctl$sock_inet6_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000480)) fcntl$setsig(r0, 0xa, 0x38) r3 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff2c9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x8000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x0, 0x4011, r3, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r3, 0x40082404, &(0x7f00000002c0)=0xffffffffffff7fff) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000180)={{0x6, 0x101}, 0x0, 0x0, 0x7fff, {0x100000000, 0x8da3}, 0xfffffffffffffc00, 0x9}) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0xfffffc47) 13:54:45 executing program 2: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100000c7, 0x0) r0 = epoll_create(0x3ff) preadv(r0, &(0x7f00000014c0)=[{&(0x7f0000000000)=""/93, 0x5d}, {&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/226, 0xe2}, {&(0x7f00000000c0)=""/55, 0x37}, {&(0x7f0000000100)=""/12, 0xc}, {&(0x7f00000012c0)=""/77, 0x4d}], 0x6, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip_vs_stats\x00') write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x1000000) [ 362.390891] 9pnet: Insufficient options for proto=fd [ 362.462549] device veth0_to_bridge entered promiscuous mode [ 362.482118] device veth0_to_bridge left promiscuous mode 13:54:45 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100000c7, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x40000, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x10}) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ptype\x00') ioctl$int_out(r0, 0x2, &(0x7f0000000000)) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x1000000) [ 362.570822] 9pnet: Insufficient options for proto=fd 13:54:45 executing program 5: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vga_arbiter\x00', 0x80000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000000600)={{0x7ff, 0xd8e}, {0x40, 0x7}, 0x1ff, 0x7ccdf13147df7b60, 0x3}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) fchmod(r0, 0x4c) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000180)={0x4e3, 0xffffffffffffff6b}) mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='9p\x00', 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX, @ANYBLOB="2c706f73697861636c2c76657273696f6e3d3970323030302e4c2c76657273696f6e3d3970323030302e752c6c6f6f73652c63616368657461673d7472616e733d66642c2c6163636573733d757365722c00482677b1360050c0365555a2512b5fc63f701a41b2a51d9115ff536ed0232f73eed5d5bbb8e0dbdbadc418c68954dad6abd474ba4695e1b581e2ccd2eb4db6a2804a3781b3f80de6dd014453b2aab30d2d8dbe428cd75f8c445f919bdb3f3213283c88ac1f87a5ff1bf9ae9d3a55494465e4f2f8ead10979ae27f61df6671f4db96113e315308cbe703b"]) renameat2(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x1) umount2(&(0x7f0000000500)='./file0\x00', 0x0) [ 362.614061] device veth0_to_bridge entered promiscuous mode [ 362.627833] device veth0_to_bridge left promiscuous mode 13:54:45 executing program 2: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x0, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@mcast1, @in6}}, {{@in6}, 0x0, @in=@local}}, &(0x7f0000000600)=0xe8) open(&(0x7f0000000680)='./file0\x00', 0x0, 0x104) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) sched_setaffinity(0x0, 0xfffffffffffffe4b, &(0x7f00000000c0)=0x9) close(0xffffffffffffffff) mkdirat(r0, &(0x7f0000000100)='./file0\x00', 0x22) mlock(&(0x7f0000bfd000/0x400000)=nil, 0x400000) ioctl$EVIOCGSW(0xffffffffffffffff, 0x8040451b, &(0x7f00000002c0)=""/7) [ 362.858429] 9pnet: Insufficient options for proto=fd 13:54:46 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') sendto$inet6(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) sendto$inet(r2, &(0x7f0000000240)="2590e75c412f44bec81babcbe5d57f41388c", 0x12, 0x4004040, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000340)={0x60002004}) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$TIOCGWINSZ(0xffffffffffffffff, 0x5413, &(0x7f0000000280)) ioctl$SG_GET_ACCESS_COUNT(r1, 0x2289, &(0x7f00000004c0)) ioctl$KDSETMODE(r1, 0x4b3a, 0x3f) syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x109040) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000540), &(0x7f0000000580)=0x4) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000002c0), &(0x7f0000000300)=0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) write$9p(r1, &(0x7f0000000400)="f6110892f57227e4f3246e09436754dfcdfc59f4af88e13a614e4aea845a3f1d06c2cf1141e5bfa6fa07a5bc1d47ea712bcd4b6ebc92ef0295586c8ae71cb96da96474613fada784e297725e751bbc9cd26ddfadf9feb49e5ea2173732ec541ff4e4", 0x62) r4 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x0}, &(0x7f00000003c0), 0x0, 0xfffffffffffffffb) keyctl$search(0xa, r4, &(0x7f0000000480)='cifs.idmap\x00', &(0x7f0000000500)={0x73, 0x79, 0x7a, 0x2}, 0x0) sendto$inet(r3, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) writev(r3, &(0x7f0000001400)=[{&(0x7f00000013c0)='8', 0x1}], 0x1) sendmsg(r3, &(0x7f0000000700)={&(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000002600)}, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10) connect$inet(r1, &(0x7f00000003c0)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000680)={0xff, 0x4, 0x1000, 0x7, 0x9b0a, 0x6, 0x0, 0x3, 0x81, 0x0, 0x8}) sendto$inet(r3, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) 13:54:46 executing program 1: r0 = dup(0xffffffffffffffff) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = fcntl$getown(0xffffffffffffffff, 0x9) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') sendto$inet6(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000004c0)='vcan0\x00') r4 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) sendto$inet(r4, &(0x7f0000000240)="2590e75c412f44bec81babcbe5d57f41388c", 0x12, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r1, &(0x7f0000000340)={0x60002004}) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000002c0), &(0x7f0000000300)=0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) waitid(0x2, r2, &(0x7f0000000100), 0x0, 0x0) write$9p(r3, &(0x7f0000000400)="f6110892f57227e4f3246e09436754dfcdfc59f4af88e13a614e4aea845a3f1d06c2cf1141e5bfa6fa07a5bc1d47ea712bcd4b6ebc92ef0295586c8ae71cb96da96474613fada784e297725e751bbc9cd26ddfadf9feb49e5ea2173732ec541ff4e4", 0x62) sendto$inet(r5, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) writev(r5, &(0x7f0000001400)=[{&(0x7f00000013c0)='8', 0x1}], 0x1) getresuid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000480)) prctl$getreaper(0x28, &(0x7f0000000140)) sendto$inet(r5, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) 13:54:46 executing program 7: syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x1, &(0x7f0000000300)=[{&(0x7f0000000240)="8da4363a00000000000000000000000000000000000000000000000000000000ecf6f2a3299748aeb81e1b00920efd9a000001000000000001000000000000005f42485266535f4d", 0x48, 0x10000}], 0x1, &(0x7f0000000040)=ANY=[@ANYBLOB="53cdbc5e96ae0973689ad83af7cba678dee66d8d433634db441f2573294a2f1da6930586da225e4e929bf86d96aa"]) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0) 13:54:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x1, 0x4) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f00000004c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x7c, r2, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_SERVICE={0x64, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2d}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x44001}, 0x80) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) inotify_init1(0x80800) pipe2$9p(&(0x7f0000000180), 0x4000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x34b7fe, 0x0) ioctl$EVIOCGNAME(r4, 0x80404506, &(0x7f0000000180)) 13:54:46 executing program 2: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) socket$netlink(0x10, 0x3, 0x9) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$BLKRRPART(r1, 0x125f, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$msdos(&(0x7f0000000140)='msdos\x00', &(0x7f0000000180)='./file0\x00', 0x100000000, 0x8, &(0x7f0000000700)=[{&(0x7f00000001c0)="baf21db21b77ccf3c52ad02ede", 0xd, 0x5}, {&(0x7f0000000200)="3f4f4df1c0b60fb16c96fbe4c4e5648fed1e3664e307e48b888309cb40bfe95c241fc39b121c2d162c00357a947e74204e4f82fbf84f0b148ae5d9a11ae3f3457b9ddc5d4675335428440fcd248985be85660ce02114bf9d0a0f9c2891b05f1857bdcad7b0df3159f8c997c74351", 0x6e, 0x3}, {&(0x7f0000000280)="ed0f6f4bd32fde96d4d2277d5e3839cdd6e0dbd40f0e6b6489cadb50efdd9b6ecbb81d142e04ca582ed262f7d1c27d567bd9a392488bfb4920f4b2fc098b7c87e3472519329e28cb91b2a4c151dd03bd9975dd485c762191061a3b90bc5fad458eacc60710a8a94e2ce6efda8dfaf3c588f4d9da828d9932c569428767dd57dab7840a1f175eccc0732892f696ec0cbb2e2a3409503cc3edced6335f671ff67080cb1d23a399ea7ec9bae5557e1dd5caf9a016ce4974962cfc53c38a0a1bb715bee995437721f7", 0xc7, 0x67}, {&(0x7f0000000380), 0x0, 0x4}, {&(0x7f00000003c0)="87ce33cfef5c5d0bc349a626164183c8b7539dd012d01f695145eda4fec167247b0647e7d18554d248f5c5968169efd422678f4aee03c04ec27747aadb610bc837c27a1a", 0x44, 0x4}, {&(0x7f0000000440)="6daf9c8cc4f2d2db290877d8b1bbb8913c3df4b523936d5cbf8bb610f3546b5540386911309e8ed81ddb19eb", 0x2c, 0x8}, {&(0x7f0000000480)="c3382c7ba681fc3b0c2b531497bc00225cddde4950cd7f55059951c8c717311d32a06f043ae30a1536635c874b4cc980de96e6090081655049db13106303d21b95a6e63222a800fe31120e049b60c384dfb96debbde9d3d61e65b7ae5b177f3b54c9617317e6679b993a0b92fcb5d97456c22ce074490483458eec6d64d8159708a3a64ee89604dfef88c5fdc0ca165f352a05df86ab062ea75d9bac59b5095d35c7ad19c49b188235a2be3ea0b629f488894aeb2e464607d12ea97496", 0xbd, 0x26cd}, {&(0x7f0000000600)="0dbe0e520fd0bd7097b5efebf1a2d9dd5e0ea104c3b1f273e3e2f1b408029f00b38e355e17c899b350fc92bf322f96ee6febcf68b01e43051f6ac309fa36561b6fce4fab08cbc78dd52c0e0c5b5a3c56ce63898a8c4d6593e1fe31ececb5b4574a3156882e6336e2ea3b46cf73ce9212dc772d341f05a1c7a32470de72044aa15a0245e49e8cebe71a40afd8855bed39b3a2f363ec0858fa39612815e30d4eefed11af22175ca1a52b025bda0a1d65134e8b74c80586c23ece4e3145b97aa60f6ec5ccf5c9c43f8f9aa227bb041ba9092d72e51fb10a7cf841943e7b41a2737adc6107c5baa3c935d57a596a46044265d2688a20db136aafc90b56d3", 0xfc, 0x4}], 0x1, &(0x7f00000007c0)={[{@nodots='nodots'}, {@dots='dots'}, {@dots='dots'}, {@dots='dots'}, {@fat=@discard='discard'}, {@dots='dots'}]}) futex(&(0x7f0000000540)=0x1, 0x3, 0x0, &(0x7f0000000580)={0x0, 0x1c9c380}, &(0x7f00000005c0), 0x0) r2 = socket(0x10, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='status\x00') sendfile(r2, r3, &(0x7f0000000000), 0x80000002) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0xffffffffffffffff, 0x0, 0x100000001, 0x3, 0x2}}) 13:54:46 executing program 5: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x20400, 0x0) mknodat(r0, &(0x7f00000001c0)='./control/file0\x00', 0xc020, 0x1f) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000000000)='./file0\x00') r1 = creat(&(0x7f0000000240)='./file0\x00', 0x0) symlink(&(0x7f0000004000)='./file0\x00', &(0x7f0000000180)='./control\x00') rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='./control\x00') getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) setpriority(0x3, r2, 0x100000000) 13:54:46 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') sendto$inet6(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) sendto$inet(r2, &(0x7f0000000240)="2590e75c412f44bec81babcbe5d57f41388c", 0x12, 0x4004040, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000340)={0x60002004}) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$TIOCGWINSZ(0xffffffffffffffff, 0x5413, &(0x7f0000000280)) ioctl$SG_GET_ACCESS_COUNT(r1, 0x2289, &(0x7f00000004c0)) ioctl$KDSETMODE(r1, 0x4b3a, 0x3f) syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x109040) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000540), &(0x7f0000000580)=0x4) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000002c0), &(0x7f0000000300)=0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) write$9p(r1, &(0x7f0000000400)="f6110892f57227e4f3246e09436754dfcdfc59f4af88e13a614e4aea845a3f1d06c2cf1141e5bfa6fa07a5bc1d47ea712bcd4b6ebc92ef0295586c8ae71cb96da96474613fada784e297725e751bbc9cd26ddfadf9feb49e5ea2173732ec541ff4e4", 0x62) r4 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x0}, &(0x7f00000003c0), 0x0, 0xfffffffffffffffb) keyctl$search(0xa, r4, &(0x7f0000000480)='cifs.idmap\x00', &(0x7f0000000500)={0x73, 0x79, 0x7a, 0x2}, 0x0) sendto$inet(r3, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) writev(r3, &(0x7f0000001400)=[{&(0x7f00000013c0)='8', 0x1}], 0x1) sendmsg(r3, &(0x7f0000000700)={&(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000002600)}, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10) connect$inet(r1, &(0x7f00000003c0)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000680)={0xff, 0x4, 0x1000, 0x7, 0x9b0a, 0x6, 0x0, 0x3, 0x81, 0x0, 0x8}) sendto$inet(r3, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) 13:54:46 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x0, 0x2b}, 0x0, @in6=@dev}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@ipv4={[], [], @dev}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x0, 0x2b}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, 0xe8) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x7, &(0x7f0000000040)=[{0x3, 0x192b, 0xb00, 0x400}, {0x9, 0x6, 0x1400000000000, 0x100000000}, {0x6, 0x1, 0x3, 0x7fff}, {0x39d, 0x8, 0x3, 0x1}, {0x9, 0x4, 0x4, 0x6}, {0x3, 0x8, 0x800, 0x2}, {0x7, 0x8, 0xffffffffffff8001, 0x81}]}, 0x10) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) 13:54:46 executing program 5: r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000366000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_unix(&(0x7f0000000000)="e91f7189591e9233614b00", &(0x7f0000000040)="e91f7189591e9233614b00", &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000200)={'trans=unix,'}) [ 363.414689] binder: 24770:24777 ERROR: BC_REGISTER_LOOPER called without request [ 363.453707] binder_alloc: 24770: binder_alloc_buf, no vma 13:54:46 executing program 2: sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x4, 0x5) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) fsync(r1) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x400040, 0x0) epoll_wait(0xffffffffffffffff, &(0x7f00000002c0), 0x0, 0x0) epoll_wait(r0, &(0x7f0000000300)=[{}], 0x1, 0x0) sync_file_range(r0, 0x20, 0x2, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbff, 0x800}, 0xc) flock(r2, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x10) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$TIOCGPTPEER(r2, 0x5441, 0x80000000) sendmmsg(r1, &(0x7f00000002c0), 0x400000000000174, 0x0) [ 363.476569] binder: 24770:24777 transaction failed 29189/-3, size 0-0 line 3136 [ 363.510061] binder_alloc: binder_alloc_mmap_handler: 24770 20001000-20004000 already mapped failed -16 [ 363.519904] binder_alloc: 24770: binder_alloc_buf, no vma [ 363.525644] binder: 24770:24789 transaction failed 29189/-3, size 24-8 line 3136 [ 363.534842] binder: BINDER_SET_CONTEXT_MGR already set [ 363.534854] binder: 24770:24788 ioctl 40046207 0 returned -16 [ 363.550037] binder: 24770:24788 got transaction to invalid handle [ 363.556947] binder: 24770:24777 ERROR: BC_REGISTER_LOOPER called without request [ 363.566628] binder: 24770:24788 transaction failed 29201/-22, size 0-0 line 3013 [ 363.575435] binder: undelivered TRANSACTION_ERROR: 29201 [ 363.581905] binder: undelivered TRANSACTION_ERROR: 29189 [ 363.594547] binder: release 24770:24777 transaction 381 in, still active [ 363.602268] binder: send failed reply for transaction 381 to 24770:24777 [ 363.609993] binder: undelivered TRANSACTION_ERROR: 29189 [ 363.616199] binder: undelivered TRANSACTION_COMPLETE [ 363.623066] binder: undelivered TRANSACTION_ERROR: 29189 13:54:46 executing program 6: getpid() r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0605345, &(0x7f0000000240)) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 13:54:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x21b9fd327c5b0366, 0x0, &(0x7f0000000400)=ANY=[], 0x19, 0x0, &(0x7f0000000640)="99efcdbf087ed202000000c5adfa5ecdaae789749166f38e30"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="00400025401d4400bcfa31fb4ca62c51ba74fc7c6907fa6152e8820148d92e562218edff9b4ac134aa82db5963ca0cd6a8065c4d716077723dc7d1ebed3c117abb33dec832a8ac4f3ac7a68cb2fd3254f5107278172e1414fe08c1d77a43998e29ad485a9a22b68e4e1e2d2825aebe3778839992e4c0ff8e43786124b87c557f61622709fa0507b9adede7048be0c854b149dc482afc3ab895c21581fe0337d533c1a6434525fa445b2d8a60a1b0c230b32057225a97"], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$int_out(r1, 0x0, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0xc, 0x0, &(0x7f0000000180)=[@exit_looper, @release={0x40046306, 0x4}], 0xe1, 0x0, &(0x7f0000000480)="7d2eda8f18725454b06e6e643c061e497c96a435b1ca13999c3b7ed5b108a2cf538e8deb11786fc53268864cfc5df4c964e1cfb35f8952511fa60074965458bc2575422742901cbc6c3d5387cfa9f23df448486e5ed1d0b598572d513f97efe90f5fdf801d8eeaee9123fb95c5880602bfd38f2ff93fd9a6a67561be70dd02a63fd11b98cbf096db3591b77b45a3c5c6fbcbddd701be0a29d5436af07e97bd0af817e4f53050ccb843ff638d44a13193a6a245effa16ab4fe7112c8f9f8409556e3de3e8a30697a978769682f9c2d58e9236d8a95dd9259803055b9e59436c2d59"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) ioctl$FIBMAP(r0, 0x1, &(0x7f00000002c0)=0x1) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0) 13:54:46 executing program 7: r0 = syz_open_procfs(0x0, &(0x7f0000000080)="636c6561725f72656673007edb") writev(r0, &(0x7f0000000000)=[{&(0x7f0000000180)='4', 0x1}], 0x1) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r1, r2, &(0x7f0000000040), 0x8001) 13:54:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000240)=0x100000001) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(0xffffffffffffffff, 0x3) [ 363.737890] 9pnet: p9_fd_create_unix (24796): problem connecting socket: éq‰Y’3aK: -91 13:54:46 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000240)=0x200) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r1, &(0x7f0000f6f000), 0x20f6f0a8, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 363.780272] binder: 24799:24803 unknown command 0 [ 363.790841] binder: 24799:24803 ioctl c0306201 20000000 returned -22 [ 363.801198] 9pnet: p9_fd_create_unix (24796): problem connecting socket: éq‰Y’3aK: -111 13:54:46 executing program 2: openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000140)={'IDLETIMER\x00'}, &(0x7f0000000180)=0x1e) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) write$P9_ROPEN(r0, &(0x7f0000000100)={0x18}, 0x18) [ 363.831079] binder: 24799:24810 unknown command 620773376 [ 363.831090] binder: 24799:24810 ioctl c0306201 20000040 returned -22 [ 363.831254] binder: 24799:24810 ioctl 0 200000c0 returned -22 [ 363.831328] binder: 24799:24810 Release 1 refcount change on invalid ref 4 ret -22 [ 363.831402] binder: 24799:24810 got transaction to invalid handle [ 363.831411] binder: 24799:24810 transaction failed 29201/-22, size 0-0 line 3013 [ 363.831475] binder: 24799:24810 ioctl 1 200002c0 returned -22 [ 363.980016] binder: BINDER_SET_CONTEXT_MGR already set [ 363.995749] binder: 24799:24822 ioctl 40046207 0 returned -16 [ 364.015641] binder: 24799:24803 unknown command 0 [ 364.020621] binder: 24799:24810 unknown command 620773376 [ 364.020633] binder: 24799:24810 ioctl c0306201 20000040 returned -22 [ 364.021507] binder: 24799:24810 ioctl 0 200000c0 returned -22 [ 364.027326] binder: 24799:24822 Release 1 refcount change on invalid ref 4 ret -22 [ 364.027412] binder: 24799:24810 got transaction to invalid handle [ 364.027421] binder: 24799:24810 transaction failed 29201/-22, size 0-0 line 3013 [ 364.027448] binder: 24799:24822 ioctl 1 200002c0 returned -22 [ 364.027888] binder: undelivered TRANSACTION_ERROR: 29201 [ 364.170069] binder: 24799:24803 ioctl c0306201 20000000 returned -22 [ 364.203024] binder: undelivered TRANSACTION_ERROR: 29201 13:54:47 executing program 3: 13:54:47 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_int(r0, &(0x7f0000000080)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000300), 0x1) 13:54:47 executing program 1: exit(0x0) r0 = socket$unix(0x1, 0x1, 0x0) recvmmsg(r0, &(0x7f0000002140)=[{{&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000000340), 0x0, &(0x7f0000000380)}}], 0x1, 0x0, 0x0) dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[{}], 0x1) 13:54:47 executing program 7: r0 = socket(0x1e, 0x1, 0x0) bind(r0, &(0x7f0000afb000)=@generic={0x1e, "0103000000000000000000004700000000a979f321b30c7bc8790405c7bad62e0a63a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb3151d24acef1f1622ca5bdb9c8ea31000077aeb81c90001d6d7c980400000000f70dc136cb184a"}, 0x80) 13:54:47 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000000240)=r3) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={"69726c61bd15000000001f0000000020", 0x1012}) 13:54:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x2, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000180)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1a) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x30e, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:47 executing program 4: 13:54:47 executing program 2: 13:54:47 executing program 7: 13:54:47 executing program 4: [ 364.351658] binder: 24833:24840 ERROR: BC_REGISTER_LOOPER called without request [ 364.361111] binder_alloc: 24833: binder_alloc_buf, no vma [ 364.368202] binder: 24833:24840 transaction failed 29189/-3, size 0-0 line 3136 [ 364.394309] binder_alloc: binder_alloc_mmap_handler: 24833 20001000-20004000 already mapped failed -16 [ 364.404491] binder: BINDER_SET_CONTEXT_MGR already set [ 364.410010] binder: 24833:24840 ioctl 40046207 0 returned -16 [ 364.410034] binder_alloc: 24833: binder_alloc_buf, no vma [ 364.410055] binder: 24833:24849 transaction failed 29189/-3, size 24-8 line 3136 [ 364.410176] binder: 24833:24849 ERROR: BC_REGISTER_LOOPER called without request [ 364.410440] binder: 24833:24851 got transaction to invalid handle [ 364.410450] binder: 24833:24851 transaction failed 29201/-22, size 0-0 line 3013 [ 364.411252] binder: undelivered TRANSACTION_ERROR: 29189 [ 364.411278] binder: release 24833:24840 transaction 391 in, still active [ 364.411285] binder: send failed reply for transaction 391 to 24833:24840 [ 364.411294] binder: undelivered TRANSACTION_ERROR: 29189 [ 364.416588] binder: undelivered TRANSACTION_COMPLETE [ 364.416594] binder: undelivered TRANSACTION_ERROR: 29189 [ 364.488177] binder: undelivered TRANSACTION_ERROR: 29201 13:54:47 executing program 6: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mincore(&(0x7f00004d7000/0x3000)=nil, 0x3000, &(0x7f0000000040)=""/156) 13:54:47 executing program 5: 13:54:47 executing program 3: 13:54:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x101000, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000180)={0x859, 0x7, 0x8001, 0x3f, 0x7, 0x7, 0x0, 0x101, 0x0, 0x1, 0x4, 0x3f}) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f00000001c0)) 13:54:47 executing program 2: 13:54:47 executing program 7: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f00004e7000)={0x2, 0x2a7, 0xdf}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000400)="21707526307861000000010000019cd30e35a01d3d040a1c60666f8dcc6d5c76fd2e9e09626b31deea1b0d3b8184872d58b62cc5b4223726b5797482fb1d83f82e2d2000000028e9604401695c8d6c866c68a8fc80de2c4b74f423c55d593bc13676f9890906be2aaa26bd1678518ef3d61afdd00427799b7ce4b70845ed9780731957b75bf0253e4d4df598be5e3d7121a60f70013200bbbe9d5835af657010520b26afa8247f3756ed4c4a34cf0701d5540acac2865fc1ce8ded62538de97482f4317a7772e66f88e5e3e7476378c0914901000000010000004b9ee55ba00a0f04a6b07345298ad052c3c12c62201c2349527a36fe4a7edad75ffe1fe586b1787526fbf2bfe87f9193ab05003485866c8d000000000000000000000000000000") 13:54:47 executing program 4: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@broadcast=[0xff, 0xe0], @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @udp={0x0, 0x0, 0x8}}}}}, 0x0) 13:54:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$packet(0x11, 0x8000000003, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'veth0_to_bridge\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x34, 0x10, 0x809, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_IFALIAS={0x14, 0x14, 'bond_slave_0\x00'}]}, 0x34}}, 0x0) getpid() [ 364.900985] binder: 24862:24866 ERROR: BC_REGISTER_LOOPER called without request [ 364.910089] binder_alloc: 24862: binder_alloc_buf, no vma [ 364.916100] binder: 24862:24866 transaction failed 29189/-3, size 0-0 line 3136 [ 364.925972] binder: BINDER_SET_CONTEXT_MGR already set [ 364.931943] binder: 24862:24869 ioctl 40046207 0 returned -16 [ 364.938121] binder_alloc: 24862: binder_alloc_buf, no vma [ 364.943706] binder: 24862:24866 transaction failed 29189/-3, size 24-8 line 3136 [ 364.954188] binder: 24862:24869 ERROR: BC_REGISTER_LOOPER called without request [ 364.983846] binder: 24862:24866 got transaction to invalid handle [ 364.984424] binder: undelivered TRANSACTION_ERROR: 29189 [ 364.984450] binder: release 24862:24866 transaction 398 in, still active [ 364.984457] binder: send failed reply for transaction 398 to 24862:24866 [ 364.984467] binder: undelivered TRANSACTION_ERROR: 29189 [ 364.990240] binder: undelivered TRANSACTION_COMPLETE [ 364.990247] binder: undelivered TRANSACTION_ERROR: 29189 [ 365.025332] binder: 24862:24866 transaction failed 29201/-22, size 0-0 line 3013 [ 365.040712] binder: undelivered TRANSACTION_ERROR: 29201 13:54:48 executing program 1: sched_setaffinity(0x0, 0x3cb, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fchown(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, @perf_bp, 0x1e}, 0x0, 0x0, r0, 0x0) sendto$inet6(r0, &(0x7f00000002c0), 0x0, 0x0, &(0x7f0000000140)={0xa, 0x4e24, 0x0, @remote}, 0x1c) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x501002, 0x0) write$P9_RRENAME(r2, &(0x7f00000001c0)={0x7, 0x15, 0x1}, 0x7) mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x0, 0x4011, r1, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f0000000200)={0x5, 0x0, 0x0, 0x0, 0xd}) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0xfffffc47) openat$cgroup_type(r3, &(0x7f0000000100)='cgroup.type\x00', 0x2, 0x0) 13:54:48 executing program 3: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x20002, 0xfe54) bind$netlink(r0, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x9000021}, 0xc) recvmsg(r0, &(0x7f0000000480)={&(0x7f0000000040)=@pppol2tpv3in6, 0x80, &(0x7f00000000c0), 0x0, &(0x7f00000003c0)=""/147, 0x5e}, 0x0) 13:54:48 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="240000000b061fad0c2489f900b51eb058b5f2001cfffd946faa830020200a0009000100", 0x24}], 0x1}, 0x0) 13:54:48 executing program 4: r0 = getpid() sched_setattr(r0, &(0x7f00000003c0)={0x0, 0x2, 0x0, 0x0, 0x2}, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f00000001c0)={0xbf}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000014) 13:54:48 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x2, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000180)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1a) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x30e, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="000000050000000090f331577172d123511b046248444f23a1d2be0a77b1b6d957c629c9b0b7d1f723377182d57c67be99b2a3b4844d021e7053ae0449ba6cf9984050af4c8283219c83dc1d16065f7d92d7805746b8c3422f09caafd388311b55fa245b58a91126580df6844f06fb3f51577df98a93d1a9a7379cf3808a0c8b875042af6ec2bbe7dfcf67b5e9f23322a54a6c1258f2fb4fe9c75595131a30901c4d9ac8b5cd9a86f6053ad50c1397f1a86661d0d4a1d0e20bbff615d575ee5b1a7d8cef5dd63a17fc018596119c847dab7bdb9854e0dfc9a4693e3c963983656ee7fad9abba67d82f843b9d0cfa3024a62b61791e8a969cb613fd36256eca14ba032f6740f1e6f1a915f3f744cf509c0b8f44e3c305be7e92f8223401d7717227bddfdc7edf857fda0870faaa2119e4"]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="4fb1c657"], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) fsetxattr(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="73797374656d2e47504c4e6f64657600d38c06f592880d10b7cb5517cbb8eaa1ca10642c277a60f4e8acab52726ff62ca3d58f6806c0d66abe4299e9"], &(0x7f0000000180)='/dev/binder#\x00', 0xd, 0x2) 13:54:48 executing program 6: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet(0x2, 0x1, 0x34d2) r2 = open(&(0x7f0000000180)='./file0\x00', 0x4000, 0x122) write$FUSE_STATFS(r2, &(0x7f00000001c0)={0x60, 0x0, 0x2, {{0x5, 0x3efd, 0x10001, 0x6, 0x1, 0x10000, 0x7, 0x10000}}}, 0x60) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000040)={0x0, @local, @local}, &(0x7f0000000100)=0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={&(0x7f00000000c0), 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x13, 0x0, 0xa, 0xfffffff7ffffffff}, 0x14}}, 0x0) 13:54:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") clone(0x0, &(0x7f0000000280), &(0x7f0000744000), &(0x7f0000001880), &(0x7f0000001900)) mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000016) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$sndseq(r2, &(0x7f00000000c0)=[{0x3, 0x9, 0x4ce9, 0x8000, @tick=0x80000000, {}, {0x2, 0x8000}, @connect={{0x401, 0x6}, {0x8, 0x9}}}], 0x30) open$dir(&(0x7f0000000180)='./file0\x00', 0x27e, 0x0) 13:54:48 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x2, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000180)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1a) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x30e, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:48 executing program 6: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000000)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3, 0x1c) 13:54:48 executing program 2: r0 = socket$inet6(0xa, 0x1080000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x40000, 0x0) write$cgroup_type(r1, &(0x7f0000000080)='threaded\x00', 0x9) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000004, 0x10, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000180)={r3}) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) r5 = memfd_create(&(0x7f0000000140)="2b8b8a16114fdddf6b284699df92d53e6f4a02759b9461ac", 0x3) write$binfmt_misc(r5, &(0x7f0000000c40)=ANY=[@ANYRES32], 0xff67) sendfile(r2, r5, &(0x7f0000000000), 0xffff) setsockopt$inet6_tcp_int(r5, 0x6, 0x1b, &(0x7f00000000c0)=0x6, 0x4) fcntl$addseals(r5, 0x409, 0x8) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f0000000100)) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000002c0)={0x28, 0x2, 0x0, {0x4, 0xffff, 0xec}}, 0x28) fchmod(r5, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000300)={@local, 0x0}, &(0x7f0000000340)=0x14) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000440)={{{@in=@multicast2, @in6=@local, 0x4e20, 0x0, 0x4e20, 0x3, 0xa, 0xa0, 0x80, 0x32, r6, r7}, {0xfffffffffffffffa, 0xf7, 0x1, 0x3, 0x3, 0x4, 0x4, 0x1ff}, {0x81, 0xfffffffffffffffc, 0x0, 0x4}, 0x6, 0x0, 0x3, 0x1, 0x2, 0x3}, {{@in6=@mcast2, 0x4d5, 0xff}, 0x2, @in6, 0x3501, 0x1, 0x2, 0x1, 0x80, 0x9, 0x9}}, 0xe8) dup3(r4, r5, 0x0) mq_timedsend(r1, &(0x7f0000000c80)="2540885adeac1ba73b3f81eaba11cd00d8fb012a382a764a994219b520d22205899fdbcd822c6cddff0d731d1d91eddf068c3737480786df8828b6ca9c9c4143ab941d55f84deb0e89efe59d181a49cafdf57295ba1ec6054f2b5618057c16b54e50d2807e077422a5b441ec406687abc53b5c4fe6817e7f4fed9eb43895acc59e1f1f49a2c85ed35f18c59e6e2cf0a9275922297a1dfc3366525c4c10122c9ef72121cb265ec8914b0481fadada73f1706a5e9009d3befd0999551aa0e3796544f4be5044c36691f40af26176accc27d5b95ec886bb5d278cd0698254603bea7988022c271a08d7d54b0f91dc1f1178fa1e9ce52ea60004f277e60601b519f3668c43a73f90dc3afa9e2e776944b4b19ad5180eb5cbe6cf4a2fa36df3130c06620011e538871a635c48653111c2774e08e579e5eae840bb6873d679a4dfcfbc2d38d1f1b2ef17f4a5541d808edb2cdbe5d3502170a25718806e0e96a795128b5f3c70b4382e99a36656f011bbcfb2ec2fa7bb1884c16d478b30d51d00aa1650b61c0f1bd042c41849ab2562e0e4389d3da52fd630d162c5f3007015d1d9f4ba17dd8d95e950c5c9eed2ff2459682bb5c35ddb8e27c6cfdb15f9a3315790182403d42299c981517df24a3b06bf84be00ee9e8cebb20a64710483a860e1891e365e0e91a2e75b130e7f162f893b0f756c583cacc2f506d8d7fab85d51517c93e91759f7d9b5bcc4caf15cf8877b468f4aa8bc9bb0f261b69680524a13b6bbed5f04070097150ef42cae41369e15fc8e621da1727797c52b0feabfc04f609f814f1a79458ed312638a6d506feacbf322eb206272172c92e6703d7e31774e2635521b6e2d2ece8c4a93580159c8a87595ea876067a9deae7832e5800c11e3ded53c8b0b753d45f19f6c55ff4ef2afee8a1dddee54572257214c400075c2ff2228e4325afb28241cdfebb4d89d892f1ba4f2b08a7347b4af5515f544eb04a16f1d7a0695de5a959be8748f56e6e398de3bdd606024091a4800a06b90fe749c6c4a5c200de72eb410ddc389ca22178cd233458f81370bbfe38e7961dc633f9b67ae6c8d7a07d220bd9823db7cb2372bc56e045476ea01ad73bace634777996bf4acd43e660cdf7459f3aba072b4c0bf83e3c31862d08653723581fd17c38bff51e708eb20cd99929f9d015afa519c6f71187b6db65e7335d4175501535770a0e4e78978640ab2a808cce00f6bf59abb03d7d027347de3fab45c95c2fb6e4cdbb47cf7ea98469f30f912d47a4bb11ed35b2cdd2105f05f2585ac08e02b78f2d17eaab855aedf06473a4bc7a15e81049d2bfd0db7827c6ccb7c355f5ac36e451e41a7032f203eac754d52bc6ce556a7d4545c4d22c2ad621b03e274a56574e68eae2ff2f96f7bf44bdf614a4b90f3df58d40a870250e418ff16d6d0c3fadff4f0818d4a231c17205b85ad7c4c6001bca7c71d71ca69082e98ef99ad1d7fad0ac843e972d87710b382fef1ac189f4d371d29f59a72ca51beead8caf82e49d3964addb942d1aa05b7e16681b4982ca0ff9b74bd404497e2c2a06a7798bab74ba319025b2fd465901330fa9f09b2f9dbd2b7302e8f451315fc145e9f4d33597eac55a962dbd728cc92f1eee10ad6f99a84496a1799995d10dd655b08fc933b9a11bd54aa47566693c472890f19594f1643e6f36acb1bc8c60c982daa8845d2d6cf2ad37d197ce5b14af9150f8d61b48b17bab42c2e6496c91d5aee80383c79f63a85a990e75897fff353bb6f3873f35723d419cc0ce04dc79e4c6d2ba24ac153f20180b83ce2fd790935de028aa861830e1095743dd59764cbd0b19ba2c13765a22cc5412306a8c49eca81642904046246e803214ad2fc802afc829e5c3c1713e9a4678516a85af806cfc79c53c2516060687d2349c309b5c59b70e0e391fb6b3c6749e14bba4b6a0280388e52146cef77688806afa6bf663d87eac80250299246c763046cf651f38955070a40c0e81a3e2f396c7b3ea8af1f052770de229a849ad6317202b967f7a27d035d63f6e4d80983d5d017feb5dac9988ade106db0c0b727cd7ce22f257a6e14650eb9f43b6c91d301a3a54df9c8abfe55abd289cf0067cb37ac17c6aa36fa176dc2fb83ee97c995b187b1ed49f7257800c35064ebe529a27ed121bbbf540ed89734cc01ccc5f01eff8e70bf5e6a45856a3e5c4e17a7a250b798a35e1443da19226d088718de39f6891264e5b30be0a1adf5098e78eaf1f518f51bb94df1cc095dcceaed2ff66bbeaeee87678c73f71ca597604ea24550e2f5c74765da2a114b48ed2c4492b8130384baacb5c27a02f21ae5acd1c277b7ba52fadf26b672e83c7897e1a19d61b06fbdfd77364810dd621f003989947e641be97b3e25445f908586db090bc399200f9371b69a9b29970cf49b171a4187f20bde05a57c8ec90ac33893900a488377e7565cc2f644228fcdb4b3421373e7c23a35dd7bcd1a8cba9ae05f81cb24534ad1e2d04574d6879b551f6956361d00551e3ff9de18810e6aae88191c9f7a2fcb1c0d4aede981cbec3c8320799ed79befc49c180b5571a8635b94f79f10d92e62577ce5fc3a28329ec8995aaa817e5263e387716bfce5a75f9b11e568fce59cbf0ac124d56980eb3d3935ff17ac4022f8ec77ebd085e195a8d61f3040c2d2b055e556329ddec9a6fac2e6eaae64a935e5d845a8c154796044845643e9b034085fbbdc9cccdca6e16e6adbd4d4f9b5870517f4d4a5d12f4ee0a4ff73c28ae9f4e6e13f323e47db09fa0166696d0477ff0069f0df2c01049eaacf9b47af8409b8ef7a128eac64e2cc50f58c3ae3ba9d8e4bdbecc25213e9ce7797d7f4742a2db116fba7b11c237c3991e10bbf821b50be297c43e589ac6c79049eb382603b0e26832bee57f793f24aa7f48d9987cd6032569999f0791264efe0524b3d15b40b696ef1674166041d1da7b80666816f1141fa990394aca67022490b8a94de991848e7156b385eb5f30b1f5f5e614954e20e3e3edce2df95bd8ec4d56d0201e3713040f77ae7ab2fef261b12157c7e586974010d7efa91b222a4bf1d30ee72c642e32b6eebaa8e75605a02f2795fd1629b25fd78b1f7551ace73ebcc36c5c103f02045b3067c3c3245276a863c60c165d03ad6dba986971971ec5443ee92adffbd8a0385249d95ef7c0690c5b5471872fbc1734174f2b462d6ca08c98c6edc811b4efe09d964f99a24c6319797107d08a891cd0076e5d760830dbf17bd14ca45b570cdbdeefa7f25d60386f93aca9da2c20132623093d4855cfd0edf871ea4cf51d71aadf55be6be34f3bc95068d50889ccda4a4cfe30f8091d8b887188732a5c35c12dd694809832e0c786975e1cbfc996d66270f4950dfc35dbaa8797b01c483ad2b4b88c9cc6061aaca48f5e7a0d87f61f5dd10853c1cd75381af0ab58c5887cbcc7ef37a35b9e4c06c5978da70f019a6c7b3df56a6741cbff513d8e25cb7fe5b30be9c8660d6060bac20cc4d710226e80dbc9fd7021dc8edfe89b77d22941526202d0e466561bf6cae3b2e9df75734a362492de6f10f50c18ae7089ef84d7b5b7c50de41cf5b434535e39d606791082065f3dd7f3529e8046b300b5a9b66fd8f720c32b52db36a7e0e25812a194145b5dabe9d1afc83c381d32140ea4ea75bb27b45f0ddf8b752adf29a1a6bd8425e9cb3066f486fcf8dac8a93897ab87d3ab2c94b56eb078bba22bac3479aa38264ecd856c2f3f575fd33ab2becd51cda231d98557e06dd432a6b524842004861f6da46c53c02dc305042fc15850a9cac41ee525c1e778a5a3a7f0b87168b249e998265cf12a021a5dc2eccf7ee5673883800bc32eb3e0c997f3c1f547522363ec63c990ca17c1c1d64cae11a22cd31e33367e087a34a06f143e3ff130536d68c0917349e289ff887057f89df2aa064393b60124df3bb5b526952b30446da01937378d32d47335b9dce2e126ca95f6458b24ed46c6f1ab17b50538aa890cdbf6ca0d36a1c92cace9f9fbfc1fdb82f2ad7cc493afe5b3209788a54468869595c4968cff4f038a53fcf825a767f08f6ecf4905ca68c6a69e29496be4422a40683610f07b33f312e4b8a98793a77d812e058f231aac6504218cb78832ce5f68978dfdb567fc9e8538c3a40384ad966e7cf9a3911873c2122c011240cd703a3d693387ae59322402df81b32f207240f4831e7fbac5fce181b2350b2549741d8b9520cf69f27cb7b3c1ecff73ae598d076e6baebf28822d66ddd7ec72f13d601c3a5b0442844f10ddf67de44c5930ac8928e5e58d59527195d59dd4872d801b99a917de00213f1a4992f78125f668ce7a392ffeea43770b4a80961a97b4fdeba1b628a41bf0a734371377a684edd4226b361d592c0017962f82c8d0b4efaef9aaf875f7a2e9268e54d415939153b4f2761a6d7a5e41fd23107018214b73d14df7088f514f64f840ba092cb9801ef4f7c406d80f08213e5f55ee1b509a79fbca2f154260eccf048e14dc5dc4d4ca56ccf4430d392569b70a6e00adee732d264443e292e36ec17f78490f24ebdafa0607d5c53cdeb4331e90d47b9b23eecb64ebfb3ca95d4d40322c20d9020835d808316f593752a8ff4a6d2597f483b4983279918d7dd9432b7c424b29e2dc0c44598e19d6fe79e97856268983aa15d504daa95ed3128e0bda4a8c73a03350b1469c7582d23ca7d9d35ff30b033afb431b3dbae1ee1593b88b0d9edd0c56e2c8a9572acebfe95f22247aebd4a637b5d6862e278fc3f6aecc75f29195b7f310d952d2590fee9c2bf8c7c862340a0abaced19822928f51a50781267068da4d0b12723e77444c83a43e962bf9ebc1be31e23aa801c3cac0e545b9ea6afc3fd8175caa458ebcdc8206f49cb4c7aeac5503093d40ec52b8e99a38647d415e6b08d385eb1db5b3132b98add7882606725880c02d1456700be63d49e83621859d2522c79648e609f0bbdc77f9a5464dad909a4af42760d8fd46fcba959ddfa5e93bf808523e90e68b210ee1c6fd9e7e5c3c33a97c7e96e74d5e9cd31b9c59060b46c9364745cf2c7d42cd5408cbdc3eb8bb58aa2554281ab3a1969a569b13c4e802bea99ca835194d8cd4bc4ab8647ca4e8d9d40609635529b43bd3613558e2529a840f1722b75065a973f82ee78877338c8a4e597e7bf217bcac5d37e202053b8b20a12790125bc27e4be88e8c60f0fef4e4b0006de02d6cf0af94d5ca630d5378431fb65d0337e113fcf55d5009fdb5109cf6fb93e07732c434f02b1b09abc44ff656ce3fc706c03337ec25979dc1769c4447672914be32647b0da618323f333be8afb514e85d481afe5e88378c0fa0edbf9cb35077fb4c51a89b7c77ca12ab72756491b11bb3e6266c5671a00be053c7af253ea68283897e9fc0613f46ad9338172daf84546c241c02dfe1bc60d4a13f35949b33310bd5ca900d8624eca540c0e120a266c37142164a85e4c3b0abb96bb746dc1639c28726d000389cf39e5f80f52e3d84234a5393ada42997beec8c686f88d9b0818a72f3b54e42ab6b38aa943dc0eadef14e2ecf967fbd3aed153036de3bded271f0615636d6f61d697d47e1cd8e072b2c9006bc12c41fc1af1945094ec94dedecc72e9fe062e7fee5c1e0d5e9ffd954a3df136ecd0cb88d5f13a67f0ed7fee0d25668653ac90295f0681e71aec685de7d6141d69301299ff403fd652e1347b6e8a32e2d50b838f333cbe7b84a69e2321d548d4356354044167677ae8bb2a58e13d49d705ed0d3c2fe66e92", 0x1000, 0x6, &(0x7f0000000240)={0x77359400}) pread64(r1, &(0x7f0000000280)=""/32, 0x20, 0x0) [ 365.224910] binder: 24886:24899 got transaction with invalid offset (83886080, min 0 max 24) or object. [ 365.235979] binder: 24886:24899 transaction failed 29201/-22, size 24-8 line 3199 [ 365.245092] binder: 24886:24899 unknown command 1472639311 [ 365.254739] binder: 24886:24899 ioctl c0306201 20000040 returned -22 [ 365.266813] binder: 24886:24899 got transaction to invalid handle [ 365.274198] binder: 24886:24899 transaction failed 29201/-22, size 0-0 line 3013 [ 365.283599] binder: BINDER_SET_CONTEXT_MGR already set [ 365.289305] binder: 24886:24905 ioctl 40046207 0 returned -16 [ 365.295665] binder: 24886:24905 unknown command 1472639311 [ 365.295720] binder_alloc: 24886: binder_alloc_buf, no vma [ 365.295740] binder: 24886:24899 transaction failed 29189/-3, size 24-8 line 3136 [ 365.315752] binder: 24886:24905 ioctl c0306201 20000040 returned -22 13:54:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") clone(0x0, &(0x7f0000000280), &(0x7f0000744000), &(0x7f0000001880), &(0x7f0000001900)) mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000016) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$sndseq(r2, &(0x7f00000000c0)=[{0x3, 0x9, 0x4ce9, 0x8000, @tick=0x80000000, {}, {0x2, 0x8000}, @connect={{0x401, 0x6}, {0x8, 0x9}}}], 0x30) open$dir(&(0x7f0000000180)='./file0\x00', 0x27e, 0x0) 13:54:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 365.323485] binder: 24886:24899 got transaction to invalid handle [ 365.329941] binder: 24886:24899 transaction failed 29201/-22, size 0-0 line 3013 [ 365.330185] binder: undelivered TRANSACTION_ERROR: 29189 [ 365.330220] binder: undelivered TRANSACTION_ERROR: 29201 [ 365.340532] binder: undelivered TRANSACTION_ERROR: 29201 [ 365.364440] binder: undelivered TRANSACTION_ERROR: 29201 13:54:48 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000180)='/dev/sg#\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BLKTRACETEARDOWN(r0, 0x5386, 0x70d000) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000002c0)=0x217, 0x4) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x404000, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') timer_create(0x7, &(0x7f0000000380)={0x0, 0x5, 0x2, @thr={&(0x7f0000000400)="4c0f25f914909dbc18f87d9ba9e27f26627fa8d9ce9b0f6c228a4fb70ba3e1f4ece7711f93e67faf1ba9763c0ae4b677ad", &(0x7f0000000440)="5e502f38b8928191f7f771c7fb80d715"}}, &(0x7f00000003c0)=0x0) timer_delete(r5) ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) pkey_alloc(0x0, 0x2) sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x410}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x38, r4, 0xa12, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10001}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xff}]}, 0x38}, 0x1, 0x0, 0x0, 0xc840}, 0x20008004) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x14000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x7c, r4, 0x10a, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x28, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xedb6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x101}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xdd}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) 13:54:48 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x2, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000180)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1a) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x30e, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 365.451911] Tx-ring is not supported. [ 365.465574] Tx-ring is not supported. 13:54:48 executing program 6: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff7a, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd9e}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ashmem\x00', 0x402840, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000380)=ANY=[@ANYBLOB="0300000000000000000000000000000004000000020000000400000000000000070000000000000002000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000fcffffffffffffff09000000000000000000000000000000000000000000000004010000000000000000000000000000030000ee5876760000100000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000005378000000000000080000000000000000000000000000000000009c2f00000000000000000000000000"]) syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f0000000100)='./file0\x00', 0x7a00000000000000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="000100000008000081000000c9030000f4000204000000000000000000000000002000000020000000010000000000016e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000140)) socketpair$packet(0x11, 0xfffffffffffffffb, 0x300, &(0x7f0000000340)={0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f00000001c0)={'team0\x00', {0x2, 0x4e23, @multicast2}}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='cpu.stat\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000240)='./file0\x00', 0x83, 0x1400) [ 365.507613] binder_alloc: 24921: binder_alloc_buf, no vma [ 365.519986] binder: 24921:24923 transaction failed 29189/-3, size 24-8 line 3136 [ 365.536793] binder: 24921:24923 ERROR: BC_REGISTER_LOOPER called without request [ 365.580477] binder: 24921:24932 got transaction to invalid handle [ 365.592499] binder: 24921:24932 transaction failed 29201/-22, size 0-0 line 3013 13:54:49 executing program 1: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/status\x00', 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000400)="2f007e574d0003308090224535f576a620cfde265528775dc9ecfe1974406edad38364782d63b6612854b9e49dbdcaef718197e37e870a308b1e390a8fa788a46d30250400000000000000064e2adbe9126423b4a73d68fbe99c6db2f160d49cb6cce76c27289a4f9d097354aaa5860d2383df87526baa184d90bb7729366c17bc9a34c470e9646f33d765e9bc2f882a13f3a9c1f6067a879f55fa31d2c0a775242289bce062d10d24ded5406918a66b2c75c43fe1ff458ae5cd9fec63039ba5a7b66a7cede5ccdabc7ee77660ef2358ccdff02226021384b0c235f114ed9ade92767aecc256acdeb610df42e7169f240357f735ae5fe29017e51e27252f48b95bfbbb3a000035298bdc36d71db635f41c5758b2fb1144046c31ec9120427e771db77aeaff883feb3dc3cc24bd3c036e396ad3af37945058839e812270bc40901fa654e7cc3292a82fc80c374dc07142a1c2e9d3e2528e4fdac32bcaefe910ebd3b948a3bfebef5fc21a4bbc01a15f1cb96a926426d9454ed23a97b5c3196c03f0e7e8b06e54743c08", 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x7) fcntl$notify(r1, 0x402, 0x0) unlink(&(0x7f0000000040)='./file0\x00') 13:54:49 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge_slave_1\x00', 0x0}) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000040)={r1, 0x1, 0x6, @broadcast}, 0x10) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000001c000900000020233ed4a01da7eb0000", @ANYRES32=r1, @ANYBLOB="ffff9e000a000200aaaaaaaaaaaa0000"], 0xff8e}}, 0x0) 13:54:49 executing program 7: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x857, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000e40)='net/rt_cache\x00') epoll_create(0x1) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f00000004c0)) getpid() r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='status\x00') r2 = mq_open(&(0x7f0000000840)="2d240076e7b00c323d9b3159cc114692803471008127727a3db8ee580dd59ad5c29179cecb3b2dbc1fb07924733517489484d1c830d9167fcdde6bebe015631a15dda4b40547fdd60000000058", 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800000000}) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x9e5) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000640)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000680)=0x0) rt_tgsigqueueinfo(r3, r4, 0x17, &(0x7f00000006c0)={0x32, 0x4, 0x4b2d, 0x5}) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000080)={@mcast2, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1}, 0x20) setsockopt$inet6_IPV6_ADDRFORM(r5, 0x29, 0x1, &(0x7f0000000540), 0x4) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000200)) ioctl$int_out(r2, 0x5460, &(0x7f0000000500)) ftruncate(0xffffffffffffffff, 0x4) r6 = openat$cgroup_ro(r1, &(0x7f0000000240)='memory.swap.current\x00', 0x0, 0x0) getsockname$inet6(r0, &(0x7f0000000c40), &(0x7f0000000c80)=0x1c) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f00000009c0)={{{@in=@multicast1, @in6=@ipv4={[], [], @rand_addr}}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in=@local}}, &(0x7f0000000800)=0x2d5) ioctl$TIOCPKT(r6, 0x5420, &(0x7f0000000cc0)=0x4) socket$inet6(0xa, 0x1, 0x6) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)) tee(r2, r0, 0x7, 0x8) creat(&(0x7f00000000c0)='./file0\x00', 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000340)="6e65742f6970365f666c6f776c6162656c006ec03114893458edc1c9d8dc4b0d8dae982640d0e6bb51d7ff596e1c92de0eaa319198e91f0a4d43697c2bcd77f017365af160acf33bd66432ebe50c0e8bdaf7fc39feff34ef27a1397193227f4733c145e66536c6c275112520e72b3097843b5cdac480c3b1384ebf592505f88589fcd2d7") sendfile(r7, r7, &(0x7f00000002c0)=0x202, 0xd9) 13:54:49 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x521400, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x60, r2, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'nr0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x100}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7fff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100000000}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r3, &(0x7f0000000280), 0x0, 0x2000000a, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty, 0x800}, 0x1c) 13:54:49 executing program 5: syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x1, &(0x7f0000000300)=[{&(0x7f0000010000)="8da4363a00000000000000000000000000000000000000000000000000000000ecf6f2a3299748aeb81e1b00920efd9a000001000000000001000000000000005f42485266535f4d", 0x48, 0x10000}], 0x1, &(0x7f0000000180)=ANY=[@ANYBLOB="007c3b5a19fa58a29bf3f957556e7f85b49fe8ac8db2498abf98221423cf7d6218995fe1b28af7bd"]) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x400, 0x0) write$FUSE_INTERRUPT(r0, &(0x7f0000000140)={0x10, 0x0, 0x3}, 0x10) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) 13:54:49 executing program 2: write$P9_RUNLINKAT(0xffffffffffffffff, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000280), 0xfffffdf7, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) clone(0x2000000, &(0x7f0000000140), &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000300)="16e5985f7610b3e2239d684a6222c2443394ddd04e24562f2b5be3e0ab7a359341e8bf5a43d478d306f4f1cc5f5a2a28ac8bffa5307c07a0d33f6285af7ee50cf9e953e1f59b7bd959cd359b6c039c003182850d36bbcae85ac5e5a8f9f3a0bab8a07d78f1ab5f6f2a06384127de0b9970f4db74cd7bca7a5bf3f3592923d01e6ae12d4243e6a2c3abc25a64d18f4d1140f6afc43e1154c9874ffcee3caaef0e62489f601c") r2 = memfd_create(&(0x7f0000000540)='/dev/sbmon#\x00\x00', 0xfffffffffffffffe) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f00000001c0)=[{0xf, 0x8}, {0x8, 0x10001}, {0x7, 0x4}], 0x3) socketpair(0x0, 0x0, 0x0, &(0x7f00000002c0)) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r0) socketpair(0x0, 0x807, 0x80000001, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) kexec_load(0x0, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000040), 0x0, 0x1aa9a1000, 0x1000000}], 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000140)="79f7882b3072b0483c0d1733fbd41a53f685923cd67173cc2b8fc356429c04a62d8dd4583287b543550b3823e3407bad66571b92c4c5d21db68dc59ead60ea6b1e5f87f190b96bd42ed5ca7232b5f3b426", 0x51}], 0x1) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="49000000290100000000000000000000000000000000000000000000000000000007002e2f66696c6530000000000000040000000000000000000000000000000700688f4deb3cd591a5342e2f66696c6530"], 0x49) ioctl$TUNGETVNETHDRSZ(r3, 0x800454d7, &(0x7f0000000480)) mmap(&(0x7f0000ee3000/0x9000)=nil, 0x9000, 0x4, 0x10, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ee8000/0x2000)=nil, 0x2000) 13:54:49 executing program 6: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff7a, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd9e}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ashmem\x00', 0x402840, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000380)=ANY=[@ANYBLOB="0300000000000000000000000000000004000000020000000400000000000000070000000000000002000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000fcffffffffffffff09000000000000000000000000000000000000000000000004010000000000000000000000000000030000ee5876760000100000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000005378000000000000080000000000000000000000000000000000009c2f00000000000000000000000000"]) syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f0000000100)='./file0\x00', 0x7a00000000000000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="000100000008000081000000c9030000f4000204000000000000000000000000002000000020000000010000000000016e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000140)) socketpair$packet(0x11, 0xfffffffffffffffb, 0x300, &(0x7f0000000340)={0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f00000001c0)={'team0\x00', {0x2, 0x4e23, @multicast2}}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='cpu.stat\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000240)='./file0\x00', 0x83, 0x1400) 13:54:49 executing program 3: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$fiemap(r0, 0x40086602, &(0x7f0000000280)=ANY=[]) write$P9_RRENAME(r0, &(0x7f0000000000)={0x7}, 0xfffffd37) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x2, 0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@loopback, @in=@dev}}, {{@in=@local}, 0x0, @in=@dev}}, &(0x7f00000004c0)=0xe8) write(r1, &(0x7f0000000100)="1f0000000104ff00fd4354c007110000f340a205010008007d00010423dcffdf20", 0x21) write(r1, &(0x7f00000000c0)="1f", 0x1) ioctl$FS_IOC_FSSETXATTR(r0, 0x6609, &(0x7f00000004c0)) ioctl$TIOCSTI(r0, 0x5412, 0x2) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000140)) fsync(r0) 13:54:49 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_pts(0xffffffffffffff9c, 0x40001) r1 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000340)=""/170) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="2321202e2f66696c65302f66696c6530203a215c2d73656c662d202f7573722f7362696e2f6e74706420707070302d5d73656c66205d65746831626465767070703024202f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f02acc7edbcd7a071fb35331ce39c5a0adb59c2d7ea219a0ddbfc4f7ba8510c7de9feb656948c68fbe246902bdcc0118788774e330329218331eb771515be450e4d6822c4e0e6fb7fbe2b2ca4c411e7af5bcac7bc201ee3bc52fd585570129df963c014e31b5ad8d0c22ba31a0823583540982defe053eeab10afb7d82cb734cd"], 0xf1) ioctl$sock_ifreq(r0, 0x2000000089f0, &(0x7f0000000100)={"73697430000202000340000040000060", @ifru_data=&(0x7f0000000300)="287df095e3a65b483b39b63e2761201382ba5647140f57b5129126f93118924e"}) 13:54:49 executing program 7: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000080)=@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast2]}, 0x18) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="e9ffffffffffffff"], 0x8) 13:54:49 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000008380)=[{{&(0x7f0000000000)=@in={0x2, 0x4e22, @dev}, 0x80, &(0x7f0000001180), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="10000000000000000000000007000000"], 0x10}}], 0x1, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x3, 0x5, 0x80000000}) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev, 0x4}, 0x79) sendmmsg(r0, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x6000, 0x0) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) bind$packet(r1, &(0x7f0000000180)={0x11, 0x1f, r2, 0x1, 0x0, 0x6, @remote}, 0x14) recvmsg(r1, &(0x7f00000002c0)={&(0x7f00000001c0)=@nfc, 0x80, &(0x7f0000000280)=[{&(0x7f0000000240)=""/60, 0x3c}], 0x1, 0x0, 0x0, 0x70}, 0x2000) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) 13:54:49 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xf}}, 0xffffffffffffff8e) r2 = memfd_create(&(0x7f0000000400)="e83779d80efa45bb7f48bebc95870bd0cd39bd2830ee47afe7b33fc778bde252c50d2e", 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x1) r4 = dup2(r3, r2) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f00000000c0)={0x0, 0x0, 0x0, "7175657565310000000000000000313b0000000000000000000000000000000000000000060000000000ccbf7ddd00"}) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000580), 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000240)='team\x00') r6 = add_key$user(&(0x7f0000001480)='user\x00', &(0x7f00000014c0)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000018c0)="a3be8ede202032c179a0ba7889a4a4316d9e85d76b6ab4168f24f28e08a5673e673f1335ed5a7f3dc0912aa7ffd1c8e1adbb29caa06fef8c5eaac49567fd3a35124ce9772c263748a0cbca9fe1a2ed13e5f146ffc298462316ef99d7d70aa8d849e8650193910b3d0d06d5b1618a0973eee186e91b6ef5", 0x77, 0xfffffffffffffffd) memfd_create(&(0x7f0000000440)='\x00', 0x2) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000180), 0x4) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5334, &(0x7f00000001c0)={0xf48b, 0x0, 0x0, 'queue1\x00'}) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000280), &(0x7f00000003c0)=0x68) r7 = fcntl$getown(r1, 0x9) perf_event_open(&(0x7f0000000680)={0x1, 0x70, 0x81, 0x4eca, 0x4f9, 0x5, 0x0, 0xb475, 0x43, 0x4, 0x7ff, 0xff, 0x5, 0x80000000, 0xffffffffffff66e7, 0x10001, 0x0, 0x3, 0x7ff, 0x1000, 0xffffffffffffce43, 0x2, 0xffffffffffffd230, 0x80000001, 0xfffffffffffffffb, 0x3, 0x4, 0x5, 0x9, 0x6, 0x8001, 0x8001, 0x7, 0x81, 0x3, 0x3, 0xd4, 0x3, 0x0, 0x7f, 0x0, @perf_bp={&(0x7f0000000640), 0xf}, 0x20000, 0x100000000, 0x6, 0x7, 0x2, 0x7, 0x8}, 0x0, 0x0, r5, 0x8) perf_event_open(&(0x7f00000005c0)={0x5, 0x70, 0x9, 0x85b2, 0x400, 0x9, 0x0, 0x3, 0x25400, 0x2, 0x3, 0x3ff, 0x5183, 0x3, 0x40, 0x32, 0xffffffff, 0x0, 0x8001, 0x8, 0x3, 0xfffffffffffffff9, 0x100000000, 0x3, 0x8, 0x1, 0x1000000000, 0x100000000, 0x425, 0x2, 0x4, 0x7, 0x8, 0x8, 0xbe6, 0x2ce408f8, 0x48, 0x1f, 0x0, 0x20, 0x7, @perf_config_ext={0x7, 0x79e}, 0x20, 0x9, 0x7, 0x7, 0x7, 0x8, 0x2f}, r7, 0x6, r4, 0x8) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) r8 = add_key$keyring(&(0x7f0000000500)='keyring\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$instantiate(0xc, r6, 0x0, 0x0, r8) setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x484, &(0x7f0000000300)={0x3f, @multicast1, 0x4e23, 0x3, 'sh\x00', 0x8, 0x0, 0x11}, 0x2c) write$FUSE_POLL(r5, &(0x7f0000000780)={0x18, 0xfffffffffffffffe, 0x3, {0x80}}, 0x18) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc058534f, &(0x7f0000000480)={{0x3, 0x30000000000}, 0x1, 0x2, 0x3f, {}, 0x2, 0x3}) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000000540)) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000080)) keyctl$get_security(0x11, r6, &(0x7f0000000340)=""/120, 0x78) mmap(&(0x7f0000011000/0x6000)=nil, 0x6000, 0x0, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndtimer(&(0x7f0000f85ff1)='/dev/snd/timer\x00', 0x0, 0x0) [ 366.199856] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 366.291159] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 366.310578] binder: BINDER_SET_CONTEXT_MGR already set [ 366.310589] binder: 24921:24995 ioctl 40046207 0 returned -16 13:54:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x110, r0, 0x4000000000000) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000b5db2d8d0d4e02f3dbf50f42caa24d8147b0e36321fcb0a29e9add1fb6fbbe3883d36f1f2443e0198e6051adcaa3e92a67fbc073a541be4613b5fc28d18e02d21dcbbf32716e13b815711a22a33fe610bbe0062d6104b09d4b940476c6d70d0a5a33ca992ed4192f0856271798631d386d8f07718a59eb513e219409c8a6bf493f2baac503a4b2b8fab8", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) r2 = memfd_create(&(0x7f00000000c0)='/dev/binder#\x00', 0x0) write$selinux_validatetrans(r2, &(0x7f0000000180)={'system_u:object_r:kvm_device_t:s0', 0x20, 'system_u:object_r:system_dbusd_var_lib_t:s0', 0x20, 0x8, 0x20, '/usr/sbin/ntpd\x00'}, 0x72) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1163484001241bdefb97d69c2fd4412796eb5ad12cf93674e50bfc105c149c34b5482cdca93937d04c24317a6ddd5aaee62f2f8987228f39bd200942fd9d3a93f897f2654aa557532e170438e96b2b95840f419beffca063227d3fbb095021a5df36937fea1081f600e6a9410a3ab8bdad385542194948acd53445ebf57365019aca1be5fcf0096cca43f063658b90cdff"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:49 executing program 6: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip_vs\x00') mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ffa000/0x4000)=nil) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) socket(0xb, 0x803, 0x10000) ioctl(r0, 0xc0184908, &(0x7f0000001000)) getsockopt$ARPT_SO_GET_INFO(r2, 0x0, 0x60, &(0x7f0000000040)={'filter\x00'}, &(0x7f00000000c0)=0x44) 13:54:49 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") sendmsg$nl_xfrm(r1, &(0x7f000014f000)={&(0x7f00003c7ff4), 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x2a, &(0x7f00000001c0)={0x40000, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x200000001fffffe}, 0x90) 13:54:49 executing program 7: r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000000140)="fc00000048000700ab092500090007000aab80ff010000000000369321000100ff0100000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe0000000700020000036c6c256f1a272f2e117c22ebc205214000000000008934d07302ade01720d7d5bbc91a3e2e80772c05defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48f6f0000080548deac270e33429fd3000175e63fb8d38a873cf1587c3b41", 0xfc) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000000)={0x54, {{0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, [], 0x10}, 0x100000001}}, {{0xa, 0x4e22, 0xaa, @mcast1, 0x84e6}}}, 0x108) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer\x00', 0x80400, 0x0) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000280)={0x3, 0x5, 0xae8e, 0x3, 0x240, 0x7fffffff, 0x6}) [ 366.310683] binder_alloc: 24921: binder_alloc_buf, no vma [ 366.310702] binder: 24921:24932 transaction failed 29189/-3, size 24-8 line 3136 [ 366.310730] binder: 24921:24995 ERROR: BC_REGISTER_LOOPER called without request [ 366.356082] binder: undelivered TRANSACTION_ERROR: 29189 13:54:49 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x8}, 0x20) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev}}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000002300)=[{{0x0, 0x0, &(0x7f0000002200)=[{&(0x7f0000002880)=""/4096, 0x1000}, {&(0x7f0000002000)=""/103, 0x67}], 0x2, &(0x7f0000002280)=""/103, 0x67}, 0x1ff}], 0x1, 0x0, &(0x7f00000056c0)={0x0, 0x989680}) sendmmsg(r0, &(0x7f00000021c0), 0x7e3, 0x8000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000006c0)={'gre0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000700)={@local, 0x70, r1}) [ 366.356109] binder: undelivered TRANSACTION_ERROR: 29189 [ 366.363276] binder: undelivered TRANSACTION_ERROR: 29201 13:54:49 executing program 7: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r1, &(0x7f0000000040)='\x00', 0x1, 0x20008800, &(0x7f00000000c0)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r1, &(0x7f0000000180), 0x65, 0x0, &(0x7f0000000140)={0x2, 0x0, @multicast1}, 0x10) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x20000, 0x0) clock_gettime(0x0, &(0x7f0000003b80)={0x0, 0x0}) recvmmsg(r2, &(0x7f00000020c0)=[{{&(0x7f0000000240)=@rc, 0x80, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/5, 0x5}, {&(0x7f0000000400)=""/4096, 0x1000}], 0x2, &(0x7f0000001440)=""/110, 0x6e, 0x4}, 0x40}, {{0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000014c0)=""/115, 0x73}, {&(0x7f0000001540)=""/45, 0x2d}, {&(0x7f0000001580)=""/145, 0x91}, {&(0x7f0000001640)}], 0x4, &(0x7f00000016c0)=""/117, 0x75, 0x1}, 0x3}, {{&(0x7f0000001740)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000001ac0)=[{&(0x7f00000017c0)=""/221, 0xdd}, {&(0x7f00000018c0)=""/50, 0x32}, {&(0x7f0000001900)=""/9, 0x9}, {&(0x7f0000001940)=""/195, 0xc3}, {&(0x7f0000001a40)=""/90, 0x5a}], 0x5, &(0x7f0000001b40)=""/208, 0xd0, 0x81}, 0x7ff}, {{&(0x7f0000001c40)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000001fc0)=[{&(0x7f0000001cc0)=""/116, 0x74}, {&(0x7f0000001d40)=""/125, 0x7d}, {&(0x7f0000001dc0)=""/54, 0x36}, {&(0x7f0000001e00)=""/31, 0x1f}, {&(0x7f0000001e40)=""/155, 0x9b}, {&(0x7f0000001f00)=""/52, 0x34}, {&(0x7f0000001f40)=""/85, 0x55}, {&(0x7f0000002580)=""/4096, 0x1000}], 0x8, &(0x7f0000002040)=""/72, 0x48, 0x6}, 0x4}], 0x4, 0x0, &(0x7f00000021c0)={0x0, 0x1c9c380}) recvmmsg(r1, &(0x7f0000003a40)=[{{&(0x7f0000002500)=@hci, 0x80, &(0x7f0000003700)=[{&(0x7f00000002c0)=""/225, 0xe1}], 0x1, &(0x7f0000003780)=""/232, 0xe8}}, {{&(0x7f0000003880)=@xdp, 0x80, &(0x7f0000003980), 0x8a, &(0x7f00000039c0)=""/111, 0x6f}}], 0x2, 0x2, &(0x7f0000003bc0)={0x0, r3+30000000}) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000100), 0x4) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r2, 0xc08c5336, &(0x7f0000000180)={0xffff, 0xffffffffffffffc9, 0xcf47, 'queue1\x00', 0xe5}) 13:54:49 executing program 6: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)="2ff963f983cf8ecd032f6e6d742f697056342f76732f69676e6f72655f74756e6e656c6564008caceecab01296023b4bffb11346982c530a569dd7ececf3077c2690631821c7efd9758aec6932d013c67bf8ea5f6f505b8764e54aec4435a53ff5cf35488ba239b81a2b001a52d17406dba5a44900bb6ce3ad2304ef62fa", 0x2, 0x0) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000708000/0x3000)=nil, 0x3000}) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000140)=0x0) syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x80000000, 0x80) write$FUSE_LK(r1, &(0x7f0000000180)={0x28, 0x0, 0x7, {{0x8, 0x4, 0x1, r2}}}, 0x28) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000046a000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f00001d8000/0x1000)=nil) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000040)) fsetxattr(r0, &(0x7f0000000200)=@known='security.selinux\x00', &(0x7f0000000240)="2ff963f983cf8ecd032f6e6d742f697056342f76732f69676e6f72655f74756e6e656c6564008caceecab01296023b4bffb11346982c530a569dd7ececf3077c2690631821c7efd9758aec6932d013c67bf8ea5f6f505b8764e54aec4435a53ff5cf35488ba239b81a2b001a52d17406dba5a44900bb6ce3ad2304ef62fa", 0x7e, 0x3) [ 366.548908] binder: 25008:25016 got transaction with invalid data ptr [ 366.555618] binder: 25008:25016 transaction failed 29201/-14, size 24-8 line 3155 [ 366.584920] binder: 25008:25016 ERROR: BC_REGISTER_LOOPER called without request 13:54:49 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") sendmsg$nl_xfrm(r1, &(0x7f000014f000)={&(0x7f00003c7ff4), 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x2a, &(0x7f00000001c0)={0x40000, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x200000001fffffe}, 0x90) 13:54:49 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x1, 0x10800) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000001240)={{{@in=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@local}}, &(0x7f00000001c0)=0xe8) syz_open_dev$sndseq(&(0x7f0000001380)='/dev/snd/seq\x00', 0x0, 0x420100) bind$packet(r2, &(0x7f0000001340)={0x11, 0x4, r3, 0x1, 0x7, 0x6, @random="230f5eb96b4c"}, 0x14) recvfrom$inet6(r1, &(0x7f0000000240)=""/4096, 0x1000, 0x40000000, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x20, &(0x7f0000000040)={@multicast2, @broadcast, 0x0}, &(0x7f00000000c0)=0xc) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000000140)=r4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x20000000003}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000013c0)) sendmmsg(r1, &(0x7f00000092c0), 0x337, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 366.636573] binder: 25008:25032 got transaction to invalid handle [ 366.662448] binder: 25008:25032 transaction failed 29201/-22, size 8804858658815424937--8561571698793849491 line 3013 13:54:50 executing program 6: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)="2ff963f983cf8ecd032f6e6d742f697056342f76732f69676e6f72655f74756e6e656c6564008caceecab01296023b4bffb11346982c530a569dd7ececf3077c2690631821c7efd9758aec6932d013c67bf8ea5f6f505b8764e54aec4435a53ff5cf35488ba239b81a2b001a52d17406dba5a44900bb6ce3ad2304ef62fa", 0x2, 0x0) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000708000/0x3000)=nil, 0x3000}) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000140)=0x0) syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x80000000, 0x80) write$FUSE_LK(r1, &(0x7f0000000180)={0x28, 0x0, 0x7, {{0x8, 0x4, 0x1, r2}}}, 0x28) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000046a000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f00001d8000/0x1000)=nil) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000040)) fsetxattr(r0, &(0x7f0000000200)=@known='security.selinux\x00', &(0x7f0000000240)="2ff963f983cf8ecd032f6e6d742f697056342f76732f69676e6f72655f74756e6e656c6564008caceecab01296023b4bffb11346982c530a569dd7ececf3077c2690631821c7efd9758aec6932d013c67bf8ea5f6f505b8764e54aec4435a53ff5cf35488ba239b81a2b001a52d17406dba5a44900bb6ce3ad2304ef62fa", 0x7e, 0x3) 13:54:50 executing program 2: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={&(0x7f0000000480), 0xc, &(0x7f0000000180)={&(0x7f0000000400)=@flushsa={0x14, 0x1c, 0x301}, 0x14}, 0x8}, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) [ 367.114611] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 13:54:50 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) unshare(0x600) pselect6(0x40, &(0x7f0000000000)={0x8}, &(0x7f0000000040), &(0x7f0000000300)={0x0, 0x0, 0x0, 0x94b}, &(0x7f0000000340)={0x0, 0x1c9c380}, &(0x7f0000000280)={&(0x7f0000000380), 0x8}) ioctl$sock_ifreq(r0, 0x8916, &(0x7f0000000080)={'gretap0\x00', @ifru_ivalue=0x1}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='io.stat\x00', 0x0, 0x0) setsockopt$inet_int(r1, 0x0, 0x3f, &(0x7f0000000100)=0x6, 0x4) 13:54:50 executing program 6: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f0000000180)) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) fgetxattr(r0, &(0x7f00000003c0)=@known='system.sockprotoname\x00', &(0x7f0000000400), 0x0) mount(&(0x7f0000000200)='./file0/file0\x00', &(0x7f00000002c0)='./file0\x00', &(0x7f0000000380)='jfs\x00', 0x80000, &(0x7f00000003c0)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f0000000ac0)) mkdir(&(0x7f0000000100)='./file0/file0\x00', 0x0) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000440)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}) r2 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x0, 0x10000) ioctl$VT_WAITACTIVE(r2, 0x5607) mount(&(0x7f0000377ff8)='.', &(0x7f0000000880)='./file0/file0\x00', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f0000000640)) umount2(&(0x7f0000000480)='./file0\x00', 0x2) r3 = dup2(r0, 0xffffffffffffffff) ioctl$RTC_IRQP_SET(r3, 0x4008700c, 0xcc9) 13:54:50 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x65, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) getpid() epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) ioctl$TIOCNOTTY(0xffffffffffffffff, 0x5422) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000140)={'veth0_to_bond\x00', {0x2, 0x4e21, @rand_addr=0x1}}) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) symlink(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000180)='./file0\x00') shutdown(r0, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x12800, 0x0) symlink(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)='./file0\x00') recvmsg(0xffffffffffffffff, &(0x7f0000003b40)={&(0x7f0000002900)=@xdp, 0x80, &(0x7f00000013c0), 0x0, &(0x7f0000003a80)=""/155, 0x9b}, 0x0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000002780)={'nat\x00', 0x0, 0x0, 0x1f, [], 0x0, &(0x7f00000001c0), &(0x7f0000002740)=""/31}, &(0x7f0000002800)=0x78) setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000001300)={0xfffffffffffffffe, {{0x2, 0xfffffffffffffffc, @local}}}, 0xffffffffffffff4b) 13:54:50 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x16c0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) timer_create(0x3, &(0x7f0000044000)={0x0, 0x0, 0x1}, &(0x7f0000000000)) seccomp(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6}]}) getsockopt$inet6_tcp_int(r0, 0x6, 0xe, &(0x7f0000000100), &(0x7f0000000140)=0x4) exit(0x0) timer_delete(0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r4, &(0x7f00000003c0)={&(0x7f0000000000)=@abs, 0x6e, &(0x7f0000000340), 0x0, &(0x7f0000000380)=[@rights={0x18, 0x1, 0x1, [r3]}], 0x18}, 0x0) r5 = open(&(0x7f0000000180)='./file0\x00', 0x402, 0x4) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000400)={{{@in=@multicast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@loopback}}, &(0x7f00000001c0)=0xe8) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ATTR(r5, &(0x7f0000000580)={0x78, 0xfffffffffffffff5, 0x7, {0x2, 0x3, 0x0, {0x1, 0x1ff, 0x1, 0x4, 0x0, 0x7, 0x6, 0x10000, 0x3310cf20, 0x2, 0xbf6, r6, r7, 0x2, 0x6}}}, 0x78) sendmsg$unix(r3, &(0x7f0000e4ffc8)={&(0x7f00000002c0)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f000053c000)=[@rights={0x18, 0x1, 0x1, [r3]}], 0x18}, 0x0) close(r2) close(r2) 13:54:50 executing program 4: creat(&(0x7f0000000340)='./file0\x00', 0x0) chroot(&(0x7f0000000000)='./file0\x00') rename(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='./bus\x00') write$cgroup_type(0xffffffffffffffff, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) [ 367.319864] binder: BINDER_SET_CONTEXT_MGR already set [ 367.329740] binder: 25008:25072 ioctl 40046207 0 returned -16 [ 367.338246] binder_alloc: 25008: binder_alloc_buf, no vma [ 367.338753] binder: 25008:25072 ERROR: BC_REGISTER_LOOPER called without request [ 367.351755] binder: 25008:25032 transaction failed 29189/-3, size 24-8 line 3136 13:54:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) write$input_event(r2, &(0x7f00000000c0)={{0x0, 0x7530}, 0x2, 0x914, 0x80000000}, 0x18) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x1, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0b7f0000763c20628946aee719812100000000000000"], 0x0, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 367.384090] binder: 25008:25032 got transaction to invalid handle [ 367.384388] binder: undelivered TRANSACTION_ERROR: 29189 [ 367.384415] binder: undelivered TRANSACTION_ERROR: 29201 [ 367.384673] binder: undelivered TRANSACTION_ERROR: 29201 [ 367.407435] binder: 25008:25032 transaction failed 29201/-22, size 8804858658815424937--8561571698793849491 line 3013 [ 367.422830] binder: undelivered TRANSACTION_ERROR: 29201 13:54:50 executing program 7: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) pwrite64(r1, &(0x7f00000000c0), 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000480)=""/180) bind$inet6(0xffffffffffffffff, &(0x7f0000000380), 0x1c) fallocate(r2, 0x0, 0x0, 0x1000f4) r3 = open(&(0x7f0000000180)='./bus\x00', 0x4002, 0x0) sendfile(r2, r3, &(0x7f0000d83ff8), 0x8000fffffffe) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f00000000c0), &(0x7f0000000140)=0xc) ioctl$PERF_EVENT_IOC_QUERY_BPF(r3, 0xc008240a, &(0x7f0000000540)=ANY=[@ANYBLOB="01006a1b4cd2000000000000000000000000000000000004854656753395779f548cc0cd0194345fa2fec9a8afd2d64877ca290e6971d8536f2887366953cde679c06161b12900024add68508e26e1c58e8d2ad4e7243bd41d7fd2182e2bea0d9bd7d6a2c331b702106ba6f46b44423c8c3d350a721fdb2f85231a9ff74b0c2089b4ac135afff43f76ff0c881dfd1fa04f17a7fb9d2054f23e564f483802e14b68d3e8989b47feef531c9677211d5df6b13218f4cfaa2bda398f765bfddc134d0eb10cde4d8ad23e6d00000000000000000000000000000099e0461767f76f9528832e43835ab99a6be1228db5e0b786c8a252052501f8dda7fb08efbf6b3bb8964d3435f2eb3e02c764c98b9febb78e6be281f373beaa5aa805000000c5a876c732"]) pkey_free(0xffffffffffffffff) r4 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000200), 0x10) sendfile(r0, r4, &(0x7f0000d83ff8), 0x8000fffffffe) getxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000300)=@known='security.ima\x00', &(0x7f00000003c0)=""/158, 0x9e) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000240)={0x1, 0x1, 0x800, 0x0, 0xe}) 13:54:50 executing program 5: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) fallocate(r0, 0x18, 0xff, 0x8) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="03000008000000f859e91900000000002d01b9"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$EVIOCSMASK(r4, 0x40104593, &(0x7f0000000500)={0x2, 0x0, &(0x7f0000000400)}) 13:54:50 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x60001, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x4000000000000006) membarrier(0x20, 0x0) poll(&(0x7f0000000580), 0x0, 0x0) 13:54:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000240)='/dev/sg#\x00', 0x3f, 0x8041) fcntl$setpipe(r0, 0x407, 0x2) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x18a) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$packet_int(r1, 0x107, 0x13, &(0x7f00000001c0), 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000788000)=0x2, 0x4) rt_sigprocmask(0x1, &(0x7f00000002c0)={0x41b}, &(0x7f0000000300), 0x8) ioctl$TCSBRKP(r1, 0x5425, 0x80) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, 0xffffffffffffffff) syz_emit_ethernet(0x423, &(0x7f0000000cc0)={@link_local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f000029b000), 0x0, 0x0, &(0x7f0000778000)={0x2, 0x1}, 0x10) poll(&(0x7f0000000040)=[{r3}], 0x1, 0x1) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0x0, 0x3, 0x9, 0x2}, 0xbc, 0x6}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000080)={{0x80}, 'port1\x00'}) close(r4) [ 367.522227] binder: 25090:25094 unknown command 32523 [ 367.528236] binder: 25090:25094 ioctl c0306201 20000180 returned -22 [ 367.535821] binder_alloc: 25090: binder_alloc_buf, no vma [ 367.542026] binder: 25090:25094 transaction failed 29189/-3, size 0-0 line 3136 [ 367.558327] binder: BINDER_SET_CONTEXT_MGR already set [ 367.563766] binder: 25090:25098 ioctl 40046207 0 returned -16 13:54:50 executing program 1: capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000140)) r0 = socket(0x1, 0x802, 0x0) sendmmsg$unix(r0, &(0x7f0000f72eb0)=[{&(0x7f0000f72000)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00003ff000), 0x88, &(0x7f00000000c0)=[@cred={0x20}], 0x20}], 0x1, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) capset(&(0x7f0000000040)={0x20071026, r1}, &(0x7f0000000080)={0xd367, 0x6, 0x200, 0xbe98, 0x8, 0x80f}) [ 367.570256] binder_alloc: 25090: binder_alloc_buf, no vma [ 367.576275] binder: 25090:25094 transaction failed 29189/-3, size 24-8 line 3136 [ 367.597887] binder: 25090:25099 unknown command 32523 [ 367.604521] binder: 25090:25099 ioctl c0306201 20000180 returned -22 [ 367.613140] binder: undelivered TRANSACTION_ERROR: 29189 13:54:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x40002, 0x200000000030, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x40, 0x0) write$uinput_user_dev(r2, &(0x7f0000000480)={'syz1\x00', {0x3, 0x8, 0x3, 0x4}, 0x19, [0x0, 0x8, 0x53423ee2, 0xfff, 0x7ff, 0x7fff, 0x200, 0x1, 0x8, 0x2, 0xa0b, 0x4, 0x8, 0x8001, 0xe5, 0x0, 0xff, 0x0, 0x3f, 0x401, 0x6, 0x80, 0x81, 0x2, 0xfffffffffffffffd, 0x8001, 0x2c1a, 0x8001, 0x8, 0x100, 0x6, 0xe00, 0x9, 0x2, 0x1, 0x9, 0xa6de, 0x6f8, 0x6, 0xfff, 0x401, 0x6, 0xfffffffffffff000, 0x2, 0x8001, 0x3f, 0x2d, 0x10000, 0x1, 0x8, 0x484b, 0x1, 0x9, 0x5, 0xfff, 0x99, 0x4, 0x5, 0xcdec, 0x40, 0x6, 0x9, 0x4, 0x9], [0x5, 0x100, 0x65e088c0, 0x9, 0x9, 0x5, 0x4, 0xfd, 0x7, 0x7ff, 0xfffffffffffffff9, 0xb1, 0x2, 0x617, 0x6, 0x101, 0x0, 0x7, 0x8, 0x7, 0x6710, 0x81, 0xad08, 0x1, 0x7, 0x0, 0xff, 0x4, 0x2, 0x28b, 0x185, 0x2, 0xfffffffffffffffd, 0x7, 0x9, 0x7, 0x0, 0x9, 0x5, 0x81, 0x6b0682cb, 0x3, 0x8001, 0x8, 0x1622b3d0, 0x81, 0xfffffffffffffffa, 0x7, 0x9f, 0x2, 0x7, 0xfffffffffffffff7, 0x4, 0x1000, 0x5, 0x5, 0x6, 0x9, 0xac, 0x8, 0x5, 0x3ff, 0x8, 0x4], [0x9, 0x8, 0x10001, 0xa0, 0x401, 0x3, 0x7fffffff, 0x0, 0x3ff, 0x9, 0x9ebe, 0x101, 0x9, 0x80, 0x401, 0x3f, 0x200, 0xfff, 0x7, 0x9, 0x7, 0x3, 0x100000001, 0x8001, 0x1, 0x400, 0x2, 0xffffffff, 0x1, 0x4000000000000, 0x2, 0x1f, 0x9, 0x0, 0x4, 0x23e, 0x4, 0x2, 0x7, 0x5, 0xdb, 0x2, 0x7fff, 0x7, 0x7, 0x3, 0x2b, 0x9, 0x5c, 0x7ff, 0x3ff, 0x1, 0x0, 0x2, 0x200, 0x7f, 0xd11, 0x20000000, 0x2b162f93, 0x0, 0x45, 0x4, 0x0, 0x3], [0x1, 0x2, 0xd4, 0x36, 0x5, 0x8, 0x2, 0x1000, 0x9871, 0x80000001, 0xfffffffffffffff7, 0x6, 0xd40, 0x2, 0xc1, 0xffffffffffffffe1, 0x0, 0x0, 0x7, 0x4, 0x6, 0x401, 0x80000000, 0x9, 0x751, 0x7ff, 0x4f40, 0x8001, 0x4, 0x6, 0x7fff, 0x80, 0x5, 0x78b, 0x10001, 0x4, 0x9, 0x400, 0x2, 0x34d, 0x80000000, 0x3, 0x8a, 0x1, 0x1d, 0x4, 0x482, 0x3, 0x0, 0x2, 0x7, 0xfff, 0x7b, 0x5, 0x401, 0x7, 0x1ef7, 0x8001, 0xffffffffffff4247, 0x2, 0x4, 0x9, 0xc73, 0xff]}, 0x45c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0xffffffffffffffdd, 0x0, &(0x7f00000000c0), 0x1, 0x0, &(0x7f0000000180)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000480)}) [ 367.619257] binder: undelivered TRANSACTION_ERROR: 29189 [ 367.632814] binder: send failed reply for transaction 419 to 25090:25094 [ 367.643476] binder: undelivered TRANSACTION_COMPLETE [ 367.650080] binder: undelivered TRANSACTION_ERROR: 29189 13:54:50 executing program 6: r0 = socket$inet6(0xa, 0x3, 0x10000000000003) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x4000, 0x0) socket$inet6(0xa, 0x2, 0x4) write$selinux_context(r1, &(0x7f0000000040)='system_u:object_r:setfiles_exec_t:s0\x00', 0x25) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast1, 0x4}, 0x1c) sendmmsg(r0, &(0x7f00000089c0)=[{{0x0, 0x0, &(0x7f0000004c40), 0x0, &(0x7f0000004cc0)}}, {{0x0, 0x0, &(0x7f0000005000), 0x0, &(0x7f0000005040)=ANY=[@ANYBLOB="1000007d000000000000000000000004"], 0x10}}], 0x2, 0x0) [ 367.783613] binder_alloc: 25108: binder_alloc_buf, no vma 13:54:50 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0xffffffffffffff8e) r1 = memfd_create(&(0x7f0000000400)="e83779d80efa45bb7f48bebc95870bd0cd39bd2830ee47afe7b33fc778bde252c50d2e", 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000042ff3)='/dev/snd/seq\x00', 0x0, 0x20002) r3 = dup2(r2, r1) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000040)=0x4, 0x4) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f00000000c0)={0x0, 0x0, 0x0, "7175657565310000000000000000313b0000000000000000000000000000000000000000060000000000ccbf7ddd00"}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5334, &(0x7f00000001c0)={0xfffffffffffffff9, 0x0, 0x9, 'queue1\x00'}) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000280), &(0x7f00000003c0)=0x68) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x1, 0x0, 0x0, @tick, {}, {}, @connect}], 0x30) r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000440)="d9ac7f92edb63808aee52cb82e33bdec79dc30bce0520527d0ecd21e6df9dbffcab0970cae3d06592a748c47c058a1c0a35c44e014a99802b19eeebb0fba4ae592c8a4708339399a03698062b2a4aa919043dbeb4a8754ca0e03c54684fea358035076ddfe5eeadec35bb2ba6387b27b23bc04e254d1295f98f82ecd44de31ab2a1756fa841759c7bae969f1b2d45312a92524e43b61a95b3fadf287ea9038555ae5d65a4c4f17e070cb2c5a91ddb89a2358154deec686e0ec2023bb355336f97fcf017a5292637bd6550905a9c7a11e07549aff2237ca5aecf7daedb57dce44eba24626c856848f97e970a323bb7a9ce17f3364a62156", 0xf7, 0xfffffffffffffff8) keyctl$invalidate(0x15, r5) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000080)={'ah\x00'}, &(0x7f0000000180)=0x1e) 13:54:50 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x65, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) getpid() epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) ioctl$TIOCNOTTY(0xffffffffffffffff, 0x5422) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000140)={'veth0_to_bond\x00', {0x2, 0x4e21, @rand_addr=0x1}}) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) symlink(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000180)='./file0\x00') shutdown(r0, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x12800, 0x0) symlink(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)='./file0\x00') recvmsg(0xffffffffffffffff, &(0x7f0000003b40)={&(0x7f0000002900)=@xdp, 0x80, &(0x7f00000013c0), 0x0, &(0x7f0000003a80)=""/155, 0x9b}, 0x0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000002780)={'nat\x00', 0x0, 0x0, 0x1f, [], 0x0, &(0x7f00000001c0), &(0x7f0000002740)=""/31}, &(0x7f0000002800)=0x78) setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000001300)={0xfffffffffffffffe, {{0x2, 0xfffffffffffffffc, @local}}}, 0xffffffffffffff4b) 13:54:50 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x9, 0x80000, 0x1ff, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000140)) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f00000000c0)="4900000019007f5300fe01b2a4a280930a60000000a84308910000003900090020000c00060000001900a30700000000000000dc1338d54400009204b98767a591ec71e3dfca8df75a", 0x49}], 0x1, &(0x7f0000000400)}, 0x0) [ 367.828304] binder: 25108:25115 transaction failed 29189/-3, size 24-8 line 3136 [ 367.833627] binder: 25108:25123 unknown command 0 [ 367.833717] binder: 25108:25123 ioctl c0306201 20000080 returned -22 [ 367.871575] binder: BINDER_SET_CONTEXT_MGR already set 13:54:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup2(r0, r0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x24, 0x0, &(0x7f0000000040)=ANY=[@ANYRESDEC=0x0, @ANYRES64=r1, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) restart_syscall() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x24, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0f630c40040000000200000000000000106308400400000000000000072e8df06bef194a94d6e2a091a66304400100000016ffaed146eca5d749bfd4221e176341047b35126cd031b18c78ea7a917ba0aa7d3aee8040b662a31594bd841d756a2cc7041a8683b244e173214d06d5b6d2181b0733b9e5a3de28aba2131a9143593bb799a37ed40ef353ca0059f58272ce2ae7560f8d869c1c322ae4255902fa15e1f08ff93cf43424d5eb2d8bd8ecc0d41745463d5000b23560d713b7ae6ca65b316af547a64ce50c480d73a83fef9eef86af495927b907c71f21c75bfea65a773e6c02a12ed45ad7c980c161a91ea6c40000000000"], 0x13, 0x0, &(0x7f0000000180)="1696910b4f5774dd83c5afd7b00971ccc3c944c67e0afce58d11d3d9501348b53cc364e9e03a8331797513fdc0305f95eb0c503c615ef20b3b7b758eaae4e102ff"}) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000240)='/dev/sg#\x00', 0x3f, 0x8041) fcntl$setpipe(r0, 0x407, 0x2) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x18a) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$packet_int(r1, 0x107, 0x13, &(0x7f00000001c0), 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000788000)=0x2, 0x4) rt_sigprocmask(0x1, &(0x7f00000002c0)={0x41b}, &(0x7f0000000300), 0x8) ioctl$TCSBRKP(r1, 0x5425, 0x80) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, 0xffffffffffffffff) syz_emit_ethernet(0x423, &(0x7f0000000cc0)={@link_local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f000029b000), 0x0, 0x0, &(0x7f0000778000)={0x2, 0x1}, 0x10) poll(&(0x7f0000000040)=[{r3}], 0x1, 0x1) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0x0, 0x3, 0x9, 0x2}, 0xbc, 0x6}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000080)={{0x80}, 'port1\x00'}) close(r4) [ 367.880274] binder: 25108:25123 ioctl 40046207 0 returned -16 [ 367.886712] binder_alloc: 25108: binder_alloc_buf, no vma [ 367.896015] binder: 25108:25115 transaction failed 29189/-3, size 24-8 line 3136 [ 367.905522] binder: undelivered TRANSACTION_ERROR: 29189 [ 367.916801] binder: undelivered TRANSACTION_ERROR: 29189 13:54:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000240)='/dev/sg#\x00', 0x3f, 0x8041) fcntl$setpipe(r0, 0x407, 0x2) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x18a) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$packet_int(r1, 0x107, 0x13, &(0x7f00000001c0), 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000788000)=0x2, 0x4) rt_sigprocmask(0x1, &(0x7f00000002c0)={0x41b}, &(0x7f0000000300), 0x8) ioctl$TCSBRKP(r1, 0x5425, 0x80) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, 0xffffffffffffffff) syz_emit_ethernet(0x423, &(0x7f0000000cc0)={@link_local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f000029b000), 0x0, 0x0, &(0x7f0000778000)={0x2, 0x1}, 0x10) poll(&(0x7f0000000040)=[{r3}], 0x1, 0x1) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0x0, 0x3, 0x9, 0x2}, 0xbc, 0x6}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000080)={{0x80}, 'port1\x00'}) close(r4) [ 368.029363] binder: 25140:25150 unknown command 808464432 [ 368.051840] netlink: 45 bytes leftover after parsing attributes in process `syz-executor5'. [ 368.068279] netlink: 45 bytes leftover after parsing attributes in process `syz-executor5'. [ 368.080828] binder: 25140:25159 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 368.080838] binder: 25140:25159 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 368.080846] binder: 25140:25159 unknown command -259183097 [ 368.080855] binder: 25140:25159 ioctl c0306201 200000c0 returned -22 [ 368.081088] binder: 25140:25159 got transaction to invalid handle [ 368.081096] binder: 25140:25159 transaction failed 29201/-22, size 0-0 line 3013 [ 368.140698] binder: 25140:25150 ioctl c0306201 20000440 returned -22 [ 368.151830] binder: 25140:25159 unknown command 808464432 [ 368.158237] binder: BINDER_SET_CONTEXT_MGR already set [ 368.158246] binder: 25140:25150 ioctl 40046207 0 returned -16 [ 368.177358] binder: 25140:25159 ioctl c0306201 20000440 returned -22 [ 368.185339] binder: 25140:25159 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 368.192384] binder: 25140:25159 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 368.202469] binder: 25140:25159 unknown command -259183097 [ 368.208543] binder: 25140:25159 ioctl c0306201 200000c0 returned -22 [ 368.223483] binder: 25140:25159 got transaction to invalid handle 13:54:51 executing program 2: r0 = socket$inet6(0xa, 0x1080000000002, 0x0) ioctl(r0, 0x400000008912, &(0x7f00000001c0)="0a5cc80700315f85715070") syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f0000000340)=ANY=[]) accept4$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14, 0x800) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000300)={@local, @dev={0xfe, 0x80, [], 0xd}, @empty, 0x9, 0x18d520000, 0xffffffff, 0x500, 0x81, 0x10030, r1}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat(r2, &(0x7f0000000180)="2e2f66692e65318c", 0xfffffffffffffffe, 0x0) r3 = fanotify_init(0x0, 0x0) fanotify_mark(r3, 0x11, 0x2, r2, &(0x7f0000000380)="2e2f66692e65318c00") r4 = open(&(0x7f0000000040)="2e2f66692e65318c00", 0x80241, 0x0) write$P9_RWRITE(r4, &(0x7f0000000240)={0xfffffffffffffd94}, 0x9) readv(r3, &(0x7f00000002c0)=[{&(0x7f0000000080)=""/45, 0x2d}], 0x1) 13:54:51 executing program 6: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f00000001c0)={0x7}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@noextend='noextend'}]}}) write$P9_RREADDIR(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="2a000000290100000000000000000000000000000000000000000000000000000007002e2f66696c6530"], 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RWALK(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="160000006f0100010000000000000000000000000000"], 0x16) write$P9_RGETATTR(r1, &(0x7f0000000540)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RWRITE(r1, &(0x7f0000000400)={0xb, 0x77, 0x1}, 0xb) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000780)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f00000007c0)=0x1) write$P9_RGETATTR(r1, &(0x7f0000000640)={0xa0, 0x19, 0x1}, 0xa0) write$FUSE_INTERRUPT(r2, &(0x7f0000000800)={0x10, 0x0, 0x2}, 0x10) r3 = fcntl$dupfd(r1, 0x406, r1) r4 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') sendmsg$FOU_CMD_GET(r3, &(0x7f0000000600)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f0000000180)={0x3c, r4, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e23}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000040}, 0x4) write$P9_RWALK(r1, &(0x7f0000000940)={0x9, 0x6f, 0x1}, 0x9) write$P9_RSTATu(r1, &(0x7f0000000700)={0x62, 0x7d, 0x1, {{0x0, 0x3e, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, "", 0x3, '9p\x00', 0x8, 'noextend'}, 0xf, '!cpuset]cgroup-'}}, 0x62) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000008c0)='9p\x00', 0x0, &(0x7f0000000440)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_mmap='cache=mmap'}]}}) r5 = creat(&(0x7f0000000300)='./file0/file0\x00', 0x0) writev(r5, &(0x7f0000002d00)=[{&(0x7f0000002c80)="17", 0x1}], 0x1) 13:54:51 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)="9e96cb4bf3043fa153608c162b6c004746e31637", 0x14, 0xfffffffffffffffe) modify_ldt$write2(0x11, &(0x7f0000000340)={0x1, 0xffffffffffffffff, 0x4000, 0x7fff, 0x0, 0x100000000, 0x5, 0x8, 0x100000001, 0x51ce}, 0x10) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x400, 0x0) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f00000002c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x2400) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)="617474722f63757272656e740099871411d7432e4cd1d0c3679f15b8cb27b7fcfedaffdfb67899fd7611a29de5a2a9897cbc43db1add207e2395f8e43a285a5487f4d39a3f4160448ebe8e43b67448ec2d6ebc0522cdcfc53ec697") r3 = getpid() syz_open_procfs(r3, &(0x7f0000000240)='fd\x00') r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/netlink\x00') socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000180)) sendfile(r2, r4, &(0x7f0000000280)=0x38, 0x2000000000000001) clock_gettime(0x0, &(0x7f0000000140)) sync_file_range(r0, 0x9e, 0x401, 0x1) write$FUSE_BMAP(r4, &(0x7f00000001c0)={0x18, 0x0, 0x5, {0x7fffffff}}, 0x18) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000400), &(0x7f0000000440)=0xc) [ 368.233393] binder: 25140:25159 transaction failed 29201/-22, size 0-0 line 3013 [ 368.261368] binder: undelivered TRANSACTION_ERROR: 29201 [ 368.274714] binder: undelivered TRANSACTION_ERROR: 29201 [ 368.416381] 9pnet: bogus RWRITE count (4063232 > 1) 13:54:51 executing program 7: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x200000) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000040)) keyctl$reject(0xc, 0x0, 0xffffffdffffffff5, 0x2, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 13:54:51 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$packet(r1, &(0x7f0000000400), &(0x7f0000000440)=0x14, 0x800) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000002500)='net/protocols\x00') getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r2 = memfd_create(&(0x7f0000000080)="008159a7811ff08a4c2ef26daf582a97c324824e153a4cb2c32228332e86baa97788319615b3c5c0ef621d910522a14631a3ba1b92da6a2c5623f76100951ed31d8ce579a26d20ede818e860e27ea2225c7794751c060f1fa1ceab21a9f0fc8eb562733bda3bbc1c5f450104742581f0cda42698c54fba8caf9ad0562f9961e5ad7522b6d558e77bc4aaaf8ee60f95c99744b456819133a2991faf1dbc02dd61af8d9a388798e1a674324e84b8de7d9890b25fe91cf06a3be7ce49b4cdd3c7866fc088afe449cf54904820cb2c41ad6f5609", 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x7ffe) r4 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) r5 = fcntl$getown(r3, 0x9) fcntl$setown(r4, 0x8, r5) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000000)={0x3c847480}) r6 = fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) sendto$inet(r2, &(0x7f0000000300)="3ed804e3", 0x4, 0x10, &(0x7f00000002c0)={0x2, 0x4e23, @multicast2}, 0x10) ioctl$KIOCSOUND(r6, 0x4b2f, 0x95) r7 = dup2(r3, r2) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r7, 0xc08c5332, &(0x7f0000037000)={0x0, 0x7fffffff, 0x0, "9ede7a8c5ae95e48008000000000007f4f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa0500000074dbcfa6dc4d", 0x7f}) write$sndseq(r2, &(0x7f000000a000)=[{0x0, 0x0, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000038ffe)}}], 0xfe23) syz_open_pts(0xffffffffffffffff, 0x0) getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000240), &(0x7f00000003c0)=0x4) readv(0xffffffffffffffff, &(0x7f0000002480), 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000380)='eql\x00', 0x10) clock_gettime(0x0, &(0x7f0000000340)) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(0xffffffffffffffff, 0xc05c5340, &(0x7f0000000480)={0x0, 0x0, 0x80000001, {}, 0x0, 0x6}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000080)) 13:54:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f0000000400)={0x0, 0x1c9c380}, &(0x7f0000001ac0)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000002000/0x11000)=nil, 0x11000, 0x4, 0x1010, r0, 0x7b9e) syz_open_dev$binder(&(0x7f0000001b00)='/dev/binder#\x00', 0x0, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x3, 0x140) syz_mount_image$vfat(&(0x7f00000000c0)='vfat\x00', &(0x7f0000000180)='./file0\x00', 0x2, 0x9, &(0x7f00000019c0)=[{&(0x7f0000000480)="ce7616fdc6c8cd68f5deca341c56df041c24f990d6c8379ea36bd56f264ced5f7bc4a7ec28510022e8740c25ffb6130360e0b1dcfbae6c663989ade9663e8e9c9de27a21965f384a032ffab949172177ad1246ed1094f4d334aaa352c52ce35e9519bee7df6ca3a5d5141e9a6b660d3ca3b91ad2a9189f073fcd44df37f7ef84e23f6eb8ba4aa2961b3dac8cd6f7074827aa17e4bdbc98926c0b6634740393ad7d2bceb44d4670395a281891333713bc75d2d781c4db94be5e03daef2677", 0xbe, 0x891}, {&(0x7f00000001c0)="8dbd6d8ad080b13f17b0b8fb40218030bb5d90673516843c28f63ebe6fd89cfbc4939580db5f737db590e8", 0x2b, 0x3e8}, {&(0x7f0000000280)="8364eaecf359ec34384944c7174d88d1448b4a339e711dc5633578a2c59a29bf77873a1716735e9996fa055628099384", 0x30, 0x401}, {&(0x7f0000000540)="32c90467ffd0babaf8cad7ffd3d882ffc83f3db3e79c4bf67e1a17ca07871773f5c140dc73388470b01ced2cb534322fbc573d5cf8eebb2e5696a6a005ac9bb865069980385ba72c3aa19e1ff3e082e1c675bc32304b9808fc79b4ce862dd69338b9133f2509e96893e3e5858de444dd41c8e2159b8c81ec56c46d3f88e1a200bae2d81e5df92e405ed77088136fab33ae947b890064b93445e46e1e3ffb0b23696b91701a2badf33919d9d9f91f77d81c087c7fd715d4cfd438b7b31082ce083f303a461a6a5804eea9566a45902c1fff97fd1b4960b302e51191088dcb205bef50bcdd0441881d763366998da6a603cb1e622b4e4cce404cd6b14628", 0xfd, 0x3}, {&(0x7f0000000640)="cd7c77f9c280759a1f3a2a361c8517441d1ed032dbb727f978d845678c71a695658f35c62145cbf0d6997d9e143abd8ea9d25103b88d06fbf149da2ec206848edbff64c32a55a284051bc95388e1b706bc68ac68cc2cf1b5a280d4915edd75e1236cbaf9816f3a07516b68a7f72998f15e435503a3b2ab045d32a02a31eed6bdb54a462fd4b183a7ccd5a19f8ae027867ef37118c9abc4e5ad2ccc8a7edcc73483c8cea8986c3dd4f3017f69c4deb30e278c58d739c930212200a3365c95d9a00febe27c0943d8cc65313c50835586a173a04283e93725bc12e01867ade3da2cbb794c3ba3295d04a70868271844207c499b71cc589d27727d4a46a2e7244b4f1e88dfb30356d013d93c660a547636a8cc6011f8d421f3f34fb0235f0d34927112973701b640a113ecd1c479a0d5b56eacb317070aad90ff8e48b643014ab25f5444fb117a3fc71e1165a873c5bd0bdbb6e493e8e32e52d012f73dc78652e51f058c2267619603f0887a02d35a9e1a28c9bfb8b0779c86050ed883dc9db96a756597c7c5b4bf9fd8b99264cfe6882b32b5a40675856b5724ad78715a05907aa7beda9a9d526b49e4d88eafae50f398fa65cf61d6a512200c5b20d812a27df2f3343076c16b1cafb6af064481782478ef3b9b6cced2cdb1185446d33c0b662da4ff6dcf82e1c0a7aecf818b4b15415f642c2032818088977b44a2138b9084d59196754864057277006c9cc11ebeefa1cb27345cae883c0e84235c0b6f4a85b07cc237b815e67e785e38dfdc425fa531adba734a3ae6c7d1aaa0b8f11f69f1919372ee3b357d3d13298d35eeb90e20acdeaea0123b5d51f10d475d4a450d72c5d8572ede556858c8720a3d2e594c9e96033ed6bffe1e88907bc9cee28e4501347fb7fe86d9f6438c5d9e8c7798165b481347b79a8052bbbb912193c127d56b1706321a6730ca27ef5d3f76ccf93bbc9636106b4267c94421eb64ac1f0e8bc5d5bc661fc8e346df197277c4c8d03c3b6f50378934197317210ce84f31766f4ee12e3a82cb418056757eedf6e55e1c32ecac987085992da6a555da9c0b0a27dc76e22dfac8cbedbe5d8b7cc30cd86a4493fd1def4c822e3694990110d31db39890b0b609b065f2600873b55fac8ec4d026241d05bba24d0c3b8a3e5046892539d1ed2606aeee6343cc78b209df0a638a6ddb2ee3bb94d2a4b09173d3d7d6de5a70cb668d5416922e64cb4aae689ebb441b92396926b3775c4c18222d9d3c8edf0fa89a75d7753ec09c7d4d8d478264fb6fe033cf06918686431ba555cf78e2c9ba9c5742c915bf1adaccf6c90786e4e147ceebc6024a5e1df801557d3e534b21db9cc333d3a4fecd35aa6667807aaca6ee9e7b1ed0407fcce5274bfaa16689a6b0d4e8ff4fe8d913efdb9f4d1f18fe9b8197d240f750acd87a22f75e50ebee97daaa86320ed804778a7ee3894a5cfdc0d6dbb18ed16ddd0ecab8ac54d6af555c38c72e93b0b89edded43a046914b422b87cc4c23d88233a3795cba899cb8f4f2752591ed889c62f4ba0b0cca9c5ccb859dfe0d59882f76fbbe101bc694708e391b04507748c1074aa51c2e35f196c6802697ffc33bdd52a1b28827561db3236cc1dec9f27f0d32efba84f8fe70fce2c08cc91ce5b0be3d0f6a3d353eadb073f68ee1cf6f0483cf9aafd050940fde988fa8693d697e2667b128212a410f15f9aab99efcc91c6ba3278f023e83d68bf1e22519728331f12c8e49fe7848f6c67be026a69d01f8c6840c2984b3c293b8c1d1b9f88c837fa2a394a4116f6074f58316a2b4b13970c1789b35ba99c3578ca785cdeb16c89ad81c2662ef2a0297d622d37c3dfb7a72174df781427d742412eac4ad6f5162ad24cfc0ead593d1bc019a2459c14e176558d9a8216652a0e7b9ebe09e0d961686b543074995a718d4c3394167cbf9d62575edd3863bd3279efeb4213639f49df976f79be3a72d0153a52e5631dda0af292d3e5a1568e8d4e4e2844a90dfe48494cc196d7af9d53e889635b3adb3d0cad413010a881d461549113ae1d1bdc58a03d7287f2b23a3276aee39085a0ff6917f1155cb7c72d092dfcb5a153cf308237d94c7ef3fb130dcc0656a018ac08f4af96fb2c90b968bc0ca5ac1eac15975a4927e4cc727cfd9833a75827c6e113a55983fbc7d619bdb76e659d7cae48d7ab484cfde709d8a37d716a3ae8321901ee96c98a551d0c856ab7d447c1072f85ccbbaf2e4331ecc3c1fdaadb89a99956ea14a8738bf9b8a22b3eabb9d1bbc2c014568113053ca18c4a38bd550c58b2440a4ef8b2cce852c1ef274d284101d1959ca440384b78c328faad6f45bece964cca5559854e5de84edbe4d95d0b5237e0178325dd1b7b6cff1848cd9d4f96f21cc6c21f6c1d47886c3719b531bd3b2ba0d58f94b0fc01aa3e4db85d74a56e522340d4b0a21ce9c5a5995bd316e5f9f59d2326ed2b20754a3c8ee4602371bf305e58730af84827437b0a1d8a226f7cba7a63f08367f1d0641d539703e504fcc90c87a276119fc977863e862d3042ae5ab7bb97cfff0e49f8cdcea8be0039169e156972027f76d73dc0e0e620885d39d941350db9926ee5048104c71f824a2b610f954923efe0eb7d28ed0d79b7f72922618ee43ee1cddd00aea97a86ed23fd06e657207e1ad660e63dc1c30325b1db1a2edda7c0cb18fbdb02fb6c896a5004d1893cce291fa05f90aa7b4bcc1b9085b3ac67ac925583fba7255aac0e7ba2a77729566d10b05f31d096fd93e77b973070638522165fe0a69209f9735d495839eab9132cee71f96fbeecb83d939f9818fd9bf2e8343a60575c95cac3aeb88a03d4008fc60ad2cc8703c77add0ca4dc7fad88a79544a1cfe7b497638370e56d3aa9b717a530a41083b4c561e4aab1f220d911bcc5250e144203b9fced79cdc5e39db3cfbcad1cb6d576f1fbcb5e5f53f847204d42be717361fa4b8ce73cc0a10932dde0dc08d633285dc08dba732e3e5fc2bb48cd2df0526dd9156c9455918ed84cd7bb12d006b7d79ab81d1f07f38b6cc4a22ea42e6524bf1453af3c0deb67caed08c5a73225d8258145cacfa44a617f8a9e44ebec6c419d236298262755c529dcadb110102e5f4c9dd2540665d03765678b8fe77015fcf0be2adfbae8e3d459748aa28de4e33843788121369b9e4b29cf876d536539fabc88b98a2783525e2e55c7e15c6d82885896388a9420ba1ab1e3eb93b593164e39861c10486a5c4bde9c744ac70151e95853ebb118c52e2088eb7f46bc563ca5bac1f27dcf595020544429e67d7741f7e9e79d15dff45fc7cb80c0dabcd7dd91f10205d65bfed01e94569f93583af6a8c6ecf45917099c4d5b7396de74340aa69735a157919f882b076c5a6dceeebdb9d9e417ab99c4984fd99ff87f8b01ee40a0a55960cb2f411a29723e242123953c627ff539dfc46b15411c22067f49911adca6960cea51fe75d28f2fd768cbdd47cec6106011ee1e7ef78b6b81eff1ddfb5feb475ceae389cd3e4bcebbfdf25676d33e8fedd2d0aabefe8852327348fdef035673edbaa0fb932cb30c55866315999b6703f5563313d811cacd6483b1f17e3f7df0d4891fc36181eb4a48a465e2482ed083aff7c4018ccc3211966116f2088b624d6f0e621d581b31feac353e4f9c54a77a30115ef1691df047022ab7d799447fb260b4887e639bcc1096d59fa46495c88ce2d2f0cb4fcc1d0e34d809fade5d6e4087d9fc76d6e7129b4c1f18548e5b6ca786025391a90419291f82cd030fcd93e0f515579a8bdd8d6fb51ca7c8b3c7a29124cf2a73395159cf70d2a2970736ae0cec76a06574581efcfe1f557cc968ad34408018905e389dc7ed05692e3b20d422a4c5a36cf6cbcf467e61f6b9b58617f86664ee7ef681e06a62ea5327059b26ddbbfbbe4865abf74df964a911136049214391f5027b2dbaf7f831f2b4a2bcfdff2a1cabf83db4cf8bdd74a2013e1c11c1f73a694728c91d6b21b8ca62e30649b03e98db986b0156e49f7b544f35710c83840aacad3727929f52116f290c251e31a1b363bd1fced5d1937fad40203f7d0a46817ea33047775fc629fbddddeab1d8c54d2f4c99dc3057c54639e35332491f694cf81cffc2666957a24bbe0f405dea76ef6273e5fd2e0fa686c4b4ecf76aa9b0f9751f561cae682c8cfa49c9b5cd78ed139f39079ff0ed27abc95b5de42b0713f602edc0f7eeed61321a0c040f09f4d5e0083397ca92fb86dbc323082f387fbc796df33686b43ed18040375a5aef88c385a5f89868c0049b867f9f89859060bd7056d38971de0dcd4305b3fdca06560ba5907ae4fa4d9260b40f4a8368cd6e01083b2aefc910417bcf42ad6129536ebcdab426857497d959241f4146118637831f339a96e3538957d87933429bf4fa3e24f64fd9fa33e825c52708b473290387e4c74bdeea8c4a6545712b7fae3041836654d0251b91b0043c1c340cbe7e61d0995ebc08cbfdc6c8dc38326eb57fb82ddb5a502831b1129e85e1d812b6ca9e0bd5d0cb91d634302a5e6e6e095ca9cb6e4967d8bb122d354dbc215eef8242a05bedeeef05249e35c521a6a7a8bc34a2d1006ce9d4e3833afc8986986770b680073981b147b0e3a27e53ded2e09c003d951403e9d0c3e6695b7958f40f0cec0457fe08ef49e23830d74e2d76c637827cd76de5cb2ba87ecc1d12bfcf1c9b0e56d61435eeb372b23aa7c9e23a6b679b7233b46521e6bf1f8ea36288f8237921b9c39b49aab865ef0ab3bc4b14dc7cff42334167a9468e215cfdf0f99ca39bbd489c3337716d94e22c2a1889d9b5b262531023dd04f09e7659bf1756af379170378becbd8da93276c378ce9f0f3a566ebd0abc31c9bd5fb09d421d1b7db37b4903b2ca889187cad113340daefdfd20e86c417f92f09a77b7d7bfd79e9e9d7666f05cdceca8202271e35f399a0f49916b17fd8b3a78cb357c537bff14f9d9f1dbadefd92d6cac4b4cdadd483795d8c55b2d7f69bd77be65b08a394318bbca5b45b1270a3359f67f2c02f645b312b9dc85d927e737007f4adf6feca0998b6af13ea672ea4bb6c31a95e00e272ec3ce269fe446ee57cda9466e49167aecea59a3e757fb91a7abb8aafde11ef3a9d3531301e54f6983e213887a7a81334bd49a6cddbcb28a24e12b149bfe9ff3b4f766a9f1c8ee2cbe1c6bbb3752e029630d428320735b4b5eccce00efe22901b4b7d88af02d12401332f2311bdff7880fd510c08df1cc4e46c8ad10e90875cb406e19a8657728b90a528bcbb2f6d85b0663612634604118bb61eb16b22d2d20f31e3cddc7fa56b1bd11b3c1e2861f7b6d96cdc8034ba15c474344c90c452fb43183bf59a9f9794a39459e6d5deb60cf105a4ca35356f350354f5de2a5eae897a112187426b3fa8ee2ee7c23a469cf27a492a4fc8cd1c706d63c250d70a481834842479f941fb6dfc4109a4645826994cf863474b6971dc8af9f7e9ce8ecace54ddd8669d17c7bff8b786f9f14496a67e7a8e04f1759e34848ddd45bb941c8beba020c2ce9b51aa8554089a9e0a9015fc2d19274f0d7dd140b618f2de5df2cc263ce64de055437c07d358bed9f9354a209e820fa44c3b86bfadba8d13bcf8c42acec521002b13323e79d46de7de7097f67e409d6e0f1ba503a77e77de7dd1f5224cc15d37944942e1dac005170713473d03aafad0553d7043f56543a856b54be7aa7ed2c750df7d315f4a2f5565e524b31e4fef85d6cc3f1ebb1106f7081e90fbd1d8b350fa4d68640cfc705ca6", 0x1000, 0x6}, {&(0x7f0000001640)="f747390e7371310fe0703a35936fe3410047a6d018f9161a160fca3a68d2234134d83f8d44c605be72122caa12aa85b8fa22600cb305e053f27223fb5a11828dc1af886af5981f79ba21a9f1d7aa17566284f411a58c818b3cba5e2523a15034ac35c9f566f186b2f89eed0301390f8325937c634e1b4b7ed670c4a19bccd624c35f0e5ef7c25e", 0x87, 0x80000001}, {&(0x7f0000001700)="b32ef942d4c4e1e54135bccf2c81737492fccc54b681512a1d2cd1deace76de9dfb9fdf1e687c96231ed0d806725f775f4646d49fe2faebbcf0439972f92ba8c5afda17a3fa473197600a7cf364939b687b2e314c4e9bb3158c0ddc19a2b95b9d547f8625de54677cd36648ecef732e33bf9550bd81f83bd68922e786c5a5732c6069db354df8ead50384268f00eff4b6375ba5d6a444d46a6de690a0d52a3c8bee1cb6de2229dacdb9c291e1eafb774baee69586361a8e40bb2a0fc9e0d7b99c4f801587699dd5a59c05613243b02", 0xcf, 0x759}, {&(0x7f0000001800)="589584d293a9471b4975a7a3c5376f96eb0a1f373afb64815bed976f065d46051a0da13e187f7332733c8a1f06167dbc4f4c329167e97659c128cc2dc761a227a1d55147bacda135422d4e76da0a8aebc828bde6dad9019438ec37cf329d9fbc418fdfd9a6a40c445549a8ea51d2876c94c83984b7cd15c930a6382839ec5e012c32f96bf9040e5bb6b3c516533dbe2918363175b8186b3228e4629d650463be564a0759b11ab88f1bd04397edb3e088d46fa676b56f0452031c440ef74945d255a6ed8e4f9b8dd212b454378eca8e7d9c0bc48dbe2ba1924e94ae0b8b", 0xdd, 0x7}, {&(0x7f0000001900)="b91af0876ac5b53bd2bc6f5d1941b10ec96f02f703900c3110cbe7caed3bcafa8ca6931e43fa27cb4e0d5b8a82f36760be3b66cd884f22b535e78c3d2e09fd37c94ae4801d7b7e4da3230c3e9af78c309c982a0100f323c4f5159f35f77771f624691101cdbb451cddd254e22d635b34776a5c1dd5e278f644ddcc913ce46716c0e714e984bacb689b1d4ee81e93b1538075737b3008b55806e113308f097fb0a86d0c9dc8f72ae90cec1bd29f37e90226ed6d79a15883087b97", 0xba, 0x1ff}], 0x800080, &(0x7f00000002c0)={[{@shortname_lower='shortname=lower'}, {@uni_xlate='uni_xlate=1'}, {@shortname_lower='shortname=lower'}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:51 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r0, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e20, 0x7fff, @local, 0x7}}}, 0x32) ioctl$PPPIOCSMRU(r0, 0x40047452, &(0x7f0000000240)) 13:54:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000100)={0x1, 0x0, 0x12, &(0x7f0000000040)="cf6b16fb7b6b0bfc24a2be44700c7264de3d"}) sendmsg$nl_generic(r0, &(0x7f0000001fc0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[]}, 0x1, 0x0, 0x0, 0x1}, 0x8000) 13:54:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000240)='/dev/sg#\x00', 0x3f, 0x8041) fcntl$setpipe(r0, 0x407, 0x2) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x18a) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$packet_int(r1, 0x107, 0x13, &(0x7f00000001c0), 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000788000)=0x2, 0x4) rt_sigprocmask(0x1, &(0x7f00000002c0)={0x41b}, &(0x7f0000000300), 0x8) ioctl$TCSBRKP(r1, 0x5425, 0x80) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, 0xffffffffffffffff) syz_emit_ethernet(0x423, &(0x7f0000000cc0)={@link_local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f000029b000), 0x0, 0x0, &(0x7f0000778000)={0x2, 0x1}, 0x10) poll(&(0x7f0000000040)=[{r3}], 0x1, 0x1) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0x0, 0x3, 0x9, 0x2}, 0xbc, 0x6}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000080)={{0x80}, 'port1\x00'}) close(r4) 13:54:51 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x65, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) getpid() epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) ioctl$TIOCNOTTY(0xffffffffffffffff, 0x5422) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000140)={'veth0_to_bond\x00', {0x2, 0x4e21, @rand_addr=0x1}}) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) symlink(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000180)='./file0\x00') shutdown(r0, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x12800, 0x0) symlink(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)='./file0\x00') recvmsg(0xffffffffffffffff, &(0x7f0000003b40)={&(0x7f0000002900)=@xdp, 0x80, &(0x7f00000013c0), 0x0, &(0x7f0000003a80)=""/155, 0x9b}, 0x0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000002780)={'nat\x00', 0x0, 0x0, 0x1f, [], 0x0, &(0x7f00000001c0), &(0x7f0000002740)=""/31}, &(0x7f0000002800)=0x78) setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000001300)={0xfffffffffffffffe, {{0x2, 0xfffffffffffffffc, @local}}}, 0xffffffffffffff4b) 13:54:51 executing program 5: r0 = socket(0x10, 0x2, 0xc) write(r0, &(0x7f0000594000)="1f0000000102ff05fd4354c007f37ffff20501000800010004000100ffdf00", 0x1f) fcntl$setpipe(r0, 0x407, 0x5) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x800, 0x0) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000040)) r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000100)={0x0, @empty, @rand_addr}, &(0x7f0000000140)=0xc) getsockname(r0, &(0x7f0000000180)=@can={0x1d, 0x0}, &(0x7f0000000200)=0x80) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000440)={0x57, 0x4, 0x3000000000, {0x1, 0x9}, {0x6, 0x100000000}, @cond=[{0x7, 0x18b6, 0xde33, 0x100, 0x7f, 0x7fffffff}, {0x8, 0x8001, 0x2, 0x0, 0x3, 0x7ff}]}) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast1, 0x0}, &(0x7f0000000280)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000002c0)={0x0, @remote, @dev}, &(0x7f0000000300)=0xc) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000340)={@local, @dev, 0x0}, &(0x7f0000000380)=0xc) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000003c0)={0x0, @multicast2}, &(0x7f0000000400)=0xc) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000480)={@multicast1, @local, 0x0}, &(0x7f00000004c0)=0xc) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in6=@remote}}, &(0x7f00000006c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000700)={{{@in6=@loopback, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000800)=0xe8) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000840)={0x0, @local, @rand_addr}, &(0x7f0000000880)=0xc) accept4$packet(r1, &(0x7f00000008c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000900)=0x14, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000940)={@remote, 0x0}, &(0x7f0000000980)=0x14) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f00000009c0)={@local, @multicast1, 0x0}, &(0x7f0000000a00)=0xc) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000e40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000e00)={&(0x7f0000000a40)={0x3b4, r2, 0x2, 0x70bd2b, 0x25dfdbff, {}, [{{0x8, 0x1, r3}, {0xb8, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}]}}, {{0x8, 0x1, r7}, {0x1c4, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0xd13}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x20d3}}, {0x8, 0x6, r9}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7b}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x44, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}]}}, {{0x8, 0x1, r14}, {0xc0, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8001}}, {0x8, 0x6, r15}}}, {0x7c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x4c, 0x4, [{0x6, 0x3ff, 0x9, 0x101}, {0xfffffffffffffff9, 0x2, 0x7480, 0xb93a}, {0x100, 0xe36, 0x7, 0x3ff}, {0x1, 0x5, 0x8, 0xb825}, {0x8000, 0x80000000, 0x0, 0x8}, {0x6, 0x3, 0xfff, 0x9}, {0x4, 0x1, 0x59f5, 0x5}, {0x1000, 0x0, 0x52f, 0x2}, {0x800, 0x8a5, 0x4, 0x800}]}}}]}}]}, 0x3b4}, 0x1, 0x0, 0x0, 0x800}, 0x0) 13:54:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socket$inet6(0xa, 0x1000000000002, 0x20000000000000) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$l2tp(r2, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000000)=@fragment={0x0, 0x0, 0x800, 0xda0, 0x0, 0x8f8, 0x67}, 0x8) sendmmsg(r2, &(0x7f0000005fc0)=[{{&(0x7f0000005680)=@sco, 0x80, &(0x7f0000005b00)}}, {{&(0x7f0000005b80)=@l2, 0x80, &(0x7f0000005c40), 0x1f4, &(0x7f0000005c80), 0x3a00}}], 0x3e8, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_user(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/user\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x9, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0e630c40000000002a"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f000000cf68)=[@enter_looper], 0x0, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x1, 0x0, &(0x7f00000001c0)="10"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000000)=[@dead_binder_done], 0x0, 0x0, &(0x7f0000000100)}) 13:54:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000240)='/dev/sg#\x00', 0x3f, 0x8041) fcntl$setpipe(r0, 0x407, 0x2) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x18a) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$packet_int(r1, 0x107, 0x13, &(0x7f00000001c0), 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000788000)=0x2, 0x4) rt_sigprocmask(0x1, &(0x7f00000002c0)={0x41b}, &(0x7f0000000300), 0x8) ioctl$TCSBRKP(r1, 0x5425, 0x80) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, 0xffffffffffffffff) syz_emit_ethernet(0x423, &(0x7f0000000cc0)={@link_local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f000029b000), 0x0, 0x0, &(0x7f0000778000)={0x2, 0x1}, 0x10) poll(&(0x7f0000000040)=[{r3}], 0x1, 0x1) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0x0, 0x3, 0x9, 0x2}, 0xbc, 0x6}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000080)={{0x80}, 'port1\x00'}) close(r4) 13:54:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="ef"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11639a1a0182b9b58435935aa131615c726d11de2e8b6a1b909757843919ca331b567901593b0ce5d6b005ccf04a4c9888ceaa14c3c6f9f57b3a8ef2f98eb7cd841b5f6b0be1f13a3a7e513b313bc3e82dc821b177674b891bbc7c4c637c47039e50bc4c954472513b6ff86453022b34ef6cffe9a5ef6d92d45f1c5fd080dc3b101792e3665ef0c357b16e8f4273748930bdf38ea2bccfa6f9e2862290300412d0efb75dba3a3723f408e6c4eba7248a3d72148bede5f69c736b144e080277c692bda31e392c0587ccd071106c8feecc686f27e6e508c84a0c1c55df73141d6eee857723860d5b3ce45b0f54906d4ce26124a393a7b2aec7d2c8023553e5e0ea271838da4f3bb7d0352ce9c1120b82862879f0370ded130021d73d3c26e93199b2717c2018261b368b28ddfe84ec3546016c1ff048b7932063e632fb5a61f8d1a11853d32b05462259e03459b2592bae7eaf0608bc8947d9dcbd24a324a7682eee3ac78a08bf0349b97a6d797fcde9353d6910c3bff55e7b37fe4b8e5cd0889701e999123187e9fe515747f2d360792994b121a40da02a0550bda6cea9009b1a11648534c6ead6af185e75971bd3b703a0e27505a0be1257cfe2"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:51 executing program 7: r0 = socket(0x10, 0x4000000000000002, 0xc) write(r0, &(0x7f0000594000)="1f0000000104ff00fd4354c007110000f305010008000100010423dcffdf00", 0x1f) sendfile(r0, r0, &(0x7f0000000000), 0x2) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write(r0, &(0x7f0000000240)="1f0000000104fffffd3b54c007110000f30501000b000500000010d10600cf", 0x1f) [ 368.636508] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. [ 368.672177] netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. 13:54:51 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rfkill\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_SET_TIME(0xffffffffffffffff, 0x4024700a, &(0x7f0000000140)={0x17, 0x21, 0x9, 0x1e, 0x5, 0x5, 0x5, 0x48, 0x1}) r1 = socket$key(0xf, 0x3, 0x2) getgid() ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000240)={0x1000, ""/4096}) sendmsg$key(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000100)=ANY=[@ANYBLOB="020700b50200000000000000000000726d14ed6ea578283efeb1034d25f16a41e8852301af4e1b5d8fbd10e800000000000000000000"], 0x10}}, 0x0) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f00000000c0)) r2 = epoll_create(0xbc45) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000180)={0x2000}) [ 368.712981] binder: 25197:25214 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 368.765618] binder: BINDER_SET_CONTEXT_MGR already set [ 368.776925] binder: 25211:25218 ioctl 40046207 0 returned -16 [ 368.796204] binder_alloc: 25197: binder_alloc_buf, no vma [ 368.814120] binder: 25211:25218 transaction failed 29189/-3, size 24-8 line 3136 [ 368.830870] binder: 25211:25218 ERROR: BC_REGISTER_LOOPER called without request [ 368.831571] netlink: 3 bytes leftover after parsing attributes in process `syz-executor7'. [ 368.851563] netlink: 3 bytes leftover after parsing attributes in process `syz-executor7'. [ 368.883891] binder: 25211:25224 unknown command 446325521 [ 368.896838] binder: 25211:25224 ioctl c0306201 20000080 returned -22 13:54:52 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) recvmmsg(r0, &(0x7f000000ac80)=[{{&(0x7f0000008000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000009440)=[{&(0x7f0000008140)=""/215, 0xd7}], 0x1, &(0x7f00000094c0)=""/87, 0x57}, 0x5}, {{&(0x7f000000a9c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f000000ac40)}}], 0x2, 0x0, &(0x7f000000ad80)={0x0, 0x1c9c380}) r1 = memfd_create(&(0x7f00000000c0)='.*ppp1:keyring:\x00', 0x3) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000f6bfe8)) fcntl$getownex(r1, 0x10, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000404000/0x600000)=nil, 0x600000}}) 13:54:52 executing program 6: socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x1, 0x0) ioctl$TIOCLINUX7(0xffffffffffffffff, 0x541c, &(0x7f0000000040)={0x7, 0x2}) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) close(r0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) r2 = userfaultfd(0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x5) ioctl$VT_DISALLOCATE(r1, 0x5608) r3 = gettid() r4 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000180)='/dev/keychord\x00', 0x0, 0x0) timer_create(0x0, &(0x7f0000000040)={0x0, 0x12}, &(0x7f0000044000)=0x0) timer_settime(r5, 0x1, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x989680}}, &(0x7f0000000140)) readv(r4, &(0x7f0000002440)=[{&(0x7f0000002380)=""/141, 0x8d}], 0x1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x32, 0xffffffffffffffff, 0x0) setsockopt$packet_int(r2, 0x107, 0x1f, &(0x7f00000000c0)=0x800, 0x4) tkill(r3, 0x1000000000015) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000180)=""/53, &(0x7f00000001c0)=0x35) ioperm(0x4, 0x1, 0x1ff) munlockall() 13:54:52 executing program 7: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)={0xa0000007}) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000180)) r2 = gettid() fcntl$setown(r0, 0x8, r2) 13:54:52 executing program 1: openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f00000005c0), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000140)={0xffffffffffffffff}) syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x8, 0x1) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000001c0)=0x14) close(0xffffffffffffffff) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) 13:54:52 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/full\x00', 0x40002, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000400)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000680)=0x0) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f00000006c0)={0x0, 0x0, 0x4b2d}) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000780)='/dev/ppp\x00', 0x817e033ca4d67b0e, 0x0) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000840)={0x2d40000000000, 0x1, 0x8001, 0x25e, 0x10000, 0x8, 0x4, 0x6c, 0x7, 0x6, 0x4, 0xf3}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x601, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x6f, &(0x7f0000000180)=0x1, 0x4) prctl$setfpexc(0xc, 0x100000) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x2, 0xfffffffffffffffe, @ipv4={[], [], @local}}, 0x1c) write$FUSE_NOTIFY_POLL(r3, &(0x7f00000007c0)={0x18, 0x1, 0x0, {0x8000000000005}}, 0xfffffffffffffd9f) ioctl$RTC_WKALM_RD(r3, 0x80287010, &(0x7f0000000800)) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000080)={@mcast2, 0x0, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) r4 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ashmem\x00', 0x8000, 0x0) fcntl$setstatus(r2, 0x4, 0x44801) ioctl(r2, 0x1, &(0x7f0000000880)="8cc93c007d676717f13ed30fcc25128b46d7e82669948f588cea661694cda40810892ad0d995f697a2e99a202cbe207472aae583748c988dc2003454482dd87bae7549edba5eecd9d3ce853952e768d870c826b70ece2e855e9d3e4277d87e03985d823c55adcdba972620232b6a5e503889f5cc926df6581d580787d189b731d2572c8bd2021c61d09344949f85d693aab8f043b69f88097a8a9360925d08c67b4502cf73f9636d4fc6f75fa8f2f644a1d81cddca21390398d4d4a0800a941829e4c01d8eaa7848e48fa9f54050bf324b7e1ceb26ed9f7d1774d7378a95") getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000700)={@rand_addr, @remote}, &(0x7f0000000640)=0xc) setsockopt$inet6_buf(r2, 0x29, 0x0, &(0x7f0000000980)="d3955488347fec4aeab9c3b3f7927403356e70b726103f7e4abcd7e46ce093c18dff54ce9703af22bab97eeaec801f5a27ed1dbe06416b2a7903b89ba83a8e5a6a4150256d8103697e3ab8ad6950064d0aa7505810c56fed671f64a831b148b232d3ed1e65a0fc08500e435a38af22629d29fe59cb7446691a803473bafa0d98fb8cba94674c8f9dbeeb72e99b1d316d0ff13a3acfad68ce3baa5848450a37c1716e26f4ffbfe6829400bf80be6b0c74e796a15a2c469e7ae85adc50d5cab0ba20853d632c", 0xc5) ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000300)=0x1) stat(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)) write$P9_RUNLINKAT(r4, &(0x7f0000000440)={0x7, 0x4d, 0x1}, 0x7) r5 = syz_open_procfs(r1, &(0x7f0000000200)="6e65742f6970365f666c6f776c6162656c006ec03114893458edc1c9d8dc4b0d8dae982640d0e60400d7ff596e1c92de0eaa311f0a4d43697c2bcd77f017365af160acf33bd66432ebe50c0e8bdaf7fc39feff34ef27a1397193227f4733c145e66536c6c275112520e72b3097843b5cdac480c3b1384ebf592505f88589fcd2d7000000") perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0)}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup2(r4, r2) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f0000000740)) sendfile(r5, r5, &(0x7f00000002c0)=0x202, 0xd9) [ 369.214720] binder: BINDER_SET_CONTEXT_MGR already set [ 369.224015] binder: 25197:25231 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 369.232115] binder: 25197:25231 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 369.239822] binder: 25197:25204 ioctl 40046207 0 returned -16 13:54:52 executing program 5: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000200)="0a5cc80700315f85715070") ioctl(r0, 0x800000000000937e, &(0x7f0000000080)="01000000000000001804000007ff01000000000000d849832f") 13:54:52 executing program 4: r0 = socket$inet6(0xa, 0x4, 0x1ff) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x177, 0x4) sendto$inet6(r0, &(0x7f0000e13f4e), 0x0, 0x0, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) recvmmsg(r0, &(0x7f0000000680)=[{{0x0, 0x0, &(0x7f0000000040)}}, {{&(0x7f00000006c0)=@rc, 0x80, &(0x7f0000000540), 0x268, &(0x7f0000000580)=""/206, 0xce}}], 0x2, 0x203f, 0x0) getsockname(r0, &(0x7f0000000040)=@generic, &(0x7f00000000c0)=0x80) mount$9p_xen(&(0x7f0000000100)='trusted:userwlan1vboxnet0wlan0\x00', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='9p\x00', 0x1000, &(0x7f0000000200)={'trans=xen,', {[{@version_9p2000='version=9p2000'}, {@debug={'debug', 0x3d, 0xabdd}}, {@noextend='noextend'}, {@cache_fscache='cache=fscache'}, {@access_user='access=user'}]}}) 13:54:52 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) sched_rr_get_interval(r0, &(0x7f0000000080)) r1 = socket(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendto$inet6(r1, &(0x7f0000000080), 0x0, 0x8081, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000280), 0xf401, 0x0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback={0x0, 0x8}}, 0x1c) 13:54:52 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0x0, 0x0, &(0x7f0000edfff0)={0x77359400}, &(0x7f0000001ac0), 0x0) futex(&(0x7f000000cffc), 0x5, 0x2, &(0x7f00000000c0)={0x0, 0x989680}, &(0x7f0000000140), 0xc0000000) ioctl$FICLONE(r1, 0x40049409, r0) r2 = getpid() fcntl$setownex(r0, 0xf, &(0x7f0000000040)={0x1, r2}) 13:54:52 executing program 4: r0 = gettid() perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) r1 = eventfd(0x0) ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000240)) write$P9_RUNLINKAT(0xffffffffffffffff, &(0x7f0000000100)={0x7}, 0x7) r2 = dup3(r1, r1, 0x80000) ioctl$sock_inet_udp_SIOCOUTQ(r2, 0x5411, &(0x7f00000000c0)) getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='pagemap\x00') timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r3, &(0x7f0000000000), 0x1000000008) tkill(r0, 0x15) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000280)={0x0, 0x7ff, 0xc30e}) 13:54:52 executing program 1: r0 = add_key$keyring(&(0x7f0000000780)='keyring\x00', &(0x7f00000007c0), 0x0, 0x0, 0xfffffffffffffffd) keyctl$describe(0x6, 0x0, &(0x7f0000000800), 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) keyctl$unlink(0x9, r0, r0) r1 = creat(&(0x7f00000000c0)='./file0/file0\x00', 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r1, 0x1, 0x0, 0x8) ioctl$FUSE_DEV_IOC_CLONE(0xffffffffffffffff, 0x8004e500, &(0x7f0000000140)=r1) 13:54:52 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000001fe8)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = memfd_create(&(0x7f0000000040)='cgroup2\x00', 0x0) pwritev(r1, &(0x7f0000000000)=[{&(0x7f0000012000)="ca", 0x1}], 0x1, 0x0) lseek(r1, 0xfffffffffffffffe, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) 13:54:52 executing program 5: sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) r0 = perf_event_open(&(0x7f0000000040)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa38, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rfkill\x00', 0x40000, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000300)={0x3ff, 0x3f, 0x2, 'queue0\x00', 0xfff}) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f00000000c0)=""/8, &(0x7f0000000180)=0x8) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f00000001c0)={'syz_tun\x00', {0x2, 0x4e21, @multicast1}}) r3 = dup3(r0, r0, 0x80000) ioctl$BLKGETSIZE(r3, 0x1260, &(0x7f0000000280)) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000240)=0x14) 13:54:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:52 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) recvmmsg(r0, &(0x7f000000ac80)=[{{&(0x7f0000008000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000009440)=[{&(0x7f0000008140)=""/215, 0xd7}], 0x1, &(0x7f00000094c0)=""/87, 0x57}, 0x5}, {{&(0x7f000000a9c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f000000ac40)}}], 0x2, 0x0, &(0x7f000000ad80)={0x0, 0x1c9c380}) r1 = memfd_create(&(0x7f00000000c0)='.*ppp1:keyring:\x00', 0x3) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000f6bfe8)) fcntl$getownex(r1, 0x10, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000404000/0x600000)=nil, 0x600000}}) [ 369.552224] binder: 25211:25275 ERROR: BC_REGISTER_LOOPER called without request [ 369.569361] binder: release 25211:25224 transaction 436 out, still active [ 369.584434] binder: unexpected work type, 4, not freed 13:54:52 executing program 7: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000040)={0x20, 0x0, 0x3, {0x2, 0x0, 0x9}}, 0x20) syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x8000) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f00000005c0)) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) ioctl$fiemap(r1, 0x40086602, &(0x7f0000000140)=ANY=[]) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$binfmt_elf64(r1, &(0x7f0000000080)=ANY=[], 0xff01) r3 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000580)='/dev/pktcdvd/control\x00', 0x40000, 0x0) recvfrom(r2, &(0x7f0000000400)=""/241, 0xf1, 0x1, &(0x7f0000000240)=@sco={0x1f, {0x2, 0x0, 0xfffffffffffffffe, 0x7f, 0x7}}, 0x80) r4 = fcntl$getown(r3, 0x9) fstat(r0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000200)={r4, r5, r6}, 0xc) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000300)=0x0) perf_event_open(&(0x7f0000000500)={0x1, 0x70, 0x5, 0x7, 0x7, 0x7f, 0x0, 0x140, 0x1, 0x0, 0x9, 0x5, 0x3, 0x2, 0x5, 0x4, 0xff, 0x6, 0x4, 0x6, 0x5, 0x7707, 0x7fffffff, 0x7fff, 0xaa, 0x9, 0x95b, 0xcc, 0x1, 0x2, 0x7f, 0x81, 0x81, 0x2, 0x5148, 0x51c55347, 0xcd92, 0x4, 0x0, 0x5, 0x0, @perf_bp={&(0x7f0000000180), 0x4}, 0x1000, 0x1000, 0x10001, 0x7, 0x10001, 0x100000000, 0xc9c}, r7, 0x0, r0, 0x3) fcntl$setstatus(r2, 0x4, 0x4000) write$selinux_access(r2, &(0x7f0000000000)={'system_u:object_r:etc_t:s0', 0x20, '/usr/sbin/ntpd'}, 0xffffffd9) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="619fb17934b86908de005083cc6d48e345dee7aad39ced304bbf22a09c23c42ebb649faf0dd9ca00bdeda7cf3cd6d78acb1a4ad252d5090ce0c5a3836f8ffa4b114022e0605236620c5180743e1f076560e2a0165005150a3b6c4fe2452e558efadca311baa1eb3a49dd656bd09868228955f585476dfb8b9514d8fed96ab207fb3def99679ca8effae41bc6e14cf16f2e73"], 0x92) ptrace$peekuser(0x3, 0x0, 0x0) 13:54:52 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000480)="636c6561725f7265667300250d9888ebb88d0f3d45d8000000000000000147138dafbdf4b8cffb4462802699d423796badc105676384e8be07e5cc03000000934984844b574c16025c9f80f90936ffa5ab43accaa6fab334bf5645c42aea1c798c4d1d7474701a36d0f7ec6eb1a2a605000000329b4e6c3f8f9d5082b96cfad4ad0f152beb66db8cd2cd3561108bc2628b4ebe053b4629439855a363d3fffeffff06cbccfb4e3997cc2ac6ae2d7bb820123b0000000000000000000000000000066132445dde9eab8e0f908cd56d74d9814a31c64d9b9f9ad74e1cd6cc1ad009642c50ab40b0f0f65e281a8e609381b90000000000009e9d47a03eacf9f06fef20da3be8dd766615ff3e000000000000000000000000") r1 = syz_open_procfs(0x0, &(0x7f0000000440)='sessionid\x00') ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f00000005c0)=""/4096) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendfile(r0, r1, &(0x7f00000000c0), 0x1) [ 369.598734] binder: undelivered TRANSACTION_COMPLETE [ 369.604129] binder: release 25211:25275 transaction 436 in, still active [ 369.623815] binder: send failed reply for transaction 436, target dead [ 369.640697] binder: undelivered TRANSACTION_ERROR: 29189 [ 369.731844] binder: 25289:25293 ERROR: BC_REGISTER_LOOPER called without request [ 369.740140] binder_alloc: 25289: binder_alloc_buf, no vma [ 369.753104] binder: 25289:25293 transaction failed 29189/-3, size 0-0 line 3136 [ 369.764786] binder: BINDER_SET_CONTEXT_MGR already set [ 369.770099] binder: 25289:25296 ioctl 40046207 0 returned -16 [ 369.776601] binder_alloc: 25289: binder_alloc_buf, no vma [ 369.782275] binder: 25289:25296 transaction failed 29189/-3, size 24-8 line 3136 [ 369.794705] binder: 25289:25293 ERROR: BC_REGISTER_LOOPER called without request [ 369.803264] binder: 25289:25296 got transaction to invalid handle [ 369.809988] binder: 25289:25296 transaction failed 29201/-22, size 0-0 line 3013 [ 369.821308] binder: undelivered TRANSACTION_ERROR: 29189 [ 369.827118] binder: release 25289:25293 transaction 440 in, still active [ 369.860470] binder: send failed reply for transaction 440 to 25289:25293 [ 369.870021] binder: undelivered TRANSACTION_ERROR: 29189 [ 369.888169] binder: undelivered TRANSACTION_ERROR: 29201 [ 369.893974] binder: undelivered TRANSACTION_COMPLETE [ 369.901160] binder: undelivered TRANSACTION_ERROR: 29189 13:54:53 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:53 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x4) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0xc000, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000100)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) unlinkat(r1, &(0x7f0000000180)='./file0\x00', 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000000)={[], 0x0, 0x9, 0x8001}) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 13:54:53 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) recvfrom$inet6(r0, &(0x7f0000000340)=""/185, 0xb9, 0x40, 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) r2 = dup2(r1, r1) socket(0x3, 0x0, 0xff) r3 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0), 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000200)='logon\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, r3) write$FUSE_NOTIFY_POLL(r2, &(0x7f0000000040)={0x18, 0x1, 0x0, {0xfffffffffffffffb}}, 0x18) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) r4 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000200), 0x0, 0xfffffffffffffff9) keyctl$set_timeout(0xf, r4, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, &(0x7f000000a000)) r5 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) pwritev(r5, &(0x7f0000001400), 0x100000000000013a, 0x0) fcntl$lock(r5, 0x7, &(0x7f0000027000)={0x1}) ftruncate(r5, 0x0) 13:54:53 executing program 3: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x1}, 0x10) sendto$inet(r0, &(0x7f000029b000), 0x287, 0x0, &(0x7f0000778000)={0x2, 0x1, @loopback}, 0x10) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/11, 0xb}, 0x10042) process_vm_writev(0x0, &(0x7f0000000000), 0x0, &(0x7f0000121000), 0x0, 0x0) 13:54:53 executing program 5: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x404) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fdatasync(0xffffffffffffffff) recvfrom$inet(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x40000001, 0x0, 0x0) write$P9_RAUTH(r1, &(0x7f0000000200)={0x14, 0x67, 0x0, {0x0, 0x0, 0x6}}, 0x14) dup2(r1, r0) write$binfmt_aout(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="0000000000010000760000009000000000000000000000ef06000000000000004e2311b580099e02bf40e2ce65d65659c2ee55e3581135e7a9ddda660a"], 0x3d) write$cgroup_type(r0, &(0x7f0000000140)='threaded\x00', 0x9) sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe) ioctl$KDMKTONE(r1, 0x4b30, 0x10001) sendfile(r1, r0, &(0x7f0000001340), 0x100000001) 13:54:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000005500)='/dev/ptmx\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)) close(r1) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$BLKGETSIZE(r2, 0x1260, &(0x7f0000000040)) 13:54:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x2000, 0x0) epoll_wait(r2, &(0x7f0000000180)=[{}, {}, {}, {}, {}], 0x5, 0x4) 13:54:53 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x200000, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000080)={'filter\x00', 0x32, "b6dd460bb272bb972788608ca208af37c6cf1ade3eaf9a4c99d13fbff61120c14633af50f5a3a2fb0f7b1a1e7d702f4b97ef"}, &(0x7f0000000100)=0x56) r2 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r2, 0x0, 0xcf, &(0x7f0000000000), 0x4) 13:54:53 executing program 3: socket$inet(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') fcntl$notify(r1, 0x402, 0x2) getdents(r1, &(0x7f0000002b80)=""/202, 0xec) times(&(0x7f0000000040)) [ 370.201226] binder: 25310:25318 ERROR: BC_REGISTER_LOOPER called without request [ 370.209758] binder_alloc: 25310: binder_alloc_buf, no vma [ 370.215923] binder: 25310:25318 transaction failed 29189/-3, size 0-0 line 3136 [ 370.225591] binder: BINDER_SET_CONTEXT_MGR already set [ 370.232267] binder: 25310:25321 ioctl 40046207 0 returned -16 [ 370.239162] binder_alloc: 25310: binder_alloc_buf, no vma 13:54:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000140)=0x2) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000280), 0xfffffffffffffedd, 0x2000012c, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000]}}, 0x1c) close(r0) [ 370.245052] binder: 25310:25318 transaction failed 29189/-3, size 24-8 line 3136 [ 370.254020] binder: 25310:25321 ERROR: BC_REGISTER_LOOPER called without request [ 370.285613] binder: release 25310:25318 transaction 447 in, still active 13:54:53 executing program 7: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000040)={0x20, 0x0, 0x3, {0x2, 0x0, 0x9}}, 0x20) syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x8000) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f00000005c0)) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) ioctl$fiemap(r1, 0x40086602, &(0x7f0000000140)=ANY=[]) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$binfmt_elf64(r1, &(0x7f0000000080)=ANY=[], 0xff01) r3 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000580)='/dev/pktcdvd/control\x00', 0x40000, 0x0) recvfrom(r2, &(0x7f0000000400)=""/241, 0xf1, 0x1, &(0x7f0000000240)=@sco={0x1f, {0x2, 0x0, 0xfffffffffffffffe, 0x7f, 0x7}}, 0x80) r4 = fcntl$getown(r3, 0x9) fstat(r0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000200)={r4, r5, r6}, 0xc) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000300)=0x0) perf_event_open(&(0x7f0000000500)={0x1, 0x70, 0x5, 0x7, 0x7, 0x7f, 0x0, 0x140, 0x1, 0x0, 0x9, 0x5, 0x3, 0x2, 0x5, 0x4, 0xff, 0x6, 0x4, 0x6, 0x5, 0x7707, 0x7fffffff, 0x7fff, 0xaa, 0x9, 0x95b, 0xcc, 0x1, 0x2, 0x7f, 0x81, 0x81, 0x2, 0x5148, 0x51c55347, 0xcd92, 0x4, 0x0, 0x5, 0x0, @perf_bp={&(0x7f0000000180), 0x4}, 0x1000, 0x1000, 0x10001, 0x7, 0x10001, 0x100000000, 0xc9c}, r7, 0x0, r0, 0x3) fcntl$setstatus(r2, 0x4, 0x4000) write$selinux_access(r2, &(0x7f0000000000)={'system_u:object_r:etc_t:s0', 0x20, '/usr/sbin/ntpd'}, 0xffffffd9) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="619fb17934b86908de005083cc6d48e345dee7aad39ced304bbf22a09c23c42ebb649faf0dd9ca00bdeda7cf3cd6d78acb1a4ad252d5090ce0c5a3836f8ffa4b114022e0605236620c5180743e1f076560e2a0165005150a3b6c4fe2452e558efadca311baa1eb3a49dd656bd09868228955f585476dfb8b9514d8fed96ab207fb3def99679ca8effae41bc6e14cf16f2e73"], 0x92) ptrace$peekuser(0x3, 0x0, 0x0) 13:54:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b630036fc0815b70a84a2857f294bc3162316ed4c8d02e6710d01001ac4d039b15caad34d2892a125d584be0660228193b1f5a0b67406b28b9df4d28c0168bb8df21ca27b0d1f801591b8475c79a4e21a98168782d345a094d547ea8f7875f59970fa2b6c814ae317"], 0x1, 0x0, &(0x7f0000000140)="06"}) r2 = fcntl$dupfd(r1, 0x406, r1) ioctl$GIO_FONTX(r2, 0x4b6b, &(0x7f0000000480)=""/211) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000580)={{{@in6=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000280)=0xe8) stat(&(0x7f00000002c0)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='fuse\x00', 0x1040, &(0x7f0000000680)={{'fd', 0x3d, r2}, 0x2c, {'rootmode'}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions='default_permissions'}, {@blksize={'blksize', 0x3d, 0x800}}]}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 370.285621] binder: send failed reply for transaction 447 to 25310:25318 [ 370.285631] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.285735] binder: undelivered TRANSACTION_COMPLETE [ 370.285741] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.329975] binder: undelivered TRANSACTION_ERROR: 29189 13:54:53 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) recvfrom$inet6(r0, &(0x7f0000000340)=""/185, 0xb9, 0x40, 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) r2 = dup2(r1, r1) socket(0x3, 0x0, 0xff) r3 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0), 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000200)='logon\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, r3) write$FUSE_NOTIFY_POLL(r2, &(0x7f0000000040)={0x18, 0x1, 0x0, {0xfffffffffffffffb}}, 0x18) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) r4 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000200), 0x0, 0xfffffffffffffff9) keyctl$set_timeout(0xf, r4, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, &(0x7f000000a000)) r5 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) pwritev(r5, &(0x7f0000001400), 0x100000000000013a, 0x0) fcntl$lock(r5, 0x7, &(0x7f0000027000)={0x1}) ftruncate(r5, 0x0) 13:54:53 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) recvfrom$inet6(r0, &(0x7f0000000340)=""/185, 0xb9, 0x40, 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) r2 = dup2(r1, r1) socket(0x3, 0x0, 0xff) r3 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0), 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000200)='logon\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, r3) write$FUSE_NOTIFY_POLL(r2, &(0x7f0000000040)={0x18, 0x1, 0x0, {0xfffffffffffffffb}}, 0x18) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) r4 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000200), 0x0, 0xfffffffffffffff9) keyctl$set_timeout(0xf, r4, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, &(0x7f000000a000)) r5 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) pwritev(r5, &(0x7f0000001400), 0x100000000000013a, 0x0) fcntl$lock(r5, 0x7, &(0x7f0000027000)={0x1}) ftruncate(r5, 0x0) [ 370.445571] binder: 25329:25339 ERROR: BC_REGISTER_LOOPER called without request [ 370.460019] binder_alloc: 25329: binder_alloc_buf, no vma [ 370.466052] binder: 25329:25339 transaction failed 29189/-3, size 0-0 line 3136 [ 370.481192] binder: release 25329:25339 transaction 453 out, still active [ 370.490527] binder: unexpected work type, 4, not freed 13:54:53 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:53 executing program 3: socket$inet(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') fcntl$notify(r1, 0x402, 0x2) getdents(r1, &(0x7f0000002b80)=""/202, 0xec) times(&(0x7f0000000040)) [ 370.495858] binder: undelivered TRANSACTION_COMPLETE [ 370.501179] binder: release 25329:25339 transaction 453 in, still active [ 370.508154] binder: send failed reply for transaction 453, target dead [ 370.514898] binder: undelivered TRANSACTION_ERROR: 29189 13:54:53 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) r1 = memfd_create(&(0x7f0000000640)='/dev/input/mice\x00', 0x3) r2 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) getsockopt$inet6_tcp_int(r2, 0x6, 0x14, &(0x7f0000000000), &(0x7f0000000100)=0x4) write$selinux_create(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="73797374656d5f753a6f626a6563745f723a627364707479b7fc65766963655f743a733020756e636f6e66696e656420303030303030303030303030303030363535333700"], 0x45) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000140)={0x51, 0x2, 0xfffffffffffff19d, {0xa5, 0x8}, {0x81, 0x6}, @const={0x0, {0xe00000, 0x5, 0x7f, 0x2}}}) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r2, &(0x7f0000000580)='./file0\x00', r4, r5, 0x500) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f0000000400)={0xfffffffffffffe10, 0x0, &(0x7f00000003c0)}) connect$l2tp(r2, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x3, 0x3, 0x3, 0x2}}, 0x26) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000340)={0x55, 0x987, 0xfffffffffffffffc, {0x9, 0x6}, {0x1, 0x7c}, @cond=[{0xfff, 0x16eb, 0x8000, 0xffff, 0x2, 0x1f1}, {0x2, 0x2, 0x1000, 0x1bac, 0x7fff, 0xffff}]}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f0000000680)={0x8, 0x0, 'client1\x00', 0x5, "ef0365dc9636fcdf", "cc764f2ce67a4305338e262667bc97214a889042a3e3e90c31b9b7a3c5b7c37a", 0x3, 0x4}) getsockopt$packet_buf(r3, 0x107, 0x8, &(0x7f0000000240)=""/240, &(0x7f0000ca5ffc)=0xf0) [ 370.581915] binder: 25349:25353 unknown command 905995019 [ 370.587628] binder: 25349:25353 ioctl c0306201 20000040 returned -22 [ 370.596145] binder: 25349:25353 ioctl 4b6b 20000480 returned -22 [ 370.604045] binder_alloc: 25349: binder_alloc_buf, no vma [ 370.609728] binder: 25349:25353 transaction failed 29189/-3, size 0-0 line 3136 [ 370.620103] binder: BINDER_SET_CONTEXT_MGR already set [ 370.625495] binder: 25349:25355 ioctl 40046207 0 returned -16 [ 370.631931] binder_alloc: 25349: binder_alloc_buf, no vma [ 370.637547] binder: 25349:25353 transaction failed 29189/-3, size 24-8 line 3136 [ 370.638918] binder: 25349:25355 unknown command 905995019 [ 370.638928] binder: 25349:25355 ioctl c0306201 20000040 returned -22 [ 370.645240] binder: 25349:25357 ioctl 4b6b 20000480 returned -22 [ 370.650545] binder: 25349:25357 got transaction to invalid handle [ 370.650554] binder: 25349:25357 transaction failed 29201/-22, size 0-0 line 3013 13:54:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 370.650845] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.650883] binder: send failed reply for transaction 458 to 25349:25353 [ 370.657419] binder: undelivered TRANSACTION_COMPLETE [ 370.657427] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.707286] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.719448] binder: undelivered TRANSACTION_ERROR: 29201 13:54:53 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) recvfrom$inet6(r0, &(0x7f0000000340)=""/185, 0xb9, 0x40, 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) r2 = dup2(r1, r1) socket(0x3, 0x0, 0xff) r3 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0), 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000200)='logon\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, r3) write$FUSE_NOTIFY_POLL(r2, &(0x7f0000000040)={0x18, 0x1, 0x0, {0xfffffffffffffffb}}, 0x18) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) r4 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000200), 0x0, 0xfffffffffffffff9) keyctl$set_timeout(0xf, r4, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, &(0x7f000000a000)) r5 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) pwritev(r5, &(0x7f0000001400), 0x100000000000013a, 0x0) fcntl$lock(r5, 0x7, &(0x7f0000027000)={0x1}) ftruncate(r5, 0x0) [ 370.762072] binder: 25358:25366 ERROR: BC_REGISTER_LOOPER called without request [ 370.777358] binder_alloc: 25358: binder_alloc_buf, no vma [ 370.791404] binder: 25358:25366 transaction failed 29189/-3, size 0-0 line 3136 13:54:53 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 370.814859] binder: release 25358:25366 transaction 465 out, still active [ 370.822957] binder: unexpected work type, 4, not freed [ 370.828492] binder: undelivered TRANSACTION_COMPLETE [ 370.837706] binder: release 25358:25366 transaction 465 in, still active [ 370.844858] binder: send failed reply for transaction 465, target dead [ 370.852026] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.972626] binder: 25373:25377 ERROR: BC_REGISTER_LOOPER called without request [ 371.004245] binder_alloc: 25373: binder_alloc_buf, no vma [ 371.013716] binder: 25373:25377 transaction failed 29189/-3, size 0-0 line 3136 [ 371.023441] binder: BINDER_SET_CONTEXT_MGR already set [ 371.031131] binder: 25373:25377 ioctl 40046207 0 returned -16 [ 371.037179] binder_alloc: 25373: binder_alloc_buf, no vma [ 371.037202] binder: 25373:25381 transaction failed 29189/-3, size 24-8 line 3136 [ 371.037447] binder: 25373:25381 ERROR: BC_REGISTER_LOOPER called without request [ 371.037973] binder: 25373:25383 got transaction to invalid handle [ 371.037983] binder: 25373:25383 transaction failed 29201/-22, size 0-0 line 3013 [ 371.043428] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.043457] binder: release 25373:25377 transaction 470 in, still active [ 371.043464] binder: send failed reply for transaction 470 to 25373:25377 [ 371.043474] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.043563] binder: undelivered TRANSACTION_COMPLETE [ 371.043568] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.114309] binder: undelivered TRANSACTION_ERROR: 29201 13:54:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:54 executing program 3: pkey_mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='attr/fscreate\x00') setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f00000012c0)={0x4, {{0xa, 0x4e20, 0x9, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1a}}, 0x5a}}, 0x0, 0x8, [{{0xa, 0x4e23, 0x8000, @mcast2, 0x5}}, {{0xa, 0x4e24, 0x10000, @ipv4={[], [], @local}, 0x1ff}}, {{0xa, 0x4e21, 0x4, @dev={0xfe, 0x80, [], 0x1f}, 0x1}}, {{0xa, 0x4e23, 0x2, @mcast1, 0xe94}}, {{0xa, 0x4e23, 0x480000000000, @local, 0x4}}, {{0xa, 0x4e20, 0x7, @loopback, 0x8000}}, {{0xa, 0x4e24, 0x7ff, @ipv4={[], [], @local}, 0x3}}, {{0xa, 0x4e23, 0xffffe00000000000, @local, 0x6}}]}, 0x490) r1 = add_key(&(0x7f0000001280)='dns_resolver\x00', &(0x7f00000019c0), &(0x7f0000001200)="83ee1d16097057f859736b0512211600f8209a4f11b3e9c462886f013b3fa1920002da3b3426eb456485770dfe35ab409ae3d2ef5ba01de9cf51bd92af9429da562c4120cdf798b5e4ff0f00", 0x4c, 0xfffffffffffffffe) keyctl$read(0xb, r1, &(0x7f00000001c0)=""/4096, 0x1000) 13:54:54 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x31) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0xfffffffffffffffd, 0x33}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x90}}, 0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000003c0)={{{@in=@rand_addr, @in6=@local}}, {{@in=@rand_addr}, 0x0, @in=@broadcast}}, &(0x7f0000000240)=0xe8) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000100)={'IDLETIMER\x00'}, &(0x7f0000000140)=0x1e) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f00000000c0), 0x1c) 13:54:54 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0x0, 0x0}) sendmmsg(r0, &(0x7f0000008600)=[{{0x0, 0x0, &(0x7f0000003140)}}, {{&(0x7f00000072c0)=@un=@file={0x0, './file0\x00'}, 0x80, &(0x7f0000007380), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c000000f900405098eb2708000000000000008e04081972908db800a4"], 0xc}}], 0x2, 0x0) 13:54:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000280)={0xffffffffffffffff}) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f00000003c0)={{0x2, 0x4e22, @broadcast}, {0x0, @random="caf1e10648f2"}, 0x2, {0x2, 0x4e23}, 'gre0\x00'}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000000180)={0x8, 0xaf, 0x7}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:54 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000ff8ffc)=0x8005, 0x4) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @empty, 0xffffffffffffffff}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f00000000c0)=0x4, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x26f) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000006, &(0x7f0000000080)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20}, 0x1c) sendto$inet6(r2, &(0x7f0000000040), 0x0, 0x20040000, &(0x7f0000f62fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$sock_inet6_udp_SIOCINQ(r2, 0x541b, &(0x7f0000000140)) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000100), 0x4) 13:54:54 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 371.177076] binder: 25380:25386 ERROR: BC_REGISTER_LOOPER called without request [ 371.192395] binder_alloc: 25380: binder_alloc_buf, no vma [ 371.198096] binder: 25380:25386 transaction failed 29189/-3, size 0-0 line 3136 [ 371.210965] binder: release 25380:25386 transaction 477 out, still active [ 371.218511] binder: unexpected work type, 4, not freed 13:54:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'tunl0\x00', &(0x7f0000000140)=@ethtool_cmd={0x25}}) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/create\x00', 0x2, 0x0) [ 371.223814] binder: undelivered TRANSACTION_COMPLETE [ 371.229459] binder: release 25380:25386 transaction 477 in, still active [ 371.236385] binder: send failed reply for transaction 477, target dead [ 371.243177] binder: undelivered TRANSACTION_ERROR: 29189 13:54:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) recvfrom$inet6(r0, &(0x7f0000000340)=""/185, 0xb9, 0x40, 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) r2 = dup2(r1, r1) socket(0x3, 0x0, 0xff) r3 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0), 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000200)='logon\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, r3) write$FUSE_NOTIFY_POLL(r2, &(0x7f0000000040)={0x18, 0x1, 0x0, {0xfffffffffffffffb}}, 0x18) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) r4 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000200), 0x0, 0xfffffffffffffff9) keyctl$set_timeout(0xf, r4, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, &(0x7f000000a000)) r5 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) pwritev(r5, &(0x7f0000001400), 0x100000000000013a, 0x0) fcntl$lock(r5, 0x7, &(0x7f0000027000)={0x1}) ftruncate(r5, 0x0) 13:54:54 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={&(0x7f0000125ff4), 0xc, &(0x7f0000cffff0)={&(0x7f0000000840)=@allocspi={0xf8, 0x16, 0x9, 0x0, 0x0, {{{@in, @in=@broadcast}, {@in6=@mcast2, 0x0, 0x33}, @in6=@loopback}}}, 0xf8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={&(0x7f0000000080), 0x17f, &(0x7f00000002c0)={&(0x7f0000000000)=@flushsa={0x14, 0x1c, 0x301}, 0x14}}, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) [ 371.345382] binder: 25394:25398 ERROR: BC_REGISTER_LOOPER called without request [ 371.353701] binder_alloc: 25394: binder_alloc_buf, no vma [ 371.359350] binder: 25394:25398 transaction failed 29189/-3, size 0-0 line 3136 [ 371.369130] binder: BINDER_SET_CONTEXT_MGR already set [ 371.374905] binder: 25394:25402 ioctl 40046207 0 returned -16 [ 371.381038] binder_alloc: 25394: binder_alloc_buf, no vma [ 371.386633] binder: 25394:25398 transaction failed 29189/-3, size 24-8 line 3136 13:54:54 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x31) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0xfffffffffffffffd, 0x33}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x90}}, 0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000003c0)={{{@in=@rand_addr, @in6=@local}}, {{@in=@rand_addr}, 0x0, @in=@broadcast}}, &(0x7f0000000240)=0xe8) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000100)={'IDLETIMER\x00'}, &(0x7f0000000140)=0x1e) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f00000000c0), 0x1c) 13:54:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$keychord(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord\x00', 0x200000, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 371.394467] binder: 25394:25402 ERROR: BC_REGISTER_LOOPER called without request [ 371.427135] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.436956] binder: release 25394:25398 transaction 482 in, still active 13:54:54 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 371.445077] binder: send failed reply for transaction 482 to 25394:25398 [ 371.452093] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.458008] binder: undelivered TRANSACTION_COMPLETE [ 371.463336] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.466371] binder_alloc: 25400: binder_alloc_buf, no vma [ 371.466389] binder: 25400:25412 transaction failed 29189/-3, size 0-0 line 3136 [ 371.482048] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.487577] binder: send failed reply for transaction 488 to 25400:25412 13:54:54 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/member\x00', 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000380)={{{@in6=@loopback, @in=@remote}}, {{@in=@rand_addr}, 0x0, @in=@broadcast}}, &(0x7f00000001c0)=0xe8) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0x0) syz_open_dev$rtc(&(0x7f0000000180)='/dev/rtc#\x00', 0xfffffffffffffffc, 0x80100) openat$keychord(0xffffffffffffff9c, &(0x7f0000000140)='/dev/keychord\x00', 0x420000, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086607, 0x800000) 13:54:54 executing program 3: mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x0, 0x0, &(0x7f0000000040)) socket$packet(0x11, 0x3, 0x300) pselect6(0x40, &(0x7f0000000000), &(0x7f0000000080)={0x8}, &(0x7f0000000100), &(0x7f0000000140)={0x77359400}, &(0x7f00000001c0)={&(0x7f0000000180), 0x8}) [ 371.495721] binder: undelivered TRANSACTION_COMPLETE [ 371.501157] binder: undelivered TRANSACTION_ERROR: 29189 13:54:54 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000040), &(0x7f0000000140)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) r2 = inotify_init1(0x0) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") fcntl$setown(r2, 0x8, 0xffffffffffffffff) fcntl$getownex(r2, 0x10, &(0x7f0000000180)={0x0, 0x0}) ptrace$setopts(0x4206, r4, 0x0, 0x0) waitid(0x0, 0x0, &(0x7f0000000080), 0x8, &(0x7f00000000c0)) tkill(r1, 0x1000000000016) listen(r0, 0x7773) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KDDISABIO(r6, 0x4b37) setsockopt(r0, 0xff, 0x0, &(0x7f0000000180), 0x0) getsockopt$IP6T_SO_GET_INFO(r5, 0x29, 0x40, &(0x7f0000000180)={'raw\x00'}, &(0x7f0000000200)=0x54) getsockopt$IP_VS_SO_GET_SERVICES(r6, 0x0, 0x482, &(0x7f0000000080)=""/180, &(0x7f0000000140)=0xb4) chdir(&(0x7f0000000040)='./file0\x00') 13:54:54 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='tracefs\x00', 0x0, &(0x7f0000000cc0)="b2a5ff5fc1120ea58722902b4b23f3bf17755f91d234b97ed56f2c39") r0 = dup(0xffffffffffffff9c) getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r1) mount(&(0x7f0000000c00)='./file0\x00', &(0x7f0000000c40)='./file0\x00', &(0x7f0000000c80)='devtmpfs\x00', 0x0, &(0x7f0000000cc0)) 13:54:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 371.639692] binder: 25422:25435 ERROR: BC_REGISTER_LOOPER called without request [ 371.642468] binder: BINDER_SET_CONTEXT_MGR already set [ 371.642477] binder: 25426:25437 ioctl 40046207 0 returned -16 [ 371.662537] binder: 25426:25437 got transaction to invalid handle [ 371.669658] binder: 25426:25437 transaction failed 29201/-22, size 0-0 line 3013 [ 371.679275] binder: release 25426:25437 transaction 496 out, still active 13:54:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) getegid() ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:54 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x511, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r0, 0x80000001) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x4, 0x44031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/icmp\x00') ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) ioctl$TIOCEXCL(r1, 0x540c) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) 13:54:54 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 371.682674] binder_alloc: 25422: binder_alloc_buf, no vma [ 371.682692] binder: 25422:25435 transaction failed 29189/-3, size 0-0 line 3136 [ 371.683341] binder: BINDER_SET_CONTEXT_MGR already set [ 371.683349] binder: 25422:25435 ioctl 40046207 0 returned -16 [ 371.683392] binder_alloc: 25422: binder_alloc_buf, no vma [ 371.683408] binder: 25422:25438 transaction failed 29189/-3, size 24-8 line 3136 [ 371.683476] binder: 25422:25435 ERROR: BC_REGISTER_LOOPER called without request [ 371.683505] binder: 25422:25438 got transaction to invalid handle 13:54:54 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 371.683512] binder: 25422:25438 transaction failed 29201/-22, size 0-0 line 3013 [ 371.745322] binder: unexpected work type, 4, not freed [ 371.750803] binder: undelivered TRANSACTION_COMPLETE [ 371.756083] binder: undelivered TRANSACTION_ERROR: 29201 [ 371.761895] binder: undelivered TRANSACTION_ERROR: 29201 [ 371.767856] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.774677] binder: release 25422:25435 transaction 493 out, still active [ 371.782198] binder: unexpected work type, 4, not freed [ 371.787481] binder: undelivered TRANSACTION_COMPLETE [ 371.792712] binder: release 25422:25435 transaction 493 in, still active [ 371.799587] binder: send failed reply for transaction 493, target dead [ 371.806244] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.811750] binder: send failed reply for transaction 496, target dead 13:54:54 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x121202, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000100)={{0x4, 0x2}, {0x0, 0x10000}, 0x7, 0x2, 0x7}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) ioctl$BLKRRPART(r1, 0x125f, 0x0) r2 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/relabel\x00', 0x2, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x40087602, &(0x7f0000000000)) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) tee(r2, r1, 0xcac, 0x4) setsockopt$inet_udp_int(r1, 0x11, 0x6f, &(0x7f0000000080)=0x1, 0x4) 13:54:54 executing program 5: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) write$binfmt_elf32(0xffffffffffffffff, &(0x7f00000006c0)=ANY=[@ANYBLOB="7f454c460700c664752c00080000000000000000000000e0ffffff8e03004f38000000e2016200010000002a8f200001000000030000000000000051e5746400000000020000003204000000000000f70f00000500000080000000e22679e937a9a2506e3541684f770574584fa16b463deb7017d9f0c0aec8cd4fbe8512bde32175dd8300ace377d661792f4fe2000000000000"], 0x91) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000500)) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u'}]}}) write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) pipe(&(0x7f0000000680)) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f00000003c0)) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RWALK(r1, &(0x7f0000000080)={0x9, 0x6f, 0x1}, 0x9) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access'}}]}}) listxattr(&(0x7f0000000400)='./file0/file0\x00', &(0x7f0000000440)=""/57, 0x39) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xa4, r4, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bcsh0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @loopback}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip_vti0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xffff}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3a}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x10}, 0x4000040) r5 = getegid() fchown(r3, 0x0, r5) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) accept4$packet(r2, &(0x7f0000000ac0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000b00)=0x14, 0x800) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000b40)={'team0\x00', r6}) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)) getxattr(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)=@known='system.sockprotoname\x00', &(0x7f00000005c0)=""/176, 0xb0) epoll_create1(0x0) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, 0x9, 0xffffffffffff762f, 0x0, 0xff}) 13:54:54 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 371.933399] binder: BINDER_SET_CONTEXT_MGR already set [ 371.939203] binder: 25446:25455 ioctl 40046207 0 returned -16 [ 371.945263] binder_alloc: 25448: binder_alloc_buf, no vma [ 371.945281] binder: 25448:25456 transaction failed 29189/-3, size 0-0 line 3136 13:54:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:55 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x511, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r0, 0x80000001) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x4, 0x44031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/icmp\x00') ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) ioctl$TIOCEXCL(r1, 0x540c) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) [ 371.947374] binder: release 25448:25456 transaction 504 out, still active [ 371.947379] binder: unexpected work type, 4, not freed [ 371.947381] binder: undelivered TRANSACTION_COMPLETE [ 371.960759] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.960789] binder: send failed reply for transaction 504, target dead [ 371.993574] binder: 25446:25464 transaction failed 29189/-22, size 24-8 line 3013 13:54:55 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x511, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r0, 0x80000001) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x4, 0x44031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/icmp\x00') ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) ioctl$TIOCEXCL(r1, 0x540c) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) 13:54:55 executing program 1: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x200000000, 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x0, 0x5, 0x0) [ 371.994783] binder: 25446:25464 ERROR: BC_REGISTER_LOOPER called without request [ 371.995880] binder: 25446:25464 got transaction to invalid handle [ 371.995889] binder: 25446:25464 transaction failed 29201/-22, size 0-0 line 3013 [ 372.011141] tmpfs: No value for mount option '²¥ÿ_Á¥‡"+K#ó¿u_‘Ò4¹~Õo,9' [ 372.060840] binder: 25446:25455 ERROR: BC_REGISTER_LOOPER called without request [ 372.068893] binder_alloc: 25446: binder_alloc_buf, no vma [ 372.075020] binder: 25446:25464 transaction failed 29189/-3, size 0-0 line 3136 13:54:55 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = open(&(0x7f0000000040)='./file0\x00', 0x80, 0x100) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000080)=0x3, 0x4) ioctl$void(r0, 0xc0045878) unlinkat(r0, &(0x7f00000000c0)='./file0\x00', 0x200) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000100)={'veth0\x00', {0x2, 0x4e20, @remote}}) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0xa40c2, 0x0) set_tid_address(&(0x7f0000000180)) sendto(r0, &(0x7f00000001c0)="0724670c6a33b9da2caedf8767", 0xd, 0x800, &(0x7f0000000200)=@nfc={0x27, 0x1, 0x0, 0x1}, 0x80) r2 = mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000008, 0x30, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000280)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x54, 0x0, &(0x7f00000003c0)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000300)=[@flat={0x73622a85, 0xa, r2, 0x2}, @flat={0x0, 0xa, r3, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f00000002c0), 0x1, 0x1, 0x3d}], &(0x7f0000000380)=[0x78, 0x60, 0x2654a79ca2c52047]}, 0x5}}, @increfs], 0xb7, 0x0, &(0x7f0000000440)="59e6a8e71c7261281ff16a71936d3222266dffd4fe27c89682d5536ecc586aa4c84d3aede1de4c179605d5ddf6f186842c7768ca1f567c1def26d20685da0cbb510bac661767d51a281109b3a984120340917d05c0bab07afbafeaee7ed9d89d62c172838dc44cbfe42fa95a9711af90758863b9bc94388399380e8406d9a5bbe409b753837d88b8dc8c4dfecd014b7abdb92038c04cb0ae25850a967764feb9b482335bfba1f90a64e827a7c38c6fa5bfa8476daee9b8"}) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) fstat(r0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000640)={{{@in=@rand_addr, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in6=@remote}}, &(0x7f0000000740)=0xe8) getgroups(0x6, &(0x7f0000000780)=[0xffffffffffffffff, 0xee00, 0xee00, 0x0, 0xee00, 0x0]) fstat(r0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r9 = getgid() stat(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0}) r11 = getegid() fstat(r1, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a00)={{{@in6=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@local}}, &(0x7f0000000b00)=0xe8) r15 = getgid() write$FUSE_DIRENTPLUS(r0, &(0x7f0000000b40)={0x3c0, 0x0, 0x2, [{{0x3, 0x0, 0x81, 0x0, 0x7, 0x80000001, {0x3, 0x1f, 0x37, 0x81, 0x6, 0x9a9d, 0xffffffffffffff21, 0x4, 0x8, 0x5, 0x6, r4, r5, 0xf6a, 0x6}}, {0x0, 0x400, 0x0, 0x6}}, {{0x4, 0x3, 0x48c, 0x3, 0xe41, 0x843, {0x5, 0xffffffffffff0000, 0x1, 0x5aa, 0x0, 0x3, 0x950, 0x8001, 0x3, 0x7, 0x3, r6, r7, 0x10001, 0x10000}}, {0x4, 0x5, 0x6, 0x1, 'veth0\x00'}}, {{0x1, 0x1, 0x6, 0x2, 0x2, 0x2, {0x4, 0x1, 0x15, 0x3f, 0x5, 0x5, 0x8, 0x6, 0x20, 0x9, 0xffffffff, r8, r9, 0x1c23}}, {0x4, 0x0, 0x6, 0x70000000, 'veth0\x00'}}, {{0x4, 0x3, 0x8b, 0x9, 0x8, 0x9, {0x5, 0x100000001, 0xc0, 0x0, 0xfffffffffffffffc, 0xffff, 0x469, 0x4, 0x1, 0x9, 0xcc7d, r10, r11, 0xfff, 0xfff}}, {0x1, 0x6, 0x6, 0x5, 'veth0\x00'}}, {{0x6, 0x1, 0x6, 0x7, 0x0, 0x2, {0x6, 0x8, 0x0, 0x1, 0x80, 0x80000000, 0x5, 0x7, 0x6, 0xffffffff, 0x1, r12, r13, 0x9, 0xdcb}}, {0x6, 0x25, 0x0, 0x1}}, {{0x4, 0x0, 0x8, 0x4, 0xffffffffffffffff, 0x3, {0x1, 0xffffffffffffff80, 0x7, 0x5, 0xfff, 0x6, 0xffffffffffffff0a, 0xfffffffffffffff9, 0x1000, 0x80000001, 0x20, r14, r15, 0x3, 0x6}}, {0x2, 0x6, 0x6, 0x401, 'user+$'}}]}, 0x3c0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000f00)={'nat\x00', 0x3, [{}, {}, {}]}, 0x58) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) preadv(r0, &(0x7f00000043c0)=[{&(0x7f0000000f80)=""/4096, 0x1000}, {&(0x7f0000001f80)=""/4096, 0x1000}, {&(0x7f0000002f80)=""/189, 0xbd}, {&(0x7f0000003040)=""/44, 0x2c}, {&(0x7f0000003080)=""/255, 0xff}, {&(0x7f0000003180)=""/148, 0x94}, {&(0x7f0000003240)=""/177, 0xb1}, {&(0x7f0000003300)=""/4096, 0x1000}, {&(0x7f0000004300)=""/41, 0x29}, {&(0x7f0000004340)=""/116, 0x74}], 0xa, 0x0) r16 = request_key(&(0x7f0000004540)='rxrpc_s\x00', &(0x7f0000004580)={0x73, 0x79, 0x7a, 0x1}, &(0x7f00000045c0)='\x00', 0xfffffffffffffffe) request_key(&(0x7f0000004480)='asymmetric\x00', &(0x7f00000044c0)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000004500)='selinuxposix_acl_access\\&}\x00', r16) 13:54:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="04911dce5c636525c885dbb08525a48cdbb8465339913cb0f47687d2c06ff628b0b45c11429743a663ba218ba3c30df3bb697b84642e88af313cd0c0a482fe522e6dd60e96df3aaa9b0e58d0f13b74357dbfb50eb0fda954b98af0362963e51e2f83056265aa59fef160990e7656a5333f1cad45ab6cb41cce876d4fa119fd5a4863389cb8ffef458f6f54ca0dccaa93049cb0e11f2445e39f4184b5cbf76fc0d91b2fb24643d72b4b360c27e81b1a57ffde86a340a27ac9ce037dd82f2ebf8a7544e3c2dec54437edacfc892c3c1e49e4da4ef4e320a2c62634a4f11bab2f7c6cf19d0b38ad2370883fdcdf886481404e925a71f913e09f358076f9cb41bc483f89be89e0a2f95609b03b0dbea6bf6dde5cfa755139230ad0f8e70a61b14d618d87f3adcbb0171c87ad5d3fd45de67ea789025ba912f38a5b5d32276a78dc7bd49aa227db12e6ef7b7e73c76280987a9c951efe2b9d701d602dfc92f80e0392db83e0b7c02fc6ef8aaaf977fb9bd614ad6c0ade6090565519a7d1006c1316e4c5d3d837178d43231489a2d509", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="11634840014f5de58706bfacd73f3b71bd4a812bcda03619bbe111a24b7d3876a9a1f33d79471fa1cc6da9a814bb9f8bee75f54fe5456a472b6ab9d999bd0836cea2b060d1c98dc21c4856ae69bdc02c905d119e0ffc1db5aebe0e94d48e6fbc"], 0x0, 0x0, &(0x7f0000000480)}) [ 372.082890] binder: release 25446:25464 transaction 511 out, still active [ 372.090748] binder: unexpected work type, 4, not freed [ 372.096105] binder: undelivered TRANSACTION_COMPLETE [ 372.101806] binder: release 25446:25455 transaction 511 in, still active [ 372.108699] binder: send failed reply for transaction 511, target dead [ 372.115408] binder: undelivered TRANSACTION_ERROR: 29189 [ 372.121015] binder: undelivered TRANSACTION_ERROR: 29201 [ 372.126582] binder: undelivered TRANSACTION_ERROR: 29189 13:54:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 372.202670] binder: 25474:25480 ERROR: BC_REGISTER_LOOPER called without request 13:54:55 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x7c9816ae) r1 = socket$packet(0x11, 0x4000000000003, 0x300) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x61, &(0x7f0000000140)={'filter\x00', 0x4}, 0x68) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x4006, 0x4) ioctl$KDGETLED(r0, 0x4b31, &(0x7f00000001c0)) sendto$inet6(r1, &(0x7f00000000c0)="060100000500000000001e00ffb25bc202938207d903378c398d5375c5f73f2e55067d2780e19e33e3c2e7725f58a55afce0b86f61f7402810c3aae5dafadc57d0f699e3014e1e17b85812f29508c008", 0x50, 0x0, &(0x7f0000000000)={0xa, 0x100200000800, 0x4, @mcast1}, 0x1c) 13:54:55 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x511, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r0, 0x80000001) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x4, 0x44031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/icmp\x00') ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) ioctl$TIOCEXCL(r1, 0x540c) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) [ 372.253242] binder: 25474:25488 got transaction to invalid handle [ 372.264746] binder: BINDER_SET_CONTEXT_MGR already set [ 372.277151] binder: 25474:25488 transaction failed 29201/-22, size 0-0 line 3013 [ 372.296039] binder: 25481:25489 ioctl 40046207 0 returned -16 13:54:55 executing program 3: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x3ffffe, 0x0) r0 = creat(&(0x7f0000001380)='./file0\x00', 0x0) ioctl$fiemap(r0, 0x40086602, &(0x7f0000000080)=ANY=[]) write$cgroup_type(r0, &(0x7f0000000000)='threaded\x00', 0xfe63) ioctl$fiemap(r0, 0xc020660b, &(0x7f0000000140)={0x9, 0x6, 0x0, 0x0, 0x1, [{}]}) 13:54:55 executing program 5: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) write$binfmt_elf32(0xffffffffffffffff, &(0x7f00000006c0)=ANY=[@ANYBLOB="7f454c460700c664752c00080000000000000000000000e0ffffff8e03004f38000000e2016200010000002a8f200001000000030000000000000051e5746400000000020000003204000000000000f70f00000500000080000000e22679e937a9a2506e3541684f770574584fa16b463deb7017d9f0c0aec8cd4fbe8512bde32175dd8300ace377d661792f4fe2000000000000"], 0x91) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000500)) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u'}]}}) write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) pipe(&(0x7f0000000680)) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f00000003c0)) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RWALK(r1, &(0x7f0000000080)={0x9, 0x6f, 0x1}, 0x9) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access'}}]}}) listxattr(&(0x7f0000000400)='./file0/file0\x00', &(0x7f0000000440)=""/57, 0x39) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xa4, r4, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bcsh0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @loopback}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip_vti0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xffff}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3a}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x10}, 0x4000040) r5 = getegid() fchown(r3, 0x0, r5) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) accept4$packet(r2, &(0x7f0000000ac0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000b00)=0x14, 0x800) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000b40)={'team0\x00', r6}) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)) getxattr(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)=@known='system.sockprotoname\x00', &(0x7f00000005c0)=""/176, 0xb0) epoll_create1(0x0) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, 0x9, 0xffffffffffff762f, 0x0, 0xff}) 13:54:55 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x511, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r0, 0x80000001) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x4, 0x44031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/icmp\x00') ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) ioctl$TIOCEXCL(r1, 0x540c) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) 13:54:55 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getown(r0, 0x9) gettid() r1 = getpgrp(0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./file0\x00', 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000180)=0x3) ioctl$fiemap(r2, 0x40086602, &(0x7f0000000840)=ANY=[]) write$P9_RAUTH(r2, &(0x7f0000000140)={0x14, 0x67, 0x0, {0x4}}, 0x14) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$fiemap(r3, 0x40086602, &(0x7f0000000280)=ANY=[@ANYRES64=r1]) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000500), &(0x7f0000000540)=0xc) r4 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x2) write$9p(r3, &(0x7f00000007c0)="61619309000000000000005508e553226f68701c6dfdb93271f6b70372b82026e862fb21fc0738e7353a64245124a305a87653b0def87e116a6f4c4f2768001513dfa7fe865a5f93c335bb11908c65b90a01b9e8bc6baf571f4e865c81651d070dc6749bc23115791ffde32d2293f63041fab88f2f54a2451912311b8131cf07e13576c5df6e6def94500daf0aed550f8500000000000000000000", 0xffffffffffffff2c) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'irlan0\x00'}) readv(0xffffffffffffffff, &(0x7f0000001400), 0x0) write$evdev(r4, &(0x7f000004d000)=[{{}, 0x0, 0x10000001}, {}], 0xff91) [ 372.333932] binder: 25481:25500 got transaction with invalid offset (0, min 0 max 24) or object. [ 372.345694] binder: 25481:25500 transaction failed 29201/-22, size 24-8 line 3199 [ 372.356904] binder: 25481:25489 ERROR: BC_REGISTER_LOOPER called without request [ 372.402813] binder: 25481:25500 got transaction to invalid handle [ 372.409361] binder: 25481:25500 transaction failed 29201/-22, size -6293378278629619847-5761640965695585044 line 3013 13:54:55 executing program 4: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000040)='./file0\x00', 0x401, 0x5, &(0x7f0000000540)=[{&(0x7f0000000080)="36a59d9b6776e88b40a7b597e442c64ab5d9a535ca6a72a0ea04281dbadff546", 0x20, 0x823e}, {&(0x7f0000000140)="9362cb7f8be5aa1fc894cabace2b064924ed3223466f2afd3ab743edc33f72283e6850aae20cd22ba098ecc821e1d0631f80c488f54d2dce68ead28ebb3d865bae331305be82187fb13558b216cc8269f3838da101e4527e0a47b7988d06537b129a7cfc95afc9bc8028fd34f33f5750310dee0af426cbd2b5d448f37f37a91ebc25ff48528024acee7da4a3ed07b6687b134481389d0094ff71d8cc449485f039a6f1409df98bd56e7cb73fb7a85b6b9cb441038e1896fea0f4ed570b7a2f8d6f5aa566e6cea6b24949d020a3", 0xcd, 0x7}, {&(0x7f0000000240)="a97efcadb1a97094a480ef21ce58c1c154be3bf5a155f342fc091e64f91282bdff1d869e5532ef4b96d812547db17465cb824ffe1c2b6b0ba7b22e948f3ae06d169b4e2c6d8d5f9595fb546c0feb56ab07448701b747c5f57b3d2f1ba6b04e677b9685826d0785fbf44ebde0c047f9bc91f14c8ae28fa0f39ebc63b42ceb84cdf699070ec77bae09016eb7b1749e0209db86cd843f8bfe516c2735c963665a54a83e40d0d8534607b3fc782312021987141a6ed6aa7e409867", 0xb9, 0x3}, {&(0x7f00000005c0)="b164d641ebcdf4e656e7a553fe6cdaddf9aeddd702d51bb13073edd0f4e2aa501b0e05e7e9da16c698639ca84f14ebc4d0690100f5b7b9edf24974132ca0a7c21386e09a377ebbbd02276467740018cfbab23f8a0ae599ac55d10a94a279614951920917948ed6204e017d9822440c2d8d34623a03d4b208d76435d1f718dd53f6daee9aace82b703ff15a4f5675f23c974ce781519dfe1f563b1224188ccece782c277b2c9e53af3bdd077ed7d13e95902dc64c5f27a2d1ef6e94", 0xbb, 0x65}, {&(0x7f00000003c0)="aff6780ccc5fe16d1131478fb60358db4427d65c4569d72c7400d561d126504bb0cabef7cfec15ac9a5d07cbb60536b5116b7070400e2995ccdb4393c7a27d61473d3f9551ce54a4b67aae5c23c070e7efc09d034c996db328bcf1f0687efb932f550c1cd24abe79404b067c274db0becea4690314fa8ca3f4f88021dacec58fccd3aa8c01e172801e31e8c6a70b6607054725fc5f60f02f1bd0f0145d50f250401e0a56717899669085db205289ef8b94ec030a8d6006a9d803bef84e311c4cf839a4c89f60e2de655f677283b9dda8954cf532fc91e2", 0xd7, 0x9}], 0x0, &(0x7f00000000c0)) 13:54:55 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x511, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r0, 0x80000001) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x4, 0x44031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/icmp\x00') ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) ioctl$TIOCEXCL(r1, 0x540c) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) 13:54:56 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:56 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000180)={{0x2, 0x4e24, @broadcast}, {0x0, @random="59a310eebccc"}, 0x0, {0x2, 0x0, @dev}, 'team0\x00'}) setsockopt(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000001000), 0xc5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_buf(r0, 0x1, 0x37, &(0x7f0000000980)=""/199, &(0x7f00000005c0)=0xffffffffffffff3e) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r2 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) mkdir(&(0x7f00000000c0)='./file0\x00', 0x4) sendto$packet(r2, &(0x7f00000003c0)="5fa41cb6239bc620461156ce27dc2db4e4f296956be194072cae1d4b4730eef390e171e335cfc279e97a7431d3014e8ddd18e8670334a143961d5385f9ce71af15ea6ce50f047ad71b5331", 0x4b, 0x0, 0x0, 0x0) pwritev(r1, &(0x7f0000000300), 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x2000005) listxattr(&(0x7f0000001380)='./file0\x00', &(0x7f00000013c0)=""/21, 0x15) rt_sigaction(0x39, &(0x7f00000002c0)={0x4, {0x101}, 0x1, 0x2}, &(0x7f0000000440), 0x8, &(0x7f0000000480)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000680), &(0x7f00000006c0)=0xc) ioctl$LOOP_CLR_FD(r1, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_buf(r3, 0x1, 0x1a, &(0x7f0000000780)=""/249, &(0x7f0000000600)=0xf9) removexattr(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="73656375726974792e2f6465762f66756c6c00df8ea4a00d794b1ca05daaa106484f1f8a2cee2946d45f1e7d0a462f33953006c21c"]) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000008c0)=ANY=[@ANYBLOB="cc4e13572c0475d2898181b84fd73eeacfbe004e71d970eda27f4757249dddc3f0850ae469f917ae4eec235343c2308672349e4892ffc51b1a63b7a7eea8347d1db9dd0b26928a31e68c41f5841b9740c95040747673e685b489cd660b06f02ebb1f2fb9af8602bfa433"], 0xfffffffffffffde9}}, 0x8000) 13:54:56 executing program 1: syz_mount_image$msdos(&(0x7f0000000200)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000300)=ANY=[]) r0 = open(&(0x7f0000000140)='./file0/file0\x00', 0x3fffa, 0x0) set_tid_address(&(0x7f0000000080)) write$cgroup_type(r0, &(0x7f0000000040)='threaded\x00', 0x9) write$P9_RLOPEN(r0, &(0x7f0000000180)={0x18}, 0x18) ioctl$TIOCNXCL(r0, 0x540d) truncate(&(0x7f0000000b00)='./file0\x00', 0x201f) ioctl$FICLONE(r0, 0x40049409, r0) 13:54:56 executing program 5: r0 = socket$inet(0x2, 0x4, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x1) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000040)={0x77359400}, 0x2a7) sendto$inet(r0, &(0x7f0000000440), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000100)="c3", 0x1, 0x0, &(0x7f0000e66000)={0x2, 0x0, @multicast2}, 0x10) recvmmsg(r0, &(0x7f0000002940)=[{{&(0x7f0000002200)=@hci, 0x80, &(0x7f0000002440)=[{&(0x7f0000002380)=""/133, 0x85}], 0x1, &(0x7f0000002480)=""/112, 0x70}}], 0x1ee, 0x0, &(0x7f0000002a80)={0x77359400}) memfd_create(&(0x7f0000000080)=',}vboxnet1\x00', 0x1) timer_create(0x7, &(0x7f0000000140)={0x0, 0x12, 0x0, @thr={&(0x7f0000000180)="69bb22e5c205b39b78b32d3bb1ae33d337cbe8a8599e4bc63f91b43f8f14f32942774b3f4d97f26f15144121fd2cd10bd3f307a8e395f214ba9aec95aa7c7c9a643dc6fb9a8ef6a63b95bf40d4ba56641e0fa38b39a2bf2f6423611280d557a0656516bb105c9d00edd450806ea459a22a2fff67b4bb39d38c33", &(0x7f0000000200)="0540d86702bb8fbe0bb11a31ea6d9dc00c6fdfc035091b14f155545158e52d1730b3f01b37470b5f4f5c7b16030b7a512cab6fea383e7e5257a36ae77e6e6c4e613bf1b0fe06744e5648a476f212d6bc6c77543075fa9f0205d18cc53f9b30cf36ef76df2d21194b03330c2390d60920b03168012dc3dd5adc638947eff4f03f2dd1a40c2fc2c8c84f04c7062ac0a9ba78eb9b442305ab822e532742f54dbc1820d9d92bfdde26f3bf82463c73db3814fdeb86f550959068c0bcca781d62dcf18cf14ff1a99139a9d38ed35dabbd693857058b10cf2c40c66dc9dc"}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) gettid() fcntl$setstatus(r0, 0x4, 0x44000) r1 = gettid() ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)) tkill(r1, 0x16) 13:54:56 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) connect$netlink(r1, &(0x7f0000000080)=@proc={0x10, 0x0, 0x25dfdbfb}, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000280), 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400026a59ed3d07c6af0001000000000000000056ae514384c720bc7ba3d33ae2429847b800000ca64aab04cd45352b6df4"], 0x14}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f00000004c0)=@expire={0xf8, 0x18, 0x1, 0x0, 0x0, {{{@in6, @in6=@dev}, {@in6=@remote}, @in6=@ipv4={[], [], @broadcast}}}}, 0xf8}, 0x8}, 0x0) 13:54:56 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) sendto$inet6(r0, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000080)={0xa, 0x6558, 0x3, @ipv4={[], [], @remote}}, 0x1c) socket$inet_tcp(0x2, 0x1, 0x0) [ 373.005256] binder: undelivered TRANSACTION_ERROR: 29201 [ 373.074173] binder: 25481:25500 got transaction with invalid offset (0, min 0 max 24) or object. [ 373.084764] binder: 25481:25554 ERROR: BC_REGISTER_LOOPER called without request [ 373.106392] binder: 25481:25500 transaction failed 29201/-22, size 24-8 line 3199 [ 373.119344] binder: BINDER_SET_CONTEXT_MGR already set 13:54:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:56 executing program 4: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000840)='/dev/hwrng\x00', 0x0, 0x0) socket$inet(0x2, 0x3, 0x100) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000140), 0x4) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000a88f88), 0x29f, 0x0, &(0x7f0000e68000)={0x2, 0x0, @loopback}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xff6c, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pread64(r0, &(0x7f0000000880)=""/176, 0xb0, 0x0) 13:54:56 executing program 7: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x501180, 0x0) getsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000300), &(0x7f00000002c0)=0x2a2) r1 = memfd_create(&(0x7f0000000080)="00000600000000000000", 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) write$binfmt_elf32(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003000600000000000000005f537c8a7001003800000000000000000200000000200002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000002000000000000000000"], 0x78) execveat(r1, &(0x7f0000000040)='\x00', &(0x7f0000000280), &(0x7f0000000380)=[&(0x7f0000000180)='!ppp0#%eth0trusted{\x00', &(0x7f00000001c0)='[ppp0\x00', &(0x7f0000000340)='/dev/snapshot\x00'], 0x1000) r2 = getpgid(0x0) fcntl$setownex(r1, 0xf, &(0x7f0000000240)={0x0, r2}) mkdir(&(0x7f0000000200)='./file0\x00', 0x20) ptrace(0x18, r2) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000000)=0x3f) 13:54:56 executing program 1: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000007c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r1 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) write$binfmt_elf64(r1, &(0x7f0000000180)=ANY=[], 0xfffffd97) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f00000000c0)=0x7, 0x4) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000440)='./file0/file1\x00', 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000500)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000480)) futex(&(0x7f0000000100), 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040), 0x0) poll(&(0x7f00000006c0)=[{r1, 0x40}, {r2, 0x9000}], 0x2, 0x100000001) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000780)={0x0, @dev, @dev}, &(0x7f0000000200)=0xc) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000680)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'ipddp0\x00', r3}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r1) modify_ldt$write(0x1, &(0x7f0000000340)={0x1f, 0x20000800, 0x6000, 0x70, 0x400, 0x0, 0x0, 0x1, 0x9}, 0x10) ioctl$TUNSETOWNER(r1, 0x400454cc, 0x0) utime(&(0x7f0000000140)='./file0/file1\x00', &(0x7f00000003c0)) futex(&(0x7f0000000280), 0x6, 0x2, &(0x7f0000000300), &(0x7f0000000380), 0x1) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000580)) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000400)={'bpq0\x00'}) ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x0) write$selinux_load(0xffffffffffffffff, &(0x7f0000000700)={0xf97cff8c, 0x8, 'SE Linux'}, 0x10) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f00000002c0)=0x63e) syz_open_dev$mice(&(0x7f0000000740)='/dev/input/mice\x00', 0x0, 0x242300) syncfs(0xffffffffffffffff) flistxattr(0xffffffffffffffff, &(0x7f0000000800)=""/132, 0x84) 13:54:56 executing program 5: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/checkreqprot\x00', 0x400002, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000100)={0x0}) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000005c0)={0xd8, 0x0, &(0x7f0000000380)=[@decrefs={0x40046307, 0x4}, @reply={0x40406301, {0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000100), &(0x7f0000000140)=[0x0, 0x30]}}, @reply_sg={0x40486312, {{0x3, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000180), &(0x7f0000000200)=[0x20, 0x40, 0x78, 0x18, 0x48]}}}, @increfs={0x40046304, 0x3}, @increfs_done={0x40106308, r2}, @clear_death={0x400c630f, 0x0, 0x4}, @dead_binder_done={0x40086310, 0x4}, @acquire={0x40046305, 0x2}], 0xe9, 0x0, &(0x7f00000004c0)="3382fa3e2470997ff4ccf21102cb216554e3fef95d756deccf81f31f9c73a0c2b7635d2b9521a8cc0d3b8f93a835d980995f63cc2677723d970edd8ed8c4ace1271e9d742f762617a6b4ccfb96df3612bf2a3038a35772c614027991e7f747c181dc2709fd3da93e0fab56742ff5eee769ea0dac9f7cfa383e5d7ce0b3f50617393d5076fa2e9224cc8137d9c3ac3d1ba3975695dadfb23d2746e1617a1f0009c8cd1d99c9bac4b200b29367c23380d52954bf8e5ac4aa7be6905645f3cb082083df4f22aafea6516944f84690956d18f79c5b760f407cf44e1db70e1bbf280724a95a5410c20dff43"}) r3 = socket$nl_route(0x10, 0x3, 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x2181, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={&(0x7f0000000080), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000014003508000000000aa0e6de", @ANYRES32=0x0, @ANYBLOB="0f000100000000000000000000000000080000001400020000000000000000000000000000000000"], 0x40}}, 0x0) fcntl$F_GET_RW_HINT(r3, 0x40b, &(0x7f0000000040)) 13:54:56 executing program 2: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x400) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000040)) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x2, &(0x7f0000000140), 0x3) getsockopt$inet6_buf(r0, 0x29, 0x3d, &(0x7f0000000080)=""/61, &(0x7f00000000c0)=0x3d) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) splice(r0, &(0x7f0000000100), r0, &(0x7f0000000180), 0x8, 0x8) sync_file_range(r0, 0x7, 0x35c5, 0x106) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e20, 0x5, @ipv4={[], [], @multicast1}, 0x100000001}, 0x1c) [ 373.128437] binder: undelivered TRANSACTION_ERROR: 29201 [ 373.134746] binder: undelivered TRANSACTION_ERROR: 29201 [ 373.141288] binder: 25555:25560 ioctl 40046207 0 returned -16 [ 373.142549] blk_update_request: 528 callbacks suppressed [ 373.142578] blk_update_request: I/O error, dev loop0, sector 552 [ 373.142978] blk_update_request: I/O error, dev loop0, sector 807 [ 373.146783] binder: 25555:25560 ERROR: BC_REGISTER_LOOPER called without request [ 373.174437] blk_update_request: I/O error, dev loop0, sector 0 [ 373.174470] buffer_io_error: 525 callbacks suppressed [ 373.174493] Buffer I/O error on dev loop0, logical block 0, lost async page write [ 373.174662] blk_update_request: I/O error, dev loop0, sector 8 [ 373.174682] Buffer I/O error on dev loop0, logical block 1, lost async page write [ 373.174905] blk_update_request: I/O error, dev loop0, sector 16 [ 373.174964] Buffer I/O error on dev loop0, logical block 2, lost async page write [ 373.175304] blk_update_request: I/O error, dev loop0, sector 24 [ 373.175423] Buffer I/O error on dev loop0, logical block 3, lost async page write [ 373.175684] blk_update_request: I/O error, dev loop0, sector 32 [ 373.175773] Buffer I/O error on dev loop0, logical block 4, lost async page write [ 373.176050] blk_update_request: I/O error, dev loop0, sector 40 13:54:56 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) kexec_load(0x0, 0x1, &(0x7f0000000500)=[{&(0x7f0000000240)="ae2720bed7b7085145c8bfef04fa1ab25bd25b4493d4ea2f7a9235a876ce18cf6c9c65f24385", 0x26, 0x3, 0xbab1}], 0x320000) membarrier(0x40, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000180)) r1 = getpgrp(0x0) r2 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RUNLINKAT(0xffffffffffffffff, &(0x7f00000000c0)={0x7, 0x4d, 0x1}, 0x7) socket$nl_generic(0x10, 0x3, 0x10) r3 = creat(&(0x7f00000003c0)='./file0\x00', 0x0) ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000340)=""/3) ioctl$fiemap(r3, 0x40086602, &(0x7f0000000400)=ANY=[@ANYBLOB="3b0c524606432d87aacd0e0c2eca52153abc86e5666a5a732f2b3b618fd6756e03c9a3f1fcaef8ecef82c9b7321c42b0f291bbe9d4f50b05072986099a77df1308b23523f5493e56f288d55e25a0537acda76364ce6bccad54baa0222c4efdabf3a2e09728dd1daf8417e12ff7e8b839559bee529d98780094c6731ebcf5aebff7912309cd61657793a8bf48b421ed89442552baa53affe704ebbcadbfca52a71c987ea3e661f7e81b5f2144e5dac896a87d6b2414023043c064"]) sendfile(r0, 0xffffffffffffffff, &(0x7f0000000580), 0x0) unshare(0x40000000) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r5 = eventfd(0x9) fcntl$getownex(r5, 0x10, &(0x7f00000001c0)) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000140)='lp\x00', 0x3) dup(r2) ioctl$fiemap(r4, 0x40086602, &(0x7f0000000280)=ANY=[@ANYRES64=r1]) openat$rtc(0xffffffffffffff9c, &(0x7f0000000380)='/dev/rtc0\x00', 0x2000, 0x0) [ 373.176093] Buffer I/O error on dev loop0, logical block 5, lost async page write [ 373.176365] blk_update_request: I/O error, dev loop0, sector 48 [ 373.176519] Buffer I/O error on dev loop0, logical block 6, lost async page write [ 373.176893] blk_update_request: I/O error, dev loop0, sector 56 [ 373.176934] Buffer I/O error on dev loop0, logical block 7, lost async page write [ 373.177112] Buffer I/O error on dev loop0, logical block 8, lost async page write [ 373.177384] Buffer I/O error on dev loop0, logical block 9, lost async page write 13:54:56 executing program 7: creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6100) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r0, 0x0, 0x0, 0x1000f4) r2 = open(&(0x7f0000000200)='./bus\x00', 0x4000, 0x0) r3 = getpgid(0xffffffffffffffff) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f00000000c0)="c94d1c8284cbd92c2755f73ec733dac9", 0x10) fcntl$setown(r1, 0x8, r3) sendfile(r0, r2, &(0x7f0000d83ff8), 0x8000fffffffe) timer_create(0x6, &(0x7f00000001c0)={0x0, 0x31, 0x2, @thr={&(0x7f00000002c0)="a1ce9019efdab16b32a79ef956bb0600d0f54004e8c1ac24b4f9bc748ffa08085f803583bfa1acbcf2c2c0576b7461e3a0e51c4a85d9b140b4043b6bbef28af5ac14971666adf374d92e525b19756b5ab5ed3201a71e361427f6bc3e3696203dde69776e308ea9e0c01bee8d6054550d2b2ca3709279c51ae85ac454d712db52a50dec0bb4dc5c9c5b2a3ccf4f27b7c87391d4abe221d02b446d0a4dff78029baa359506d435ac71ba1e750ad1c4d275d004aac6b4d33f9cea25a47aa9812605dbc192c4c0538d18133f0043cd6b6865513f8871d37bc375a2d46fe59e37dd748f2ecd5c228d4ce177be7ccbb6bb8aaf1479", &(0x7f0000000140)="207e49ca086eb4f27f09c5f07ce4593a823da1f5df8a4ce114aa4dfcb4f479c70885d19a95bdb7265ac976872f03e5329315b597cc7f088fd89c1633762bd562e142e3e428653fbecb59fbb5bed701a8c4c14bf4"}}, &(0x7f0000000240)=0x0) timer_delete(r4) 13:54:56 executing program 5: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) renameat2(r0, &(0x7f00000002c0)='./file0\x00', r1, &(0x7f0000000340)='./file0\x00', 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/rfkill\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) fchown(r2, 0x0, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000000)) socket$l2tp(0x18, 0x1, 0x1) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer\x00', 0x4000, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r4, 0x29, 0xd3, &(0x7f0000000400)={{0xa, 0x4e22, 0x100, @remote, 0x74d5}, {0xa, 0x4e22, 0x40, @empty, 0xfffffffffffffffe}, 0x10000, [0x3f, 0x80000000, 0x7494, 0x2, 0x7, 0x8e8, 0x6, 0xe4aa00000000]}, 0x5c) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30340237e7d2f592000000200001040000ff030000000065dc67330000000800000000"], 0x1}}, 0x0) 13:54:56 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'team_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000014590a53434b9600000000000a000000", @ANYRES32=r3, @ANYBLOB="14000600f0ffffff09000000000000000000000014000200fe8000000000000000000000000000aa"], 0x40}}, 0x1000) ioctl$EVIOCSREP(0xffffffffffffffff, 0x40084503, &(0x7f00000000c0)) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000000)={0x17, 0x0, &(0x7f0000000140)}) [ 373.202954] binder: 25555:25565 got transaction to invalid handle [ 373.202965] binder: 25555:25565 transaction failed 29201/-22, size 0-0 line 3013 [ 373.361351] binder: undelivered TRANSACTION_ERROR: 29201 [ 373.436332] binder_alloc: 25583: binder_alloc_buf size 9007207978893312 failed, no address space [ 373.445901] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 373.455180] binder: 25583:25589 transaction failed 29201/-28, size 134217728-9007207844675584 line 3136 [ 373.469804] binder: 25583:25589 ERROR: BC_REGISTER_LOOPER called without request [ 373.515102] binder: 25583:25595 got transaction to invalid handle [ 373.522698] binder: 25583:25595 transaction failed 29201/-22, size 0-0 line 3013 [ 373.559738] IPVS: Creating netns size=2536 id=45 [ 373.612566] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=22804 sclass=netlink_route_socket pig=25603 comm=syz-executor3 [ 373.641444] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=22804 sclass=netlink_route_socket pig=25607 comm=syz-executor3 13:54:56 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:56 executing program 2: clone(0x0, &(0x7f0000000040), &(0x7f00002cfffc), &(0x7f0000000000), &(0x7f00000000c0)="4b920d882f86bd16042b4302fb635da4f8bc6d1cddfae7247dcc9499637df9d9643c015a6e8e1c6f76e78e4e977afcc3a48bb9d974a6ca25ee65d0d4b477347c205b890dc618e1443c4df88e22c325156e84fdbe42aa9a6440b9950690497f73544a33ccae2a2b380393107515b797091a18fab7940918be22bc61e35d9df6880751c1a8746ef20a41de0f3c306d2c78228c89b1c598555795c8f0ad61d0534bdc7a2d") r0 = getpid() ioprio_set$pid(0x1, r0, 0x7fff) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000180)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x80, 0x800) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000200)='tls\x00', 0x4) ioprio_get$uid(0x4000000000002, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000040)=r0) 13:54:56 executing program 1: syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000100)="0243443030310100004c0049004e0055005800200020002000200020002000200020002000200020004300440052004f004d002000200020002000200020002000200020002000200000000000000000bb000000000000bb252f4399f34f9ddbe6e6ecd2aff21aff7ba0113b774c8b8d31b14d774a23fb939e74cb4b2d59b07ae594", 0x82, 0x9000}], 0x0, &(0x7f0000000040)) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r1 = fcntl$getown(0xffffffffffffffff, 0x9) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000200)=r1) 13:54:56 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = fcntl$getown(0xffffffffffffffff, 0x9) r2 = syz_open_procfs(r1, &(0x7f00000008c0)="6e65742f6e65746c696e6b002e54928ad0b9dc6cbff0938ea9956f0523371fb36347bcf066ada95110fc1d3e9621bb381f24c50b0ea9a98c7e031f9631871530cc0fef01ec585efffbdc3be35381f3a62975a9528b4cd4de2b50a07cdb0677b6e1ade5f526f38797116d7e471f1bd3f9d693dd2a7b1fd88844b961fa4a1e045ebe559d11478ff758abb64a3e08d56d4772bbc28ae9fbf7a504329db7566749e6279af8abaf484c47f39e91019bde3f85b316be4b533ba02dcea4f0857b43b9df99fbfe38271bce70b57dcae3d7d357a1833546eb5ed84c22d82228c407c3a3904c7fda1852675fd93d552049fc34d3b0036beb29c314c35014600644055ce645e6f1177ff5ffe5ce05fa809bc99d70a892d9fa29115e30fd39a2d3102a9c7897721752c7e80d12e5718d34afac17c793dd1aa7973c9d1bf036752c469e2a28e08e5d9abbc3df6f0e21a21e4acb2ea8e400a2795858b53c85cc7afaf7952c555be6ca93b5fb78ce26b1985f") sendto$inet6(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="2590e75c412f44", 0x7, 0x4004040, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r0, &(0x7f0000000340)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$SG_GET_ACCESS_COUNT(0xffffffffffffffff, 0x2289, &(0x7f00000004c0)) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) getsockopt$sock_timeval(r3, 0x1, 0x14, &(0x7f0000000100), &(0x7f0000000140)=0x10) syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000002c0), &(0x7f0000000300)=0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) write$9p(0xffffffffffffffff, &(0x7f0000000400)="f6110892f57227e4f3246e09436754dfcdfc59f4af88e13a614e4aea845a3f1d06c2cf1141e5bfa6fa07a5bc1d47ea712bcd4b6ebc92ef0295586c8ae71cb96da96474613fada784e297725e751bbc9cd26ddfadf9feb49e5ea21737", 0x5c) add_key$user(&(0x7f0000000180)='user\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000140), 0xfffffffffffffff5, 0xfffffffffffffff9) add_key(&(0x7f0000000540)='asymmetric\x00', &(0x7f0000000580)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000005c0), 0x0, 0xfffffffffffffff9) keyctl$search(0xa, 0x0, &(0x7f0000000480)='cifs.idmap\x00', &(0x7f0000000500), 0x0) sendto$inet(r3, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) writev(r3, &(0x7f0000001400)=[{&(0x7f00000013c0)='8', 0x1}], 0x1) sendto$inet(r3, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) [ 373.923016] binder: undelivered TRANSACTION_ERROR: 29201 13:54:57 executing program 1: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 13:54:57 executing program 2: syz_mount_image$ext4(&(0x7f0000000340)='ext3\x00', &(0x7f0000000100)='./file0\x00', 0x4, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)="00010000003c4f0081000000c927738ba77fe644cb000000000000e7ffffff00002000000020000000010000000000016e1fbe5a0000ff7f53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000180)=ANY=[@ANYRESOCT]) [ 374.011823] binder: BINDER_SET_CONTEXT_MGR already set [ 374.047486] binder: 25621:25623 ioctl 40046207 0 returned -16 [ 374.063588] binder: 25621:25626 ERROR: BC_REGISTER_LOOPER called without request [ 374.064366] binder: 25621:25626 got transaction to invalid handle [ 374.064375] binder: 25621:25626 transaction failed 29201/-22, size 0-0 line 3013 [ 374.082915] IPVS: Creating netns size=2536 id=46 [ 374.196659] binder: undelivered TRANSACTION_ERROR: 29201 [ 374.242357] binder: BINDER_SET_CONTEXT_MGR already set [ 374.260037] binder: 25583:25637 ioctl 40046207 0 returned -16 [ 374.272739] binder_alloc: 25583: binder_alloc_buf, no vma [ 374.278443] binder: 25583:25595 transaction failed 29189/-3, size 134217728-9007207844675584 line 3136 [ 374.292928] binder: 25583:25637 ERROR: BC_REGISTER_LOOPER called without request [ 374.318300] binder: undelivered TRANSACTION_ERROR: 29201 [ 374.318474] binder: undelivered TRANSACTION_ERROR: 29201 13:54:57 executing program 2: sched_setaffinity(0x0, 0xfffffffffffffdaa, &(0x7f0000000240)=0x1) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) ioctl$TCGETA(r1, 0x5405, &(0x7f00000000c0)) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000140)={0x0, 0x9, 0x7ff, 0x3, 0x1ff, 0x80, 0x8, 0x1, 0x80000000, 0x400}) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_vs\x00') ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000180)={0x19abaaa9, 0x93ed, 0x1, 'queue1\x00', 0x5}) preadv(r2, &(0x7f00000017c0), 0x1fe, 0x400000000000) 13:54:57 executing program 4: timer_create(0xffbffffffffffff0, &(0x7f0000000100)={0x0, 0x20, 0x0, @thr={&(0x7f0000000080), &(0x7f0000000140)}}, &(0x7f0000000400)) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x200000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@acquire={0x40046305, 0x3}], 0x0, 0x0, &(0x7f0000000080)}) clone(0x0, &(0x7f00000000c0), &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) timer_gettime(0x0, &(0x7f0000000240)) 13:54:57 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000009c0)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0xc) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFADDR(0xffffffffffffffff, 0x8915, &(0x7f0000000180)={'sit0\x00', {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}}}) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setregid(0x0, 0x0) rmdir(&(0x7f0000000240)='./file0//ile0\x00') ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) fchownat(r0, &(0x7f0000000940)='./file0\x00', r1, r2, 0x1100) execveat(r0, &(0x7f0000000340)='./file0//ile0\x00', &(0x7f0000000700)=[&(0x7f0000000440)='\x00', &(0x7f0000000480)='sit0\x00', &(0x7f0000000600)='cgroup2\x00', &(0x7f0000000640)='\x00', &(0x7f00000006c0)='/proc/self/net/pfkey\x00'], &(0x7f0000000840)=[&(0x7f0000000740)='eth0ppp0\\ppp1@\x00', &(0x7f0000000780)='\x00', &(0x7f00000007c0)='\x00', &(0x7f0000000800)='/dev/rtc0\x00'], 0x800) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000280)) write$P9_RFSYNC(r3, &(0x7f0000000980)={0x7, 0x33, 0x2}, 0x7) socketpair$inet6(0xa, 0x0, 0x300000000000, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet6(0xa, 0x1000000000002, 0x1) ioctl(r6, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mkdir(&(0x7f0000000680)='./file0//ile0\x00', 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000a80)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000000ac0)={{{@in=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000bc0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000cc0)={'team0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000d00)={{{@in=@loopback, @in6=@dev}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000e00)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000e40)={@remote, @dev}, &(0x7f0000000e80)=0xc) recvmsg(r0, &(0x7f0000001240)={&(0x7f0000001080)=@ll, 0x80, &(0x7f0000001180)=[{&(0x7f0000001100)=""/94, 0x5e}], 0x1, &(0x7f00000011c0)=""/67, 0x43, 0x100}, 0x2040) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001280)={{{@in=@local, @in6}}, {{@in=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000001380)=0xe8) accept$packet(r3, &(0x7f00000065c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000006600)=0x14) accept$packet(r3, &(0x7f0000006700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000006740)=0x14) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000006780)={'veth1\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000067c0)={{{@in6=@ipv4={[], [], @multicast1}, @in=@multicast2}}, {{@in=@rand_addr}, 0x0, @in6=@mcast1}}, &(0x7f00000068c0)=0xe8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000006c40)={@empty, @local}, &(0x7f0000006c80)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000006cc0)={{{@in=@remote, @in6=@local}}, {{@in=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000006dc0)=0xe8) getpeername$packet(r3, &(0x7f0000006e00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000006e40)=0x14) accept(r6, &(0x7f0000008340)=@xdp, &(0x7f00000083c0)=0x80) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000008540)={'team0\x00'}) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000008780)={{{@in6, @in=@local}}, {{@in6=@mcast2}, 0x0, @in=@dev}}, &(0x7f0000008880)=0xe8) getsockname$packet(r0, &(0x7f0000008a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000008ac0)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000008b40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000008b80)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000008bc0)={{{@in6=@dev, @in6}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000008cc0)=0xe8) getsockname$packet(r3, &(0x7f0000008e00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000008e40)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000090c0)={{{@in=@local, @in6}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f00000091c0)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000009200)={@multicast2, @remote}, &(0x7f0000009240)=0xc) accept$packet(r3, &(0x7f00000092c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000009300)=0x14) getsockname$packet(r3, &(0x7f0000009340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000009380)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f00000093c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000009400)=0x14) recvmmsg(r4, &(0x7f000000e200)=[{{0x0, 0x0, &(0x7f00000099c0)=[{&(0x7f0000009800)=""/164, 0xa4}, {&(0x7f00000098c0)=""/238, 0xee}], 0x2, &(0x7f0000009a00)=""/22, 0x16, 0x7}}, {{&(0x7f0000009a40)=@ethernet={0x0, @local}, 0x80, &(0x7f0000009d40)=[{&(0x7f0000009ac0)=""/211, 0xd3}, {&(0x7f0000009c80)=""/164, 0xa4}], 0x2, &(0x7f0000009d80)=""/198, 0xc6, 0x1}}, {{&(0x7f0000009e80)=@alg, 0x80, &(0x7f000000af40)=[{&(0x7f0000009f00)=""/3, 0x3}, {&(0x7f0000009f40)=""/4096, 0x1000}], 0x2, &(0x7f000000af80)=""/251, 0xfb, 0x56}, 0x1}, {{0x0, 0x0, &(0x7f000000c580)=[{&(0x7f000000c3c0)=""/5, 0x5}, {&(0x7f000000c400)=""/214, 0xd6}, {&(0x7f000000c500)=""/65, 0x41}], 0x3, 0x0, 0x0, 0x4}}, {{&(0x7f000000db40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f000000dc00)=[{&(0x7f000000dbc0)=""/19, 0x13}], 0x1, 0x0, 0x0, 0x4}}, {{0x0, 0x0, &(0x7f000000de80)=[{&(0x7f000000dc40)=""/103, 0x67}, {&(0x7f000000dcc0)}, {&(0x7f000000dd00)=""/113, 0x71}], 0x3, &(0x7f000000df00)=""/150, 0x96}, 0x6}], 0x6, 0x2, &(0x7f000000e440)={0x77359400}) sendmsg$TEAM_CMD_NOOP(r5, &(0x7f000000f080)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x140}, 0xc, &(0x7f000000f040)={&(0x7f000000e480)=ANY=[@ANYBLOB="e4000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000ffdbdf250000000008000100", @ANYRES32=r7, @ANYBLOB="7c0002003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r8, @ANYBLOB="40000100240001006d6f646500000000000000000000000000000000000000000000000000000000080003000500000010000400726f756e64726f62696e0000", @ANYRES32=0x0, @ANYBLOB="4400020040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=0x0, @ANYBLOB='\b\x00\a\x00\x00\x00\x00\x00'], 0xe4}, 0x1, 0x0, 0x0, 0x4040}, 0x20000000) 13:54:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) timer_create(0x7, &(0x7f00000002c0)={0x0, 0x2b, 0x3, @thr={&(0x7f0000000540)="6617d164ba4d3c698e67eb60010720d8796fd0bdc6ed0dfe5730b6e5090e08d5927fac9cae34119a7b272d4896434d38583bd77b522e889b4b03059907694c40c2fa4a667bbbe5ea40b7a1c260e467ddbd1773948640dcf9746b4c5a6c7d7735866366232acb9b910f74c1e0966a1425551943de6dceac439cd7aaf65e3b99610529007d34f0e51e5d1827314404f7b6f7dfed1b09c0d583e20e0c628e46289c46f97908217d0a9e371a5efbd85145a1177887ac7f938f4ac2bdfe05ea61f56f412ed1574e573059dfc7e0f8b2", &(0x7f0000000280)="34e80c4d996810b0c51602ed47fa007c55e18e26416f534b296c5244224732c21a1bc704a12bfdfe42c28476d13fb7ec85"}}, &(0x7f00000003c0)=0x0) timer_gettime(r2, &(0x7f0000000400)) r3 = getpgrp(0xffffffffffffffff) fcntl$lock(r1, 0x7, &(0x7f0000000640)={0x1, 0x2, 0x8, 0x3, r3}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xfffffd8e, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f0000000180)="dfa9e55e658f98e4f5d2116c872a3eec7fdb080baf0f58ab3484d208793054590dec6a72d4cb637834b73df40985d9b84de288c7cabba56df39980d68ee0e7559599fbb59f"}) ioctl$FIBMAP(r1, 0x1, &(0x7f00000000c0)=0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) write$binfmt_elf64(r0, &(0x7f0000000480)={{0x7f, 0x45, 0x4c, 0x46, 0x4000006, 0x200, 0x42, 0x100000001, 0x8, 0x2, 0x3e, 0x1f, 0x314, 0x40, 0x29, 0x61b, 0x8001, 0x38, 0x1, 0x420000000, 0x9, 0x1}, [{0x70000000, 0xfff, 0x8000, 0x7fffffff, 0x9, 0xffffffff, 0xa, 0x22}], "f1c1dab433c4a28a2c47a0d206ecc7e150eec082faad462862a178267ddf22652081b82e673eea5259ea93bdceb287aeb3b5a4d3604c1a9aa655e9779c203cb42a1e12592bb4"}, 0xbe) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0018150000"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:57 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:57 executing program 3: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) fcntl$getflags(r0, 0x1) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000040)={0x2, 0x1, 0xfffffffffffffffe}) 13:54:57 executing program 7: socketpair$unix(0x1, 0x100000000005, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0x10, 0x6, 0x7fffffd) sendmsg(r2, &(0x7f0000000140)={&(0x7f0000000200)=@nl, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000080)="5500000018007f7500fe01b2a4a280930a06000000a8430891120000390008000a000a00060000001900a30700000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab91d4", 0x55}], 0x1, &(0x7f0000000180)}, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x4600, 0x8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000180)=0xc) fstat(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ENTRY(r3, &(0x7f0000000380)={0x90, 0x0, 0x8, {0x6, 0x2, 0x9, 0x5c5d, 0x1, 0x3, {0x2, 0x6c0, 0xfff, 0xffffffff, 0x8000, 0x1, 0x8, 0x800, 0x101, 0x81, 0x401, r4, r5, 0x5, 0x1}}}, 0x90) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) fallocate(r0, 0x2, 0x0, 0x4) [ 374.356020] binder: undelivered TRANSACTION_ERROR: 29189 13:54:57 executing program 2: futex(&(0x7f0000000040)=0x4, 0xb, 0x4, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000080), 0x0) futex(&(0x7f000000cffc), 0x800000000005, 0x0, &(0x7f0000000180)={0x77359400}, &(0x7f0000000040), 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x100, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f00000001c0)={{0x0, 0x8000}, 'port0\x00', 0x10, 0x2, 0x0, 0x3, 0x1, 0x1, 0x28bf292c, 0x0, 0x7, 0x8001}) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffc) [ 374.454091] binder: 25649:25655 ERROR: BC_REGISTER_LOOPER called without request [ 374.502906] binder: BINDER_SET_CONTEXT_MGR already set [ 374.522300] binder_alloc: 25649: binder_alloc_buf, no vma [ 374.522324] binder: 25649:25666 transaction failed 29189/-3, size 0-0 line 3136 [ 374.577389] binder: release 25649:25655 transaction 528 out, still active [ 374.577562] binder_alloc: 25649: binder_alloc_buf, no vma [ 374.577591] binder: 25659:25671 transaction failed 29189/-3, size 24-8 line 3136 [ 374.578245] binder: 25659:25671 ioctl 1 200000c0 returned -22 [ 374.578334] binder: 25659:25671 ERROR: BC_REGISTER_LOOPER called without request 13:54:57 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = epoll_create(0x80000432c) r3 = epoll_create(0x3) r4 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f000000e000)) r5 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000140)="9efa49ac42b45b625737f57b70bb4adea604d10fe4fd4b8d48c0bcc50e6e40c6efb92dc51faf87068d26d560e338e9139182dda342da79f6a16203b6fc0067d5ff9cab14764df6da9560303ca2eeaba161f6118de9b0", 0x56, 0xffffffffffffffff) r6 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000240)="d8941bd54df4f40a5dbbb0ba67ca7863eda20613731e06e71e765e14b87275287b8082ace4fa864a617003d711c535f0720aea5ae7101cb5d9d2c4c1a3590e5cc32c2fffd7b58edd6f005c1da2d8e334e7ed090b7e630827d4b3210c85c74e08c11bd75e215e90e8d349e8b81259", 0x6e, 0xffffffffffffffff) r7 = add_key(&(0x7f00000002c0)='encrypted\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000340)="0b150ea6fba6911f5d602ac226fa4aa9159c311b675de90a1beab3a7a9f59f84edd52e40260d16136a8fc595dc025bb30384f06f9fca4c6cd0d67e149744b42171842e4c2fbd858f47aaba06e313ccff1b8ccb7555170733bcd865de3651805bce530dc79f397580ee46673653b457cf1fe5c4450c22fd3f27dc53cfcea48989e0e6aa274b35049cc006", 0x8a, 0xfffffffffffffffa) keyctl$dh_compute(0x17, &(0x7f0000000400)={r5, r6, r7}, &(0x7f0000000440)=""/117, 0x75, &(0x7f0000000600)={&(0x7f00000004c0)={'md4-generic\x00'}, &(0x7f0000000500)="9354fc68c264bfdb8593923a221ae722e8f2724b6a28c0419f221b7b150675fa5b9bff4b596088b7904cd44599e5f3ddf5131efbd36cca39d908c6ff3f5443b543aef4d69b5de36981f8e63f498cc7c1e7331cdd940660768631372240e57bd96e9e462e717659617d98642a213294c350a83dd935fd63f2217f0c4eb2eba46b40b769708f6c81cde171c67851f99dd395bfb59e46a0b72da2a08accda48bbf8d3dc088fe291415ef5d359576c46e7475aa9da5cab2eee3100022b05240ad62b51d017c623d8499e20c019792f4a9bca5f6456", 0xd3}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000001c0)) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r0, &(0x7f000000d000)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f000000dff4)) r8 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r2, &(0x7f0000c7f000)) 13:54:57 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x7d7, 0x6, 0xfffffffffffffffe, 0x8, 0x0, 0x8, 0x40000, 0xc, 0x0, 0x5, 0x7fff, 0x3833, 0xff, 0x7, 0x401, 0x4, 0x9, 0x0, 0x3, 0x8, 0x7ff, 0x4, 0x5, 0x2, 0x2, 0x9, 0x1, 0x80000001, 0x2, 0xffff, 0x3, 0x2, 0xff, 0x9, 0xfff, 0x2, 0x0, 0x1000, 0x6, @perf_config_ext={0xb0, 0x2}, 0x0, 0x7, 0x6, 0x6, 0x72b, 0x1da7, 0xfffffffffffffffc}, 0xffffffffffffffff, 0x7, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000040)) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='memory.swap.current\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f00000001c0)=""/194) ioctl(r0, 0x8912, &(0x7f00000002c0)="0a5cc80700315f85715070") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_int(r3, 0x1, 0x2b, &(0x7f000059dffc), &(0x7f0000000100)=0x4) finit_module(r2, &(0x7f0000000080)='memory.swap.current\x00', 0x2) 13:54:57 executing program 7: r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10c) ioctl$RTC_PLL_SET(r0, 0x40207012, &(0x7f0000000140)={0xfff, 0x3, 0x0, 0x8d4, 0x1, 0x7, 0x23}) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in6=@ipv4={[], [], @rand_addr}}}, {{@in6}, 0x0, @in6=@loopback}}, 0xb) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000180)={0x10000000}) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) close(r1) 13:54:57 executing program 5: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) renameat2(r0, &(0x7f00000002c0)='./file0\x00', r1, &(0x7f0000000340)='./file0\x00', 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/rfkill\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) fchown(r2, 0x0, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000000)) socket$l2tp(0x18, 0x1, 0x1) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer\x00', 0x4000, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r4, 0x29, 0xd3, &(0x7f0000000400)={{0xa, 0x4e22, 0x100, @remote, 0x74d5}, {0xa, 0x4e22, 0x40, @empty, 0xfffffffffffffffe}, 0x10000, [0x3f, 0x80000000, 0x7494, 0x2, 0x7, 0x8e8, 0x6, 0xe4aa00000000]}, 0x5c) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30340237e7d2f592000000200001040000ff030000000065dc67330000000800000000"], 0x1}}, 0x0) 13:54:57 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 374.636604] binder: 25659:25681 unknown command 1382400 [ 374.638283] binder: 25659:25664 ioctl 40046207 0 returned -16 13:54:57 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000009c0)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0xc) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFADDR(0xffffffffffffffff, 0x8915, &(0x7f0000000180)={'sit0\x00', {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}}}) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setregid(0x0, 0x0) rmdir(&(0x7f0000000240)='./file0//ile0\x00') ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) fchownat(r0, &(0x7f0000000940)='./file0\x00', r1, r2, 0x1100) execveat(r0, &(0x7f0000000340)='./file0//ile0\x00', &(0x7f0000000700)=[&(0x7f0000000440)='\x00', &(0x7f0000000480)='sit0\x00', &(0x7f0000000600)='cgroup2\x00', &(0x7f0000000640)='\x00', &(0x7f00000006c0)='/proc/self/net/pfkey\x00'], &(0x7f0000000840)=[&(0x7f0000000740)='eth0ppp0\\ppp1@\x00', &(0x7f0000000780)='\x00', &(0x7f00000007c0)='\x00', &(0x7f0000000800)='/dev/rtc0\x00'], 0x800) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000280)) write$P9_RFSYNC(r3, &(0x7f0000000980)={0x7, 0x33, 0x2}, 0x7) socketpair$inet6(0xa, 0x0, 0x300000000000, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet6(0xa, 0x1000000000002, 0x1) ioctl(r6, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mkdir(&(0x7f0000000680)='./file0//ile0\x00', 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000a80)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000000ac0)={{{@in=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000bc0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000cc0)={'team0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000d00)={{{@in=@loopback, @in6=@dev}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000e00)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000e40)={@remote, @dev}, &(0x7f0000000e80)=0xc) recvmsg(r0, &(0x7f0000001240)={&(0x7f0000001080)=@ll, 0x80, &(0x7f0000001180)=[{&(0x7f0000001100)=""/94, 0x5e}], 0x1, &(0x7f00000011c0)=""/67, 0x43, 0x100}, 0x2040) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001280)={{{@in=@local, @in6}}, {{@in=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000001380)=0xe8) accept$packet(r3, &(0x7f00000065c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000006600)=0x14) accept$packet(r3, &(0x7f0000006700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000006740)=0x14) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000006780)={'veth1\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000067c0)={{{@in6=@ipv4={[], [], @multicast1}, @in=@multicast2}}, {{@in=@rand_addr}, 0x0, @in6=@mcast1}}, &(0x7f00000068c0)=0xe8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000006c40)={@empty, @local}, &(0x7f0000006c80)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000006cc0)={{{@in=@remote, @in6=@local}}, {{@in=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000006dc0)=0xe8) getpeername$packet(r3, &(0x7f0000006e00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000006e40)=0x14) accept(r6, &(0x7f0000008340)=@xdp, &(0x7f00000083c0)=0x80) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000008540)={'team0\x00'}) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000008780)={{{@in6, @in=@local}}, {{@in6=@mcast2}, 0x0, @in=@dev}}, &(0x7f0000008880)=0xe8) getsockname$packet(r0, &(0x7f0000008a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000008ac0)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000008b40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000008b80)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000008bc0)={{{@in6=@dev, @in6}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000008cc0)=0xe8) getsockname$packet(r3, &(0x7f0000008e00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000008e40)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000090c0)={{{@in=@local, @in6}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f00000091c0)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000009200)={@multicast2, @remote}, &(0x7f0000009240)=0xc) accept$packet(r3, &(0x7f00000092c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000009300)=0x14) getsockname$packet(r3, &(0x7f0000009340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000009380)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f00000093c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000009400)=0x14) recvmmsg(r4, &(0x7f000000e200)=[{{0x0, 0x0, &(0x7f00000099c0)=[{&(0x7f0000009800)=""/164, 0xa4}, {&(0x7f00000098c0)=""/238, 0xee}], 0x2, &(0x7f0000009a00)=""/22, 0x16, 0x7}}, {{&(0x7f0000009a40)=@ethernet={0x0, @local}, 0x80, &(0x7f0000009d40)=[{&(0x7f0000009ac0)=""/211, 0xd3}, {&(0x7f0000009c80)=""/164, 0xa4}], 0x2, &(0x7f0000009d80)=""/198, 0xc6, 0x1}}, {{&(0x7f0000009e80)=@alg, 0x80, &(0x7f000000af40)=[{&(0x7f0000009f00)=""/3, 0x3}, {&(0x7f0000009f40)=""/4096, 0x1000}], 0x2, &(0x7f000000af80)=""/251, 0xfb, 0x56}, 0x1}, {{0x0, 0x0, &(0x7f000000c580)=[{&(0x7f000000c3c0)=""/5, 0x5}, {&(0x7f000000c400)=""/214, 0xd6}, {&(0x7f000000c500)=""/65, 0x41}], 0x3, 0x0, 0x0, 0x4}}, {{&(0x7f000000db40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f000000dc00)=[{&(0x7f000000dbc0)=""/19, 0x13}], 0x1, 0x0, 0x0, 0x4}}, {{0x0, 0x0, &(0x7f000000de80)=[{&(0x7f000000dc40)=""/103, 0x67}, {&(0x7f000000dcc0)}, {&(0x7f000000dd00)=""/113, 0x71}], 0x3, &(0x7f000000df00)=""/150, 0x96}, 0x6}], 0x6, 0x2, &(0x7f000000e440)={0x77359400}) sendmsg$TEAM_CMD_NOOP(r5, &(0x7f000000f080)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x140}, 0xc, &(0x7f000000f040)={&(0x7f000000e480)=ANY=[@ANYBLOB="e4000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000ffdbdf250000000008000100", @ANYRES32=r7, @ANYBLOB="7c0002003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r8, @ANYBLOB="40000100240001006d6f646500000000000000000000000000000000000000000000000000000000080003000500000010000400726f756e64726f62696e0000", @ANYRES32=0x0, @ANYBLOB="4400020040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=0x0, @ANYBLOB='\b\x00\a\x00\x00\x00\x00\x00'], 0xe4}, 0x1, 0x0, 0x0, 0x4040}, 0x20000000) [ 374.669040] binder: unexpected work type, 4, not freed [ 374.669044] binder: undelivered TRANSACTION_COMPLETE [ 374.669090] binder: release 25649:25655 transaction 528 in, still active [ 374.669095] binder: send failed reply for transaction 528, target dead [ 374.669124] binder: undelivered TRANSACTION_ERROR: 29189 [ 374.722153] binder: 25659:25681 ioctl c0306201 20000080 returned -22 13:54:57 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:57 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x7ff, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000140)) setresuid(0x0, r2, 0x0) r3 = syz_open_dev$mice(&(0x7f0000000200)='/dev/input/mice\x00', 0x0, 0x20000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000000280)={{0x2, 0x9}, 0x1, 0xffffffffffffff21, 0x88a3, {0x1, 0x9}, 0x0, 0xffff}) setresuid(r2, r2, r2) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f00000000c0)={0x7, 0x70, 0x9, 0x8, 0xffffffffffffe673, 0x400, 0x0, 0x800, 0x20005, 0xd, 0x8001, 0x14bf, 0x99, 0x0, 0xfffffffffffffffe, 0x9, 0x63, 0xff, 0x100000001, 0x4, 0x3d, 0x9, 0x6, 0x6, 0x1, 0x7, 0x3, 0x220c, 0x200, 0x10000, 0xce3, 0x7, 0x6, 0x5, 0x4, 0xf6, 0x17419ac3, 0x5, 0x0, 0x7fff, 0xe001cfcfe6f76054, @perf_config_ext={0x26fe1d13, 0x2}, 0x2, 0x7, 0x8, 0x4, 0x6, 0x6, 0x80}) fcntl$setlease(r1, 0x400, 0xfffffffffffffffc) fgetxattr(r1, &(0x7f0000000180)=@known='com.apple.FinderInfo\x00', &(0x7f00000001c0)=""/33, 0x21) 13:54:57 executing program 4: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000000)) mount(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='pipefs\x00', 0x800000, &(0x7f0000000100)="fb795c0792017bf91a5623866725d121d30909d36623303ec95972ff9639eed05f718a7b1abe9f13edbddecfc73c08ff09f9221ac8a5654a562618184f11792ea7689cb475e5c3219a17a865d024ced06e1305092a9fc8f8285eea95e1e46da31ccda92f7dcd96e04965624a45d3b2e2e26ecdaf65b2c607746c58dab2dfd5d1fd88b79ef622a300298f324aa4553853cb0c46046e26c8da66181e4dc8e64bcb02870491ebe01c3d15da5e34b2c450bb285bec4b14b0a092d7c400efe219071e8f975073") getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f0000000340)=0xe8) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r0, &(0x7f0000001940)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x408}, 0xc, &(0x7f0000001900)={&(0x7f0000000440)={0x14b0, 0x3d, 0x400, 0x70bd2c, 0x25dfdbfd, {0x4}, [@nested={0xc, 0x92, [@typed={0x8, 0x6d, @ipv4}]}, @typed={0x8, 0x38, @ipv4=@multicast1}, @nested={0x2e8, 0x5c, [@generic="ad06219b822d1e86c1784cf62831e102a1568e8a08f03db1fc9ab100d17b0aabdc0861eb48c2ee30d3ae3ee533b986ab75b2694b6a29693fe37e81304b1a34439360ba1473c4c1cc9c78b3a3b3ca649f7e792b452b97c2c0157665cb261f9e2a", @generic="36934c3db325fa62bf9301a755b7fc97722bfdedfe68108b5e49e84b155744c1f48a6b200aac36a8e8e82172ac452dd31de40be7eb38453a1b19ee768e934cc286b9e5ff", @generic="1bcaf0522392e9e1e315794d206ed08c796d7a70ac55b7a085add9642b1b00d48cb5dcc42509e789ad80efebd2e98c5d6a2c8d68bd0ba3a11569cc0fcf1aad7c811fce45c972d71a77d809d2f93e7aaa4aba8d9570a3712b5866060712c4b480309854b334b4ca4e529a", @generic="8648839e51d4d73653911e3649bf64e9e0c4b453ecc27ef24b843c65e5ab33fb56c81768567a372b80bed76183b4ebc22e3b5cda89c34d952d5dea84417c9896e3a0a5818609d7faa369d8ec2adb648593208700e1e5e5bfb21856b313fdd0543dbc1e1c7c873966f2abde14b0c23d761ba5d0ad40d32eab6d", @generic="27c5ae3af179c03bb21288ea6bd5a41869fec9788b0805ef6a99e78556d7f8af0ccc8d97e2c2b938cb30a2192b06563abdc75923f16b594418649c14ac7f46d3cf512e9d7ee60c1b9023038cff7000a8fa48d5369eeb1461fb186e84fa217dff491b90608b420869cc337ee55b499b1a67bb23da17cd12fabd168e490bcb03f3a89110a1db4ce33b179fb9406a652b738a205e0f3357714c4af30f8554fddecf73c8d5cb7c4614925c5af6d076311716d133774dd923c444143e78cb740177f90acb1c8bd20782dfd6ef76ae42337f86066f9a1e585bed9caab7ead99cf9f763f41b1916822dd187d15cef90", @typed={0x8, 0x6, @uid=r1}, @generic="07723fcd6a8460eb877bd6692c63ef7c772768e400e94301c1898d016ed0168937111d2b1c2f42590a40bddc2578cbccd8f7d1279dc965bab4578b01f7b78d00afb16bf0403b5d3b723949b58ff403b296afd12d431d8d0530c1", @typed={0x4, 0x35}, @typed={0x8, 0x4b, @fd=r0}]}, @generic="3d2cb094b4db92aba4467f742ec2e400ac50b0cc0cbc2ba1b0d89918dbc4c228f413ac6375f2479c91c19ed9b2b11b28f512489c8397ef79f9c73360a12369a891a8f01fa42cb5c8846e7ed2a9af1c3ca05ade0012dde13f52371b3389242a799085195a29e82167dbf93f7081ee3d6bbb2f40225905f9db3681be4a4f4f3b14d8205fed30d143c94053517f87628ea3b20698de6a9c5bb7b773afc446ef34d02951ac00f8826a1c7cebb26dc6771a9041d12bc5a88654aa15014fb5fb49ea2a73df302d13ae47fcdbf9a2ff0432ca", @typed={0x8, 0x23, @fd=r0}, @typed={0x8, 0x21, @ipv4=@loopback}, @generic="7563b20af041078b9c028576", @nested={0x1008, 0x87, [@typed={0x4, 0x58}, @generic="632d2903fb3983172677ea77edd8ccfe04e85fe411426e6347802002fbaa3b11aecb69bd1b68c332299c0df538ac9132b0f3bdb64737ab3ca6f55c632ce3223281629467df867fb243ab0fab437e4382da7e2c9460f3bbe84093026f10b3b92d228e4ebaedca8e90a4041039b8381c79d92744328007423b498ba209f8258140efc8dd184120c66c2ceef292647dab678e856890f852d68f1aac1163faf66e623a964a9f3af432674faf571c9b17dac50a18956a57a0141388a4c547debf08827b9cd3aca58ce5a5a3b5dc061a14d733f8e049d80de90d70b8d9bb27b81f8a69245ca791922eebeacc5f3d5387874bcddf6ee0be7eb305e6855f89aedde00bbc3845e91b00758c11f0403949db8683d959dcf9f5dbf30aaab5efdda42c4564cef5bc755f93c2ae5fa382dd5c7434f3f0a1a3cf1b53cb39f17647291325fa1b7559e06fa745444ff320aaae8b7e9e8e189055bbb3bff056bcdff440c486d529e7c95af35a5644f46738f1600f2c3b546a06bba72a7eaff283a35068862cffd5ae3a7801f6e49b2f384d912725a0e79e7a0723297e3baac857151c0e96be1a452fd50d57123f148f76eaf8ac2341dc35c19955cad3c4656dc3ed680a8104bd7fb5bf49881758950bcf42c9c71f4cd89a3e0339e623fce0a1bdc602a30cd85dde17874a5fd13a9b8dc07650b725c413d642ddd421ed81c6fe153c796036d5f1a4c8b991dba736984446b7b1253235318a20be88fbe564eb9f00f1216e4cf723835fd3fbdcfe28a696bae6037b80d5fc42c07d2d47320bb024893d0b83e9d2d7e7fee1e2aa5bb75550b03724638091e1c39048eaa9d2162b1860ea107bf5527bd2f146ba58b7ed42087c34c96c2e9d53d42ed0283e059dc5a73be859f35cb9684d03357078c29242e21c1fb046a132bd3285a1f72e492e90d8d52ea9f55409c31a20dd9b8a0805bb5d0c0225c75214029d20ae01a1b705fafccf0aec68bcd6fa095850e810b79e53f512c8fda2c2ba213659dd037c081e9bd0555be5d2bf44cd188907e0522744c24ccdacb895078a83c46c9defda5724112ba76d87b3b21b327511d827735ce2b42e4dc59495fb4eafb7aee04efc32474aaccceb7df804f13db406bd9134a171499143b6cd278861cf567b3f1dd4eae836164e94a12b339f6065661d24bfda60f79af1e87a5e0b711ea5c66cc2a1290ebc3cd50fc0d240609c9efcd63205aa47a33d09a02359567bd5552bce3fb034abf8edbe6c116e98730121caea4588d2c74b254bbec5b66790ad58eea6048bcc8ecc34586349c46b9b4e328c65109f748d7d83f880dd3573f297dcab75984f4af95b773c0043e94e283ee9667ba15cf8fcfa6235c06bfc94f82b641014f7128f6791d698633084cec28fcf71d1defa61a44ed41ee6820b73a6e34820ac305f8ed20d1961e9ba4e5321d0b29a7af4021a6cb38815a019abf58e51f30f66a3fb37c14f771cb6cf159ab9cd6576f8686655c8521aef95b29d44dc8b7cb73fa3b531811207574559d9ffe53fe6ddc59fef0f8675f68d9f4cc7ef4776a2433a3e1141a05f0cd76a48b133fd16e65e574769d7c15303f48735f20772ebbd5c84d2176a95e6a42e2a0e70517aff352927aa3ed8db41b2d4c1e8914495b6c29ff732779483ecd4625642af883f77ab3ad151604322de7c6b7dc6c9554c5fdf7b760ee3b69fa6dd6d08fcd287efc4892365ce503c8d02d8ab066d7187a2fc6cb98fb9a7f9bea4354a8fb4c7b6fc452e9a808dbaa5d149adf549a9d1b78cf4147168ff2828f17c2402c7dcd71436c10325bb373964492f191c86b10d6355bef0609b1cab08146983930208d681ef98a943f7775a998ab6623f1a5992d0bbf026427a757184f098a775d46772e212f514839892cbf9f3cedfb30fdb606482aaac83cda0f71320b21d641553fee322bd877b6aae9af4f5cfadd16b0044ffe3b4c4c6ad547ab0216e1fef727f39e44526f17aeeb97389b426295afb5197d220d07a7547fb95260ff1904776ed1b30a4fa1ddfc3b70cd88b1edebddcb54d21a6e53d18fc727a6e005fb48c2b4f0729f2eb5bb6ae7cb82a59dcb07e9162534d5d45f057631603fb347ac045bc7505e589c3c657ff188c6f44e3eff410451b58645534d59f0b59487206a2103e0d156c06be8079820773b5a57475a4dffd50caab136c78be0b8132c0c16c1a60700035a13f256c02f815a802779e44feff9ccfac54a8bd3b0a06c12a604ec5709e28545f8a61f72174d615d3c4b68ef8dfda19c55a15c1b4f7209d060d2fc96e5d2e823435442778cfba64c7a8c8bd7dc0488d3516ccee1e66e65c436cec63a1809afecd492bbd2e13a942033c5db5a20fc3166fc2de311ea3eaf59bbb7d6fb3d5517c1107ad4014360a1b9b057f30933ddc62a7473e571ed5f8ad3798f549068ee84a378c43956066493bc104533bc11e577914af47df89c6e74e11fe0ada8d01b4cd4c926e1702a1efde3de74e822d4eb99a9b4b62be8977ac0f5b19464636c0cd5bcf10900626ff4f7c26ee711fd7076362cbe53af78865bd125c83e27da0b1843f8e3436d1470e470f34986c7287d1f8a2310df9b525a9f1d34c37c22ef8c6b69915dbee294af5b0d80bd756986f4155b44874fbc9f7499dc792f7c77e6bcff311dac97fd1f8ed5b6acd1f2ab67b7bc084412595e04324d7cfcd4a3ccbc554413726de59c46578ff7112a6ac06bd335055eef48ba532a09899daabb2311d14f1d60c844576c3e99cdec37b6e8d4a1439d427be8b7be10c492bcdb96a94839121ff202ec2a806b9c9ee7de46a60494a8dccfffc52f1e9da166baae1f3c5bafb039da0062a3698fd4f9b743b58062c24d3d59dc707b51297c7fed0ce2ec46f487f5d95b82b26759650372d39d622fb84e273400d288c78a06e4fdbdb7b9d6fde31564d269ce874408f17ef0c0174e0f4ffe2857e8b99e84a0a7c89f5dd29e78db78166f864f9cdb11835b73b2cd273131e1aef49b08d35a43d22deade895a584ae5b73c9ee7dd16bff423c079ca67bbb999e2546423edc7a1f1b2b393a8a277bb061c4679197d858ccd9476c8f3aca6224ee8bcf9c95cf6b3a29d1616b1ca4e587b0e04fecad1a09b66b5e9139aa11f82db7302145fa6de387a3ebf344ddea79976e096ce5044a9c7010d49676e855cc1f5615ec1de00eec150d5a69480be0e3495b152bba8104921d1aa8079796d47e11725f7e3748da82f2ea56f2ab0cdb7ea1e5dd4b081ceb1db263044ffec1024cab26a4d31049fb6e4488cf2282ddb0e4cf190084a388f3c2dc2f532e173dbcc7584606950526af5c8ea115f9e78e7695c14c74f3968e3ad7284864d8780a78a02752ccc9b6ee717ac0744ffd826393416eee2a7f50d68c842164114fcdbf9d09e67a41adc176e38f7e5bc51f853d5800fb28d35b18894d248954b497abc15b1f1de26fbd1db741c92b1811099a870180fc39ca7af8e78a8044460128f9da5efa99d025db19e3f7b7d04863250fa47a040a0880b0f33ee7c94d54c215a9bf58abfed8939e4c2928216c3d5b10613c3c970445356fb182590e5e27b3076f053e3139374fa1d0ed229d2cf8c55a38b4aac6551df7a5f4fa327660b666c580f5201552c8a469c6e9293549801c6ee48253244bcb55667c1702c55cc16c3982cc283eb0ce1653758c63092e861147f4d238bf65f84c30cb9e23fef703dc6e0013b24a6a5e147ca9a92502d5f916939ce753f7febd0bf7ef2c84c1b2edae26207de775b4affc530cc877fad4fc408cec3d9dce5f34a1de9635b773a76d68c693663158e280a75ff500d357a1134a92c1934f13a183dad3b6eb6859ffe3543edc0e9b209beb837b072d8cc8a322f4eabd9e5f0d560d991459eb4ef7fa0d50ffcc8b6014a32f4ec2efcfb907e5788dfd9fd13a090dc24024362581f4fbb3aaea4b2b9e60869014d10481ee943830881f2414ebc6e219873b4eebf6d8088b89fe0449add87d863f3c9f62deb91a4ca9aaa26a6fb7835b348a6d108599461d169356394e737a60b872478b0417d3b72bb54563af7199c5f9d0d4791f8023d68da9ddc9504a32c5768379a52016e94ef6877adc92532f48aa1c9995c7d866d94914549f34ff1da3911b41eb9ac949810f3103d161b68fb5339fdcff8a532a282b57caa904f61565c9a70445914614bd664f5409fbf2a557743ded2fd7fc9f06ebc29d393477656d4c91c1276529ce4ee0d6a16f4f0a0ec66bd35294b2ad2db471c1a95aa8468797bb5b8b3c7acc53bf2cd63c258b5b3d768a674c3cf4425b9a1039bffbf057eb7c7f5ddb78efad0c0cbd44714cac9b9a500a0db98e0133da395881fa830f849608f4a01f46a2c6216bb099a37f4eb7e1fd37327b862b2b0ddc625269fb166d9017fa81b39532f1d7a12e78cf93d052b8afd06af5a099623f86be9bbb8495e9a8e866cabdf6164c79e830c65d888fa668296a6b7eab1c81cc4f14767d9bf1e41bd4b17106c2ca105983482d96a8c380cb720a0d3243b1f68ab6bb92fd2b0f1285a508a82c3f09b8d93c6f2029026869ee629695452744894af12b666307536651b9d31de71232adf5b69988a9f131333471653cbd46e917177c74015488e504b90b19789bc98f86a96d415efe4729087a2875519042af213abb86c03c6d7d6edbe4d67f6720949655a52cd2cd0e0e91dbc64f364844d1ef90604a99520d6c48871dcc113b4557a455ce23162059906592301c4e8b6e3d9cd4716b7d240393f2e62fc02602348e11a49bda0124a404232fd13c31a635892da5818c79a46ef356e2cd81d4ece434d192c7a6e3afa64a77022f24b5b5b3cf1fd702e734100b600c2ca7660acd5c6436cd75fab6e1ed537540505f1e828c5b102d70169e67e51b3de184e55198375b84aeb66b01f5ad9ca9d77f76dd224bc02d8f67e54de97a4c9a2e64e50f3a653d2dd74179a643f55a83aefcd66db3aeeb98873fcbee27def04ed6c68ca627570f329927ad78d2b53e74b9ecaaf577261db9afd5c50b07033d3e6d43d079972289c4dea00bdbc9386022c54f22c3af3f1c349c4167c90c018574ff2857115eae6ea03d7137eb09a1177b0ef2f01ea6edf38459c78fcd70c8a018fc4d8ba78a063b915c0047a7a2b05fd06871970c62f776e9abb5d499fd14fcf0a0af2e18a996e2963a62c6fec6500a8da7ecdb3b62ee170f0bea49a066bf2be180f6d043fc587af08b889c8bb45ec2410a63dae191f98872132fc864b2f85ae48c3ad113b3b47e33b25ce8e6313837d4edb1efdaf232999a0a6c5127858a9645923e4934d338973915bf2d43d57820b5c499cf64ba57e70a7decb8f64134d976585f6ddc2f7ebe441bcf6c6296ea5ebcc1e0d3bfead84e9ae855b9aaa3e2c7c419c195d73581dff6f61ff5ee0e706c2ba104d815a1dcabd4b50a076ee21d9fb1db996d09d6e2ed12ea35c911ba3d35bae56564155847c5851cb2728b74efa5d087276a8ce835749df29a268e159ad01a41729f1cea3a28754ce2c084151f1f3ab53ef0fe2cf68dcc8fd788a1a70ca6d8b7f0e5775c7b8573f685fc190b329891ab73fe1681ba926cdd2f006afaf724bd129c455cb13af54f61f605c08f4751a871cb89dd151f0a2d0ded31ec08b71c8ab5c96b78483ce223b43ed58c55258f19a16f85dbbe26032b62b15001cdd0029875b6f4ffe8a3586e3cfdf43e4e36854c5c2aa49dc01f8eb47f77a299e494aa19c6b77eef698b8fecb5326dd447b2284040a6326cf6465cfc505456ae573f8b9f43909eb722f6"]}, @nested={0xa8, 0x7, [@typed={0x8, 0x92, @uid=r2}, @typed={0x8, 0x7, @u32=0x6}, @generic="720c8b6c677a5facc92a4541b3635fbd311de2b205ef2372b7a62e9152d93e5d11ec363f74fe061657be8abd7542e48ad702a03e492a290ef7a195a32d81a6000f014426ca1bc3e42e7106ba22aea7839b91a403743eec346dfc71329a0f210b9e44cf62eccb514fa99ea871ee18b91908d7ecd48c09b6e2e1872f0105a8bc39", @generic="0e2bd21c867b3c9bdd5fb236067daae8c9d6360e"]}, @typed={0x4, 0x5}]}, 0x14b0}, 0x1, 0x0, 0x0, 0x50}, 0x51) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000001980)={r0, 0x0, 0x8, 0x2, 0xd0}) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000001a00)={0x8, {0x2, 0x4e21, @multicast2}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, {0x2, 0x4e22, @broadcast}, 0x288, 0x7fff, 0xfffffffffffffff9, 0x2, 0x40, &(0x7f00000019c0)='bcsh0\x00', 0xff, 0x0, 0x8}) write$P9_RLCREATE(r0, &(0x7f0000001a80)={0x18, 0xf, 0x2, {{0x2, 0x1, 0x4}, 0x56}}, 0x18) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000001b00)='fou\x00') sendmsg$FOU_CMD_GET(r0, &(0x7f0000001bc0)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b40)={0x38, r3, 0x0, 0x70bd2a, 0x25dfdbff, {}, [@FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e21}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x7f}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000001}, 0x8001) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000001c00)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_int(r5, 0x6, 0xc, &(0x7f0000001c40)=0x8, 0x4) r6 = inotify_init1(0x80800) fanotify_mark(r0, 0x8, 0x20000, r6, &(0x7f0000001c80)='./file0\x00') setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000001cc0)={0x5, 0x1, 0xff, 0x5, 0x4}, 0xc) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000001d00)='bic\x00', 0x4) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000001d40)=0x0) fcntl$setownex(r0, 0xf, &(0x7f0000001d80)={0x1, r7}) ioctl$void(r6, 0x5450) write$P9_RSTAT(r0, &(0x7f0000001dc0)={0x7a, 0x7d, 0x2, {0x0, 0x73, 0x3, 0x8, {0x8, 0x3, 0x8}, 0x20200000, 0x20, 0x8, 0xffffffff00000001, 0x4, 'fou\x00', 0x1c, 'mime_typeselfeth0$eth0system', 0x6, 'bcsh0\x00', 0x1a, 'securitywlan0procmime_type'}}, 0x7a) ioctl$sock_inet_SIOCDARP(r4, 0x8953, &(0x7f0000001e40)={{0x2, 0x4e21, @multicast1}, {0x306}, 0x6, {0x2, 0x4e20, @multicast2}, 'irlan0\x00'}) execveat(r0, &(0x7f0000001ec0)='./file0\x00', &(0x7f0000001f40)=[&(0x7f0000001f00)="776c616e31706f7369785f61636c5f616363657373a270726f6326657468316e6f6465762600"], &(0x7f0000001fc0)=[&(0x7f0000001f80)='bcsh0\x00'], 0x800) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000002000)={{{@in=@multicast2, @in6=@ipv4={[], [], @remote}}}, {{@in6=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000002100)=0xe8) fstatfs(r0, &(0x7f0000002140)=""/124) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000021c0), 0x4) r8 = pkey_alloc(0x0, 0x3) pkey_mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2, r8) setsockopt$inet_tcp_int(r5, 0x6, 0x8, &(0x7f0000002200)=0x5, 0x4) perf_event_open(&(0x7f0000002280)={0x5, 0x70, 0xb6fa00, 0x8, 0x6, 0x3, 0x0, 0x84b, 0x80400, 0x4, 0xfff, 0x7, 0x10001, 0x2, 0xffffffffffffff00, 0x1, 0x400, 0x9, 0x9, 0x0, 0x7ff, 0x1, 0xfffffffffffffff9, 0xb3c0000000000000, 0x7, 0x1, 0x3, 0x8, 0x7, 0x1, 0x8, 0x7fff, 0x3, 0x1, 0x9, 0x1f, 0x5, 0x7ff, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000002240), 0xa}, 0x100, 0x5, 0x9, 0x7, 0x14e, 0x100000000, 0x3}, r7, 0xf, 0xffffffffffffffff, 0x1) [ 374.731647] binder: 25691:25697 ERROR: BC_REGISTER_LOOPER called without request [ 374.731763] binder_alloc: 25691: binder_alloc_buf, no vma [ 374.731782] binder: 25691:25697 transaction failed 29189/-3, size 0-0 line 3136 [ 374.732075] binder: release 25691:25697 transaction 534 out, still active [ 374.732080] binder: unexpected work type, 4, not freed [ 374.732082] binder: undelivered TRANSACTION_COMPLETE 13:54:57 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xfffffffffffffffa) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc8070031e5c5914470") r1 = socket$packet(0x11, 0xfffffffffffffffe, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$SIOCSIFMTU(r4, 0x8922, &(0x7f0000000100)={'sit0\x00', 0x800}) r5 = socket$nl_route(0x10, 0x3, 0x0) gettid() ioctl$TUNDETACHFILTER(r3, 0x401054d6, 0x0) ioctl$TIOCMSET(r3, 0x5418, &(0x7f0000000000)=0x3) mkdirat(r4, &(0x7f0000000140)='./file0\x00', 0x0) fcntl$addseals(r1, 0x409, 0x6) sendmsg$nl_route(r5, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="400000001c00200029bd7000fddbdf250a0000005a5123c598cc79d2e65d388e5d991a933d7f1e37b8598f0ecf28b4c5d89e248c1bab7518d36a186df84efe6cdeea834aa9ad38e6a7de1423bec61a65d83a2768d9d59c649356f53b929d7000586bcf2fc6ce1c00000000000000000000000000654ca0d39e27b523e4798a5917bf47a6bc4b", @ANYRES32=r2, @ANYBLOB="8000800f08000100ac14b70000000180000000020000080000000800050003000000"], 0x3}, 0x1, 0x0, 0x0, 0x4}, 0x0) [ 374.739611] binder: release 25691:25697 transaction 534 in, still active [ 374.739616] binder: send failed reply for transaction 534, target dead [ 374.739624] binder: undelivered TRANSACTION_ERROR: 29189 13:54:57 executing program 7: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x818}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x10000000000007) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000140)=@fragment, 0x8) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) fallocate(r0, 0x1, 0x5, 0x8000) sendmmsg(r1, &(0x7f0000000140), 0x7b, 0x0) fcntl$setsig(r0, 0xa, 0x1) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x8000, 0x0) write$selinux_validatetrans(r2, &(0x7f00000001c0)={'system_u:object_r:mail_spool_t:s0', 0x20, 'system_u:object_r:setrans_initrc_exec_t:s0', 0x20, 0xfffffffffffffc00, 0x20, '/usr/sbin/cupsd\x00'}, 0x72) recvfrom$inet(0xffffffffffffffff, &(0x7f0000002580)=""/177, 0xb1, 0x0, &(0x7f0000002640)={0x2, 0x0, @rand_addr}, 0x10) [ 374.869713] binder: 25700:25706 ERROR: BC_REGISTER_LOOPER called without request [ 374.878386] binder_alloc: 25700: binder_alloc_buf, no vma [ 374.884039] binder: 25700:25706 transaction failed 29189/-3, size 0-0 line 3136 [ 374.900829] binder: release 25700:25706 transaction 539 out, still active [ 374.911253] binder: unexpected work type, 4, not freed [ 374.930776] binder: undelivered TRANSACTION_COMPLETE [ 374.936031] binder: release 25700:25706 transaction 539 in, still active [ 374.954786] binder: send failed reply for transaction 539, target dead [ 374.968804] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.291294] binder: 25659:25681 ioctl 1 200000c0 returned -22 [ 375.297353] binder: 25659:25664 unknown command 0 [ 375.297361] binder: 25659:25664 ioctl c0306201 20000440 returned -22 [ 375.309876] binder: 25659:25664 ERROR: BC_REGISTER_LOOPER called without request [ 375.320989] binder: release 25659:25664 transaction 544 out, still active [ 375.328664] binder: unexpected work type, 4, not freed 13:54:58 executing program 0: mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x2001e, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x10400, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ion\x00', 0x10000, 0x0) unlinkat(r1, &(0x7f0000000180)='./file0\x00', 0x200) 13:54:58 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:58 executing program 3: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$P9_RLINK(r0, &(0x7f0000000300)={0x7}, 0x7) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, &(0x7f0000000040)="428e797bf6fe6dbc966e4b2203f4aede1db2296372cf15291f62348ad65c44813926c7dc1214f534dd4e0dd82988f60a3575466ef6ad44ae553ca6773ef147bcdd32081d07c6ccc8a0c611f40f5497bae86e7e0d70a42927b22153b7c87e88ff8fa1bff66063854aa877c6b83554ea96672c608116528ddbbc2483837840f0eaf56054f5d7621074d480073c49e270c2bfd31f26a9ba029afb35fe92bc7f609a8255a9830dbc2e076f92379f5fed8d45d475ebf0f581509feb1da5170db57b21cc7cacc739a01dafc897e51632b9be41e2f966b7e34525ea40f58d3b5948ac5c3a42dfadc6eaeea395cc22fb3d834400f37ffa9d4c07390b55c334cd92713402") r1 = creat(&(0x7f0000000280)='./bus\x00', 0x0) clock_gettime(0x0, &(0x7f0000000500)) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x10000, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x9) ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) faccessat(r3, &(0x7f00000003c0)='./file0\x00', 0x80, 0x600) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_NAME(0xffffffffffffffff, 0x81007702, &(0x7f00000006c0)=""/4096) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r2, &(0x7f00000004c0)={0x80000000}) open$dir(&(0x7f0000001740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x101000, 0x0) write$tun(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[], 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000480)={0x5, 0x2, 0x400, 0x10001, 0xf8e, 0x9}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000005c0)={0x5, 0xffffffffffffffff, 0x0, 0xc8, 0x5}, 0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="244000001900bea2a2543f4a05f3209d"], 0x1}}, 0x0) mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/status\x00', 0x0, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x400000003, 0x0) getpeername(r3, &(0x7f0000000400)=@vsock={0x28, 0x0, 0x0, @hyper}, &(0x7f0000000340)=0x80) r5 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x8) chmod(&(0x7f0000000380)='./file0\x00', 0xa3) dup2(r5, r4) [ 375.342672] binder: undelivered TRANSACTION_COMPLETE [ 375.348868] binder: release 25659:25664 transaction 544 in, still active [ 375.365367] binder: send failed reply for transaction 544, target dead [ 375.373113] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.421521] binder: 25734:25736 ERROR: BC_REGISTER_LOOPER called without request [ 375.421873] binder: 25735:25737 ERROR: BC_REGISTER_LOOPER called without request [ 375.422806] binder_alloc: 25735: binder_alloc_buf, no vma [ 375.422825] binder: 25735:25737 transaction failed 29189/-3, size 0-0 line 3136 [ 375.423149] binder: release 25735:25737 transaction 548 out, still active [ 375.423155] binder: unexpected work type, 4, not freed [ 375.423157] binder: undelivered TRANSACTION_COMPLETE 13:54:58 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x24000000}, 0x22d, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x48}}, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x690000, 0x0) mq_timedsend(r2, &(0x7f0000000200)="3e5e623af9d98339a50265228212f4bc5333c64fd1bfa2c5580f132639afbe4f08ddc9ce17a44f37d24c23712866cb1b64e04229ae02e8755bc84b3c133247116adcb4379e32708d23f28450a77edf2792ecb0b372f8f50c2d9937fac19917ef82657fbca4418514327c1e4ff3fabad73570499ee4bf67d30c5315b7ba4897cf6287c91ec13444193ce0d92a8ba62cd9dfa6fc9e007f5991138614b325a859b07cad72a8097d0e666c6104d7885ee00513d4ebd666319daf89b74e4bbee1d893a0c78f44c058c926c773a04bb2e5aea7ed00fe6d0e5c7a8f", 0xd8, 0x8, 0x0) 13:54:58 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x10540, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000180)={'broute\x00'}, &(0x7f00000000c0)=0x78) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x100, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000040)='\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) 13:54:58 executing program 4: r0 = accept(0xffffffffffffff9c, &(0x7f0000000440)=@ipx, &(0x7f00000004c0)=0x80) getsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000500), &(0x7f0000000540)=0x4) open(&(0x7f0000000000)='./file0\x00', 0x6000, 0x2) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000100)='eOp\x00\x00\x00\x00\x00\b') kexec_load(0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000000), 0x0, 0x9}], 0x0) 13:54:58 executing program 7: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0x7}, 0x7) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RWALK(r1, &(0x7f0000000140)={0x23, 0x6f, 0x1, {0x2, [{}, {}]}}, 0x23) write$P9_RGETATTR(r1, &(0x7f0000000640)={0xa0, 0x19, 0x2, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0xa0) write$P9_RREADDIR(r1, &(0x7f00000003c0)={0xb, 0x29, 0x2}, 0xb) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access'}}]}}) r2 = open$dir(&(0x7f0000000580)='./file0\x00', 0x200000, 0x0) symlinkat(&(0x7f0000000540)='./file0\x00', r2, &(0x7f00000005c0)='./file0\x00') [ 375.430869] binder: release 25735:25737 transaction 548 in, still active [ 375.430875] binder: send failed reply for transaction 548, target dead [ 375.430882] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.430918] binder: send failed reply for transaction 551 to 25734:25736 [ 375.515449] binder: 25734:25742 got transaction to invalid handle [ 375.532679] binder: 25734:25742 transaction failed 29201/-22, size 0-0 line 3013 [ 375.682435] binder: undelivered TRANSACTION_COMPLETE [ 375.695639] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.706650] binder: undelivered TRANSACTION_ERROR: 29201 13:54:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008010, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback, [0x2, 0x7000028, 0x4002000000000000]}, 0x10) socket$inet(0x2, 0x3, 0xcd27) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='illinois\x00', 0x9) recvfrom(r1, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739e53, 0x120, 0x0, 0x4f) 13:54:58 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000001540)="0a5cc80700315f85714070") add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000001c0), &(0x7f0000000100), 0x0, 0xffffffffffffffff) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000040)) r1 = dup(r0) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f00000000c0)={{0x2, 0x4e24, @multicast1}, {0x7, @local}, 0x2, {0x2, 0x4e24}, 'irlan0\x00'}) clone(0x2818900, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000280), &(0x7f00000002c0)) 13:54:58 executing program 4: r0 = dup(0xffffffffffffffff) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) unshare(0x8000400) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) r2 = fanotify_init(0x0, 0x0) sendmmsg(r1, &(0x7f0000001cc0)=[{{&(0x7f00000019c0)=@l2={0x1f, 0x0, {0x4}}, 0x80, &(0x7f0000001a80), 0x0, &(0x7f0000001ac0)=[{0x20, 0x0, 0x0, "a72b9abbc10d4fb8fcaf71613e35"}], 0x20, 0x20000000}}], 0x1, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ftruncate(r2, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x1f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141041, 0x0) fallocate(r3, 0x1, 0x0, 0x10000101) 13:54:58 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:58 executing program 7: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x40, 0x0) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000280)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x1, 0x0) ioctl$TIOCLINUX7(0xffffffffffffffff, 0x541c, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x5) r1 = gettid() r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000180)='/dev/keychord\x00', 0x0, 0x0) timer_create(0x0, &(0x7f0000000040)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x989680}}, &(0x7f0000000140)) readv(r2, &(0x7f0000002440), 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x32, 0xffffffffffffffff, 0x0) tkill(r1, 0x1000000000015) munlockall() perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 13:54:58 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x24000000}, 0x22d, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x48}}, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x690000, 0x0) mq_timedsend(r2, &(0x7f0000000200)="3e5e623af9d98339a50265228212f4bc5333c64fd1bfa2c5580f132639afbe4f08ddc9ce17a44f37d24c23712866cb1b64e04229ae02e8755bc84b3c133247116adcb4379e32708d23f28450a77edf2792ecb0b372f8f50c2d9937fac19917ef82657fbca4418514327c1e4ff3fabad73570499ee4bf67d30c5315b7ba4897cf6287c91ec13444193ce0d92a8ba62cd9dfa6fc9e007f5991138614b325a859b07cad72a8097d0e666c6104d7885ee00513d4ebd666319daf89b74e4bbee1d893a0c78f44c058c926c773a04bb2e5aea7ed00fe6d0e5c7a8f", 0xd8, 0x8, 0x0) 13:54:58 executing program 1: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270f7", 0x15}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x20, 0x80000000800000, 0x40000008) setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000540)={0x3, {{0x2, 0x4e24}}}, 0x88) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000100)=0x6, 0x4) lstat(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = creat(&(0x7f00000003c0)='./file0\x00', 0x0) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, &(0x7f0000000740)=ANY=[@ANYBLOB]) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000400)={'filter\x00'}, &(0x7f0000000500)=0x54) r4 = creat(&(0x7f00000001c0)='./file0/file0\x00', 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000001000)) socket$netlink(0x10, 0x3, 0x0) perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='fuse\x00', 0x40000, &(0x7f0000000600)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xe000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xa00}}, {@max_read={'max_read', 0x3d, 0x200}}]}}) epoll_wait(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r3, 0x111, 0x4, 0x1, 0x4) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000240)) epoll_create1(0x80000) unshare(0x10000) 13:54:58 executing program 2: r0 = socket(0x14, 0x6, 0x5) write(r0, &(0x7f00000000c0)="2600000022004701050007008980e8ff06006d20002b1f00c0e9ff094a51f10101c7033500b0", 0x26) setsockopt$sock_int(r0, 0x1, 0x20000000000008, &(0x7f0000000000)=0x8000000000000, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mq_notify(0xffffffffffffffff, &(0x7f0000000080)={0x20000000, 0x3, 0x2}) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000100)=0x200000a8, 0xfffffffffffffed8) 13:54:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) lseek(r0, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20013, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:59 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:54:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000080)=0xb4, 0x4) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f00000000c0)=@routing, 0x8) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f0000000300)={0x1, &(0x7f00000002c0)=[{0x6}]}, 0x10) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) ioctl$sock_ifreq(r0, 0x8991, &(0x7f0000000000)={'veth0_to_team\x00', @ifru_flags=0x3000}) shutdown(r0, 0x0) [ 376.029633] binder: 25745:25756 got transaction to invalid handle [ 376.042158] binder: 25745:25749 ERROR: BC_REGISTER_LOOPER called without request [ 376.053040] binder: 25745:25756 transaction failed 29201/-22, size 0-0 line 3013 [ 376.066067] binder: undelivered TRANSACTION_ERROR: 29201 [ 376.184918] binder: 25798:25801 transaction failed 29189/-22, size 24-8 line 3013 [ 376.206981] binder_alloc: 25799: binder_alloc_buf, no vma [ 376.207000] binder: 25799:25804 transaction failed 29189/-3, size 24-8 line 3136 13:54:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$P9_RLINK(r0, &(0x7f0000000300)={0x7}, 0x7) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, &(0x7f0000000040)="428e797bf6fe6dbc966e4b2203f4aede1db2296372cf15291f62348ad65c44813926c7dc1214f534dd4e0dd82988f60a3575466ef6ad44ae553ca6773ef147bcdd32081d07c6ccc8a0c611f40f5497bae86e7e0d70a42927b22153b7c87e88ff8fa1bff66063854aa877c6b83554ea96672c608116528ddbbc2483837840f0eaf56054f5d7621074d480073c49e270c2bfd31f26a9ba029afb35fe92bc7f609a8255a9830dbc2e076f92379f5fed8d45d475ebf0f581509feb1da5170db57b21cc7cacc739a01dafc897e51632b9be41e2f966b7e34525ea40f58d3b5948ac5c3a42dfadc6eaeea395cc22fb3d834400f37ffa9d4c07390b55c334cd92713402") r1 = creat(&(0x7f0000000280)='./bus\x00', 0x0) clock_gettime(0x0, &(0x7f0000000500)) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x10000, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x9) ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) faccessat(r3, &(0x7f00000003c0)='./file0\x00', 0x80, 0x600) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_NAME(0xffffffffffffffff, 0x81007702, &(0x7f00000006c0)=""/4096) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r2, &(0x7f00000004c0)={0x80000000}) open$dir(&(0x7f0000001740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x101000, 0x0) write$tun(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[], 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000480)={0x5, 0x2, 0x400, 0x10001, 0xf8e, 0x9}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000005c0)={0x5, 0xffffffffffffffff, 0x0, 0xc8, 0x5}, 0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="244000001900bea2a2543f4a05f3209d"], 0x1}}, 0x0) mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/status\x00', 0x0, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x400000003, 0x0) getpeername(r3, &(0x7f0000000400)=@vsock={0x28, 0x0, 0x0, @hyper}, &(0x7f0000000340)=0x80) r5 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x8) chmod(&(0x7f0000000380)='./file0\x00', 0xa3) dup2(r5, r4) 13:54:59 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0}) ppoll(&(0x7f0000000280)=[{r0}], 0x1, &(0x7f0000000200)={r1}, &(0x7f0000000240), 0x8) r2 = dup(r0) ioctl$TIOCSBRK(r2, 0x40044591) 13:54:59 executing program 1: mprotect(&(0x7f000004a000/0x4000)=nil, 0x4000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000480)='/dev/full\x00', 0x0, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xffffffffffffffd6, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x2, 0x1000) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x0, 0x0) [ 376.207077] binder: 25799:25804 ERROR: BC_REGISTER_LOOPER called without request [ 376.235955] binder: 25798:25806 ERROR: BC_REGISTER_LOOPER called without request [ 376.243623] binder: 25798:25806 got transaction to invalid handle 13:54:59 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 376.243633] binder: 25798:25806 transaction failed 29201/-22, size 0-0 line 3013 [ 376.255903] binder: 25799:25809 got transaction to invalid handle [ 376.255914] binder: 25799:25809 transaction failed 29201/-22, size 0-0 line 3013 [ 376.308137] binder: undelivered TRANSACTION_ERROR: 29189 [ 376.325196] binder: undelivered TRANSACTION_ERROR: 29201 13:54:59 executing program 4: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000000080)="408fe413e5d1c43c80c2e96ac2fc0bd0fce8a0d7c28cc19f44561aa829121241434144cf0ed67ce3ac838b1e8a0d14c2d256b8cd0fb34652ac4bf8c1f24957cb741cba8ef16f302ce41b16cd5ce9f8317ab8008a944c18727f598c593b746a1f6ee2a737ff541eb740e39d209ec358f01a33deed6c3e260953f3c7fb0f483213b5d3068301") socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ifreq(r0, 0x8931, &(0x7f0000000000)={'bridge0\x00', @ifru_map}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ppp\x00', 0x202, 0x0) [ 376.340367] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 376.450961] binder: BINDER_SET_CONTEXT_MGR already set [ 376.469101] binder: 25820:25823 ioctl 40046207 0 returned -16 [ 376.480897] binder_alloc: 25799: binder_alloc_buf, no vma [ 376.486805] binder: 25820:25823 transaction failed 29189/-3, size 24-8 line 3136 [ 376.495955] binder: 25820:25823 ERROR: BC_REGISTER_LOOPER called without request [ 376.548524] binder: 25820:25828 got transaction to invalid handle [ 376.558684] binder: 25820:25828 transaction failed 29201/-22, size 0-0 line 3013 13:54:59 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000080), 0x10) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b6c, &(0x7f0000001480)) r1 = socket$l2tp(0x18, 0x1, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x10000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$l2tp(r1, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r0) sendmmsg(r1, &(0x7f0000005fc0)=[{{&(0x7f0000005680)=@sco, 0x80, &(0x7f0000005b00)}}, {{&(0x7f0000005b80)=@l2, 0x80, &(0x7f0000005c40), 0x1f4, &(0x7f0000005c80), 0x3a00}}], 0x3e8, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000900), &(0x7f0000000940)=0x14) ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000340)=0x100000000) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xee4f72ee4ff5db95}, 0xc, &(0x7f0000001400)={&(0x7f0000000100)=ANY=[]}}, 0x5) 13:54:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) r2 = add_key(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000001c0)="7901250d59ebb07bcceaf48fcd81e46f97bef346794ac82ea459f3bd24e5b121927c94c68206a072f4456f965b76b35136ee7df027872fc475bc4acc165c626907eeaa7be4df85313a7fa44e2b972e70597384a417f0f19b0e0835e438cceebbcc40fef8467ae9edf7ddd599be", 0x6d, 0x0) add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000300)="5edcf6c28ee10988ab42e588450bbc75993a573bf3c98882cc5211f72e697ee89f7db0aeb8e5e583fddc0acb6fae49109c82bd32d762a7c5aecf6bdfa9a00fe1bb3c63b86a6ddeb07b5d3cd3615c5ccf6625f7db70bb83cc6a17665ea2a7b51aa848f6538ed3325ab523f33e294ff3bb1a83e46eb89678aae177c23b91be27a3836585424b13a8a12ae638a440da8889e5fd8662e137f1efe6d0a529f3b9b9dddad1cb513fbba5239e6edff3356d8f7c206f1df0397ddd58fb8d29b5d9ad309ba90d8b6f51256cd6f6d0f6cf1d1f685763c36ec21d2ae357a86a3c1d1e6e6f6af2bbe8e2e96ba198197aa8a9a01c14aaf9fb34c1086543d56169407632418b1dcf7fe661ad566013fb76968a1ef1fd3b00301531f8bb1d87822ffa579254758889866cf76ef02a854b7d29f51cda418eba40c47663cc5ef1eaf07a26c4a852b855a3a0de52c166a8f6a50f59a9a626c58583160d1f71ccff6f893c434a6e5fca7a5204229460d69037de24553e957718bf0ea3f2c95793a814599632b82ff62583fd4f3ba193f0979e4111413cd2573736c18a2226fbe816dbec1627c8623439ee06499c276f1576a969b20ca28f62646fd9e1679f226f38c16fc3426dcc69fecdd6f28ba3ea728f437f1540f3f251b33c4cc607231b55d961e455c84ee6f19fb08b27a980b7a3b7d7aa593853b064fcb4bb65f90ee1c947ceb9e24f95b706a7433a11c63ced56a17c984d19dca036c9f3a21d8cf0f8659a6f727d70268dc837e1852a40d47145d604a4dbc5c749a6f040ce2e73ab527d17cbf18e46d6889c7751de2c78a3b9f3cde3e3192e0005c00e11bee9762acc7c4849b8aaf8116fd784a17b46a4ef29fa78415411824e06e4f805d18ef7ec1de2a2e348d553bebd7d16956fbd5bd7afdb91851f2406e1014092a74130269d48599e660920bbe24cb412749a79f58f05ab637318bf788325329a5ee6e1ba58ab3b808e0fc854b358aa0aad662d6f3bd17c245bb4aded9260888381b144ab221c94530606baa6ff1b96d418c18f121bcbbd80c0998895a2d66fd79c37ed08e071a689887dd44cf10c8d3fce800ca4b5b30467b6aeac18bc24332617612b4a431945522fa54d27c60d3bdfd77e116eb25cce5c6b66419a8f8fe42cfb5047486ab8c9ee4140c1f93437b498ac28b017de4dea9792749a2e63eb329673869f35dee78f553624594c6f8c228f8ef71f97cd8be077bedf42c9ea0eabd8b4b7ad3e600cb07ca73caca4d7c48f6d7f71c8fce816a22e1f0c3ef12d004b38575ae6202736a1c581ff45e9af33ba9635482082e704f150447562ca62081139968ba798675b041aecaf5b09e7e3f0aced6308761a2e3b735eb26407e92a706a195058f7c7cf7a917ef2e7661c88860b81d1ece63f12b333941847f7795652cd96a3e3b60d03e1986cd7c151f8d60f5edde6d31578f5e850f33a8976dc5470fd18afe7abc724ebc5d779f01ae4262201fd09edcf35b5a988d144e6411917c0772c9e86348a08362f40c02e9080812e95b722f9c8ff0d6fa1989a7815a9983469541121bff9a894b95174c32fe56a9275d0844cdc2235880bed843e36eca6551631ab840f90322650ea3b4f6957b2468c5ddff781b0a6e3b420820174ee7db4cf3cade5744e662e6e1fad531479c9789d1784d389da1b0385a89b2d46ee6f42cb541fbf4a4f644c3a08ee6d743a398db3b5dc2f97c161d4456ffe31aa10cbdbf57d7c5bf493fdd11fbb330523c4674106dad6ac2fa6a260ffb1a3f9c8675c1b2e4db1f78a2e99b11a3db5d32a432d69c7670f9873bbb96655b02c4f45762a706e44bfa02cc0b376765fbb8f3cce865e1e63461f227d4448467a8467827a6ca9a4b342b50febca09b08f8cebe55cb0ecd939bcb0a2004788f6c9c956d066f059cbcca52ad939a597f71e6ce76a2137d802e960b6d672fd104a67fd8c80541991a9d6fccf90f56787b7b13bab044428862d95431a376c5f8e91b62bd6dff83cde41dda5276139799424f5e27c35aba21661f7edc5c4c139fdc0e2badcb6ffab5feb23b6b9b1716a703aa902e89dd211ffd0c373b78cd52fdc0b1a4bb85882e512426a621b90a472dd7b821ba3096f9f395b674679430b352bf02bfa253223109f9861c0f7d3654868e2fef78ca8fc22f251766d33df8e20e9f58fa08035325467ff520fa8ffcfbfd453040c36362867d65ed14d35bb5afc27d429c4c279663ff0776ebc3de6f1f7d5c73961ea840b00782a75a028f5229ffd9ec8d683653caf7d827d1c72bda5e2e0f5cd8a1a4fa6764e36b1a0baa2cf22f58b32a7e3c3be9235f0b2d00c7dfb5ec3e7c4571771a6771a8eb3c3cc04469ff058fc977cc51c059fb2cb1b78a43fa28fcf52e4bb576126d19663d66d266fa91b2cbe6ef726cedf0b6a7218acbf6c56f24f35a5e9c120922130707093dbe6f9755ebee739d4442827317b488347bffb80c6476ab40f0ac972702162e4cb368726fefe848f9186246e75094cbac7a93aa34a9e7e0e9efc9caeb61c344ad1ef69cd117d2c3d7b183eee477035b88243db5af1e4fd14bb6fc0081cdc82a66a61a305435236b64601045c53db2d42c9b92b1be2072ee887e0a746cb4e1bebe48951f7876a322952e0262fc6db6d2b578ed3b93a539c01c793a577e492158f2e770c3791211ccf917917e493f652cc7b5645985546c2e3b24a1db09936d1f38ac144a53d6b2cda92de4f1bcdd069d3b8ce4f4f7fe5e87cd97509ded96e7cbd78ebc7985899a9b42247baf19e3b8eb0a7cc07a13999a6d8195da6e2f5cb28ef1fbc7ca15a4cc1263edab23bf72d3f0088426db0279969ec7dfdca55bc74957fefa64d8d36f21e4aac4be90a4f1548c41d45caab1be07ab93b339d856562ce107c01a7fb86047a340e4a5c87d26dd5e6bb3b60a3761365ca108c170eb1ba28c28eb220e7753c9c5597a18102727ff7124bdc3e1e885ff53f25e63b5fc39954704dffe41c46dd2c610c988040a88b45ef512cf134f67ef6da2575d377a5330f4cba7777c949dad4d1341cfaa5caf43a155eee4b5f3c9d5853f8f85076b6e02c0e27777e1ac11a093c4af13b941f5574b8e482970bde9f56b0e5935779916df85ef557cced1756694db888f28c5bf5e139635bccbc66e3b3f85b9896f1a33ff63180c9c292d4e07c6997ac939795c6d8a6ea7e806366b16433ccb5f440efbbf943462733c6adbe162f09839c7c21d8ec3abe92351de01aae75abd31d806e26836f33c760f76a8ad8a0881a3f07f77e0f8d7dd2f4f6302cee3c55a06c8df84200b0ccb5b1bf615e4d3a0e38b4498af93e70818932e72fdff1ab606013f123d463c249d2023c1c0cef86c64a54b06810541b1a88a32fbbc4ebcb5ea846365cdcd617debbf902b122bc72f364631be8dbec919095d268ad47ef8f41f42417824d9aa47602f48fb273549e54fc54a451e322f5c753936122f002911cf23806e33a41584236791e7510c8a9910bc21d55fe984fecc9110641b35730e05effd71f71850fb06f935dde82b24572737d2ae7f50c7188c66217d996c42eb4b45c2cce66b962672e23becf928cf7111bd1c211588eb1129677b2ac953befa4136176eb9d966526852b8eb689cfd0bd65c4bcbbfcd72b3b3b6999911062f2fe2ffd34d3206e2e4af9744e43f2522d1608dc63ba374389f33a66d858cb4acb37d88e71bd20792e17cf1768d94d2a9df74a6b63076c988108137d1e1d97c62aba63cfba133720d01dc184293436f9fa16bb2f18a331c392533f5e701617edccff0b7214d6109e7a44b17d47a5499d8630c3f69797795fe581b5207cefa7b27a84905b183da55470f4ab70da3e4f520e299c32e09229299284336a6f9d6cebee1e65836850644b52c763925be115858b4ddb03cacb5987e4fefccfcffa36d6ab3dc2e9340a130433e906e02332e3d20f20ef497c81421f9ee5fe39025d2643718b689562300ab68409de848e0815e3f378979fbd6bcdd7f9c1f24291716a812b68545668fbb22e57f5fecd3d7a0d7afa9e92c792faabc659accb5dda00a8261ee20b48cc1fb47b8ab1260013976ffa534ed455b049aa5a37c04decf78387c3d57115cad9898bdbcc49680be8a8f6384f45f96bc73922c49ea311b8b45623724f9b8248285ba3e28f4705fec0ce6451fb04b354fd0e14811f047698ad2797f5fde744b51a6bfb3ca8b884f23c88de2e79c4d940c42992c16ef898db2c9f2a1ab0b670d38ebd6840084d7e361c9259dedf5281806b443cf6dbe899cc40a2d0a5c77f72f3851766fefee6f28b81434ed52ba792663b182d08cb877c6702143474ef0258f62cb6c29a61d55f1daf1325cfd47d4e85eb61c95aa34e1be5c5426046c452786ebe2ff1dd8868544f211424aff39ee67e3e5e0723b61d5716a7d43f3c2eaefbbe95f9b40e2d88d0892d6d8ca0373ab3cd5a24ad658e2028d9ada9d25e9f66b04a414edf0f80bdecdba3815357803b35d186d661b71707b2029cf80be8367e432e3ee7a7500f971860fba7a850895778e6035f9f2dd6c9addd578c193089d49325121e874298ee1bdf71fa5134ed4752a7bd86047c44bc36a310d44f09e8dc939353fb4a63df307dc110629824316be68976c080fb9447acee4d337f25deeac596567ce2b73a8c66e1728a4057d58a76098aff774c80b3076f7a28f5c85abb02aba4e06c9dfd77f756a55166429e8c34398855e0551f9540ceba1bff13ee3900b7d650ac1c2106e176c7dbc7ec94a056423a18b6d6db8437244957eacfedb6881a8851623b0cbcfe7b488aa74e5c1ef7773fd81952f32cc2d2e653b1fd2ba0d016fe64db326f6da4b6e2c28cc6d636066db60e25d9d172007e4d0d027fc0d4929ecd3805b8ad15d5ef7caa720587c946d529e9ae01fddaf5f360a4cdc63394a04405b7db29defdcac075c6866d7e5d29436ebc78bf03e5db1363f9be27a602122c314962d0c5adc81e4b060c9e4ee2475acd76c0e806f1e8321733d5e8bfb3b40ee51aa30f4299456cbdb2857b2a913ec2a46afd01bbb1241308097f3d3e193f9174853c1f0404a644f859566e8d33fbc6d436a2db96955223f5cf6c17f90f5fc3f6f196e8a39ecc5c6113fade6670ba6bfb13468805bad2211998818f6c0693dc59a017b4bdce10b867982d15767f1dc332b55a2dc2892400907cff9650b514242e02737b27524971e60b23857a7a25bb77c7be7e808a526af9420950184ea5c59ca8ecae4125c2219272bdf61ea753d0fcd45bbbd6052b7dc3bbe7a1b48287dccfddf7dc89cd632261ec440501e662fa69b31d694906d67769472526d32fa86b914eccf97cefc17f94b7513e62dbd49803920079d878af651657ef431c9111854275c7cf7f1f51e4d9c0845e3f379ab76e844779d9f0779cf8d6e20f4fbdb751e02cad95f0d690960e5a3e6d8591c1fd17790281dc3aa7b61847623f4b21c74fc21e9a810b135762858ef49d82df98d68477ec2b2f4f8d1a90e138d8c82b0610e7ddca80156b9c44ab59ef5619e20f1edbd0ed9768c43d8be15d6187d1792ac1a49f5357a4b9dfc952f6bf9e2285ee9c7a0e5793106721048de51f12bf7a31fc0b24e3e08561001a46c12e9df06e91dfdd537ec832794a0c797d41aaada6c1dc225e106878d48073086a0a44bfabfac7b4e82feb084ca04a7612ea70a5d1fd605f44e58cd6eebdb83af60efb5cda9c5f7ab7279d6c7c6d0e8d97361213f57aa1d0084bad8eae672c0f895d770c63673a6ff076c4aa7512b288a787b7f3e07c9f6e49", 0x1000, r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 13:54:59 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0xb, &(0x7f000059dffc), &(0x7f0000000100)=0x4) write(r0, &(0x7f0000000140)="4a1359357c300fbff5c1d2aaaadc04e2b66b098486708c5dbab958dd3bafa1ae51128b176b68aff889228cdf849393d816f9f92741fd1f73c209b55af100a4a10490016fb6b32f3cbeae21a1992ce86187e516ce725f81f2d73cb5511f82cdb88796ef6ecddfb1f64aa49075069c3de9e62aa3d23d730ef3a4d70aad30849b979de8cb34f2eadfb97285a38bd7f76f3e2a33b062a6f8ac1a1b9267b20b09dd5f8ab7fb3058ea27a4a22f58646840bc152641acef0aec508f774e0b48d66b0539b2b9e9a21c36f3b3782a573ece", 0xcd) 13:54:59 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") rt_sigaction(0x400000000000007, &(0x7f0000000040)={0x4064cf, {0xffffffbfffbff270}}, &(0x7f0000000380), 0x8, &(0x7f0000000100)) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x181, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r1, 0xc0a85322, &(0x7f0000000180)) syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x4, 0x44031, 0xffffffffffffffff, 0x0) syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x0) 13:54:59 executing program 1: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) write$binfmt_elf32(r0, &(0x7f0000000b00)={{0x7f, 0x45, 0x4c, 0x46, 0x7, 0x9, 0xa2e, 0xfff, 0x8, 0x0, 0x3e, 0xffffffffffffffe0, 0x38e, 0x38, 0x1e2, 0x1, 0x48f2a, 0x20, 0x1, 0x1, 0x800000006, 0x1}, [{0x7474e551, 0x20000000001, 0x401, 0x0, 0x6, 0x3ff, 0xfffffffffffffff9, 0x7}], "e22679e9370408000013346ec7d57c7541684f770574584fa16b463deb7017d9f0c0aec8cd4fbe7812bde32175dd8300ace377d661792f4fe2"}, 0x3c2) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000500)) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u'}]}}) write$P9_RREADDIR(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="2a00000029010000000000000000000000000000000000002300000000000007002e2f66696c6530"], 0x28) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000a00)={{{@in6=@dev, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6}}, &(0x7f0000000700)=0xe8) setuid(r3) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f00000003c0)=0x3) write$P9_RWALK(r1, &(0x7f0000000080)={0x16, 0x6f, 0x1, {0x1, [{}]}}, 0x16) write$P9_RGETATTR(r1, &(0x7f0000000540)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access'}}]}}) listxattr(&(0x7f0000000400)='./file0/file0\x00', &(0x7f0000000440)=""/57, 0x39) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xec, r4, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x100}]}, @IPVS_CMD_ATTR_DAEMON={0x80, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bcsh0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @loopback}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip_vti0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x28cd}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x800}]}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xffff}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3a}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x10}, 0x4000040) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) statfs(&(0x7f0000000680)='./file1\x00', &(0x7f0000000780)=""/178) ioctl$KDGKBLED(r5, 0x4b64, &(0x7f0000000740)) write$P9_RWALK(r1, &(0x7f0000000600)={0x4a, 0x6f, 0x1, {0x5, [{0x41, 0x2, 0x3}, {0x4, 0x2}, {0x2d, 0x2, 0x3}, {0x4, 0x4, 0x4}, {0x4, 0x2, 0x5}]}}, 0x4a) write$P9_RLOCK(r1, &(0x7f0000000500)={0x8}, 0x8) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)) fremovexattr(r5, &(0x7f00000006c0)=ANY=[@ANYBLOB='btrfs&./#)\x00']) epoll_create1(0x0) ioctl$TIOCLINUX2(r5, 0x541c, &(0x7f0000000000)={0x2, 0x9, 0xffffffffffff762f, 0x3ff, 0xff, 0x2}) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0x7f602c97) 13:54:59 executing program 4: r0 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000140)='/dev/pktcdvd/control\x00', 0x103000, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000180)=0x5) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000500)=[{&(0x7f0000000400)="710dba0bbe4f41884acf2e142413c1efb7a18ab6030d1e7431392110a5102d4203cb2e3b64fab9cca1a704448c799a67d09103efbd14ccf811"}, {&(0x7f0000000440)="98681009afa1897adec3b552bd8071e7f8477cab191788cdbeb29fd7f06cc6b182e5ac7d38a68c9ed194a9202c4c98927a9b936762a7a2c30db8c4149e09806c4735a3d03a55cf6eae446607d97e920f8f6ff02f2eb2b4e8b3b5c2235f6d5c36f3170d0ca0dac82c3eda9babd1baf99669fb8d7f48c626aba1d5723eb9972567e4a2ace684f8d557780985dbb73ef1ddd0493edbf4b3d251eda1bb48fed460923ab0c80268809dab24c5d4902e22ef1084a644"}], 0x4a103c2, 0xc) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f00000003c0)='IPVS\x00') set_robust_list(&(0x7f0000000380)={&(0x7f0000000280)={&(0x7f00000000c0)}, 0x0, &(0x7f0000000340)={&(0x7f0000000300)}}, 0x18) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f0000000000)={0x401, 0x0, 'client1\x00', 0xffffffff80000002, "4e955a2405b653fb", "cf0cb1b461a36c1e89bf155453b51c86a6ea3ed29c75a27dc6319a59b25b6c92", 0x1, 0x2000000000000}) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, &(0x7f00000002c0), 0x0) 13:54:59 executing program 7: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x0, 0x0) fallocate(r0, 0x0, 0xffff, 0x4) fallocate(r0, 0x1, 0xffff, 0x160) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) sendfile(r1, r0, &(0x7f0000000040), 0x10001) fallocate(r1, 0x11, 0x1, 0x2814a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth1\x00', 0x3400}) 13:55:00 executing program 3: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f0000000540)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000='version=9p2000'}]}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000140), &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000300)) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) r2 = getegid() syz_mount_image$f2fs(&(0x7f0000000180)='f2fs\x00', &(0x7f00000001c0)='./file0\x00', 0xbc10, 0x6, &(0x7f00000017c0)=[{&(0x7f00000002c0)="e55a4ae742f0fe3d5e96305ba67c4f36ef32cc4e8e4554610033dbaca37f82192631f234455fff8be850f5646f49e241b5a570dc2c546c8d42c1b995425327635c4d8dbd4002f7a40fc7e3b6d7ad7f760780587c909e8092", 0x58, 0x7}, {&(0x7f0000000440)="bac9c5e383535f54", 0x8, 0x3}, {&(0x7f00000005c0)="df5072c81e036cc90d27b95c9f6f970d1189fe1244e80dced8e0e437b4567aa85b542b2a423722d9bfd37acdacff150e194b7cca2d2fb4984310a1f2ecff8ac733013327dd7c313e9c3330584db5ed2447d0016fc58bd7983166ca6542ce292c1eb76a41e61b19ad1e9465254dfc26ca699d7ff62e50e720154de16823f87659de0008b315d0097fc51fb43b930a0af734a17d4e8705ff2c0991f40e5a120fe59caecf66312081b2c0178c63d0b58b6cf51e322a60063af9469e5b435a48ca9f932ca8a540c4567f6b6092b05db933e6d996977db1", 0xd5, 0x400}, {&(0x7f00000006c0)="6a0a2807e30bdf0cb9c4a373c168baf862de7d75cc3dbd6ffcb7318b0a5858c4b54863e7c6fdebb9cd23be4814118038c29f7be0d767f677e2b691eaff9f1bb1defbe523747e740d397cd9434faaab9318c95d80b669cf5db4d1f7f0c0b081f5ba45a7ac8a4cd535fd5f7a6760f672b1fe917dbc3070516da026ac0bf9aa1dd4003ce88a9471d50ded40fa7daaf0237c0116d0e9693d605dc8c0d466d1541ce8e682c5bc979f096ed95dbc16945b529bb634aae5a45a515c464bcd97350ee0971569f9008ad2e53c5dd6c2bf3f05eedd340d019d61d560403b92cb5c7f6702360252ae1804ef498322816d4771423482face3b997719c3e9e66fcabe8e1f32a1e8f58565bb3eb2f993aef49532f6e8cf5248f1dd193cf03956a0079372ffc65028bd85fac4032df03b4a4676df6c588ba062ece26adf231dac02681d479ff9d12e260fc5c3181c9be7bee2e5578ce2dc6b733d394bd8dac29af6bcdb3bf4ba7377cfa10bff2d714fb631619671539482844de0af665411b9b950becfe8736b6807d471ce2ef88f54d96934d3c4554a8d6b0d4e7288a6b5bd1bbb19da61e2a57af7aa72251494809780a180a7e09f011cfdf59c113861cd392271a0ccb7874851257d68ab18cc38ce8d84e801c88d5b95853ab1ca02fa987014f6072889a448bd07612cb908a3bb7b5ae9b15fc1a5b5ff5cccbb4c98fb1e996b4397ba28d9652cf953ac3ba12b2f94f26535e973cab33cabe02927e309c5b7f8c0b7858a4150fade38e59fad806d11bb09611f20d5cf7bdb95b2a32cef63332b3591e4d123c6a15540f5188b1020e8742b6ec8aff7fdb3041400a55c41c96bacc1c9259a2b1c4ce6947a21442be493873e6a7e43f6ec1c52f5446d49bd9c6d07e7bc6beec9184acbe735a6ad520ddfdc7799d3e069ac2e0883b54835246f710b6a543373df0728885131c3f0fdb4ef39f4ff69850d76bd43542a288fe3f23468789241586195bc61a4a2275d0e97cb989dd900c22a3846e3a339981c6939d8f43990e1ace5615cd26dc4453bd70885b10e73b218ad214ad3d74a96f66801833c2e4f83b3de8e9c82228952eca269f7f627592c167a751c61a3395195f28775dfc0fd6af75361c8a6a5e0b3f9c846238dba7ff68b781e8508e0d647750ec1a9a38665e187230bd1cd8aadb793767386b5987c032706a5c16f91d96d324ff906583ee9fce8e299e5a88a7abbe40e3a5d19a057fc1b82fa6e95d871945e35643a348ed2dc7d0a4615dad7ef087176add8b84e5e9cd84754b8acb7caa086d170b9e14595e072da3bda541848796052c05730ed50acbf55bb729cc68a7d9bcbc04ee6f6d03a5e4080ed8de45f2a550033a865ca0e0394ece4190a4154097b6fc7511c576cc2732e93401b54716890acbe1342280d5437f673cc6a21e04decf1942340cbe9d594be2718f446fc5e2a76008125bdd63022b5fa8b921e33c2b4badc8b6997f311b45ecc9a99c94f521dcec114fac7c2c5f753e8e6025770e2ae92395a1a95e3099ad33526e73499deeb30891b9255e527873d22689d89d746b2b10fdec94c52a4dd8c339e151ccc7a9862e3ec6c8e285cc79b1e45c5d2b15dc5aac5331dd025e13e6c7cd9a77b781f15cc46204395aef2b24d8522aa8d7b1cf8d4a9d80d493230bf9ee9aaf9a2d055b0a6bae5e54f0e44d86f8e3fef55bea5ba2abd6c18fa12ead8dca2a20717e8cea8805f478d507514304a5dd3e3d152a8e7f26e3b902236fdcdac37af013fe8025c894ea3c9b52a4d2c1f5d9cc3d19ca68c001ec97d975c81343e1efb1d9be4d14aa0e1ce183f356fe20a7c6b6c1f6f8c421dab69fab7fe2e92b7715c30354590d04b8574294397b63ceca5af3dd3626bbb57a6b54e8aa96eab59afbb54c79dabbab617ea698e47fbb6bb1d09fd31ca9047ecb4c649e2d8990615d9a58a27dcc4e91ca906062379681f52a895424e6d626d1fd7c2ad69f91faf2864c5eaa686ab250bce53ee9dc7b15a5df284b97dc2ed2dd675eaa7a9773516be1e53ad58440e926b5b5e70894d59376460583bd20f03a5aaad1323ce4cf626725437ca6911a3b3f488d70c70f72e6cd24a387a79ab46030dba93d65f2df21e776037abd2dac31e95cb2689efbe0e442164e367cce06fd3cc422fe95e969d2867fab2b40b4afdf94d574eb7ce441cd6efb1bac2a818809c0aeec7c5e97a93af63f8094fcc4ac58c76c6113308bb921b77d17b9e853ec100979da1cc95050be5d02dc003af3bf2187a6ae9de5bdee0651e251adc3414899d4fda58b65263dcbaded4124ffa8ff507476ed9832013fb4e00a16cc3bde9917ec5a8139dfa352dc6ebed425f91a18b302e34d28a6f2ff172980f661c5a88343d5f66e8e9d1a661848f83d9b8535bae1eb7f1083f8dd0fe723926bcdd859ff7bfa24a25aac32e2ae66b037575084da765889719a14c2b139245b71a097bc6d64d7928a5a83252359ae8acf2b3f298c1134a2dfe298552df40a49a0ac426efd298c86dd970bc207dad2dcc5e85372290168eb1287ff7a36f0cb7a6e90772b10428b7b97049cab81cf87992b8d1aa76c100fb527b183afdabdd0c36dbdaa27532b7fbb157336905883e5227d2bb86879a4a4e3b6657f6e3312b436cf092a056c8f23644e8813adc121e831a43b6c1065e297e1df397ebc145e736494132be86d212b2b06991814ea6b3c05cd1a1094eb9dc033ad15635b1711a6c9a2a16c1fd5de2d7e4835c33deda4a2253642db90642ea544acf7631cd5d1da299810a83e3a39bd27d3bea1826d6144cdeb0e3ba49881469a95148242b4d7c8f0045c4e26bbbc73c4b44829b6bda3cf70aa2c08f27ece21ccd16436fe3ac928c6d666f76e0c5978834d4a7a0ba689d5ef848630935823ef326de63bd1557e20d860730953ac73bc3a1d5f6cbeec9e161ee7152181564f9b08ec5e040f824ef43b10c317df17acebb8f29db452d1b233e44e2adb46594c783213a46f2784aaaa3368e9f9bf65b678d7e24c4ed930b9926f520fcdc9e4f154a85fcb6c657b302d03edcebcf42a2691846e3dc127f71a9df3f990d7c831348d9c4e3714d146a1d843bfa57dfca4e5079a506665c419741472c9eda51b415d74cc1c3df3b1443f9703c2f994242a492c4ac0022da0d873cf2b4e87b9a78ebea0aac005bfe1375d7b5b9a26ecc4bc74dbc7c474b7d51f23969d25fd7656d9ceafc0fd5b4b18cde724c5e27fd49c4644b4905b6e7ead1683c166525b9cb24fe7c88917461789f2da1c41bd5ce0201f5248918d1a192e7fcc2e683fb107e3d9f4fd2dd432121df810f987bf8ec19ef63de215636f83376930d9b3565ffc93e04c4fbb9b8ae2d256dc0be4809089d87fd5c355d92f6667025777601bcc5c12c0ce919b5fd1b675ca0c23f0ffc93ade1c606cebacec66ee34f2d958810876290429ebc945e1ed9bd5c7edfba193b83ae3b0ff930f84d77d552bc4457f781de7a159d8ce0fcfd498e6ddaae37bf3e301aa64b1c3543febc4e33c714b3f2f09fa16c23b0b844ece41ff4bd8633e7a7026c8b9d9b733e82aaa4c63634875aabbd8628cb888dd37dfcef6b5ed394e821d4c25074ce7f6b09928cd601c6b08ce1038caeb995197be7b448ef0bd59770a89d6ec0d1fac47c8c884eb37a8075ff8f178b155eceda61f5cddf648cc22c47dd7b3904dc9b1760de8dfc1c781a3a3c871305d180ab3899a6dcdf09207a01a4dcdf8fd68df8d061596995c3ccb806ac123e1fc5f18213c0500cbe5333fd7e3251008868d08befacc909313e02b1b16215a912da7695949b0fbf93d292dfa1ba8e78dc5efe2de56fa44bf5e19bc2c268cda11776bf303477eac5c180f6f3d2f6927739e2a21bb0a4e991552793cfce339bdd802ff1d118eb09556f510306f09fc133420a846a9394576b55c8d4fc1f41632b16b564627ee48b9714c14a722fde3a760cd6a2708ef42fbf9431b38b716f3ad5e99a9c36915fa71ed686463df54ace24a81e7365963b55f53b84e1c0be130a218858ca7dfb1f7aa0fe25693322e3ccdadfd9d1db1526df47c018cd5e2203ad4b182401eb70cc126a6c6f68d64237854b78511a85621f8377441b1f859fbb6f01de0c5e1e6d32d9f9963787e88dd5ae1333444f0953b55237098039b6f98fb18ea0d83aadce11cea88b40d67ea99d7c050df0fccccc8cce8553a06ec745a184cd7ca05ab8e6939ccab9b59fe4cbcb05559f73ab1cc32add5beb38f7f8af98b7bf8423fb5718cc0b46321767a3cc62e17ca387feaba0df5aeca49de68c1677015275e0c719c8b16d15c8d3a88e155bc4126725ae955acc5b61e9d105a269b0bcb58ba963826c8c3ebe2c6edfea4ab0a0547c35b6d1798f1bf5519d9afa30e6ea6f90cbce2baa822075eaf80a14a7661677ac26f33dbc7dca1e66355af08ecea15202aa615fae9223cfb31eec624743d76f9b8cf281577a5e9e416d351962233b11fa31e734004ad4cb664ff1b6f64859dec1af06239afabb27ad10b7fce71dec392991122a6b4983329c954365fed70beb937c73520dad9ecac4035b11ba31b182d78d9c34667268ae8e731a706c218014a309992a193ffd328d856da690de09251a90f6bfdd13369bae1e36752a0198402754afeb03e1d63c8434c91806e20bf3571a1c9247af9eeebf377c8846a5efdeb0740eac886dfd63f663966af7e3fcdb882656e30c45921de2e0c4d899fb28f6972dc41426561d94e5c03dae1ee68d20846d07cebd83e58b4754a38b9af2192c7a153561c001ed753ebef52a550a912c2c118872224815dee0b1a789cec944ad29a41bf054de51b70066aa5ed18118c10a38c284e0fe98352588ab2b633047e42f6e977d6f56401050470fb0c9006ae1378b2d0143159aba4d1644dae0b3f7cc12fb6d27514a90434b6af46568ab22230f9568e41e1f180a3a2dd99d493f7d29d3f112fe54eaeaadcaaef8ba2bdb235e200227065df239936a146efb7b3ff23c696a9a49752f4b401ce7d53004dc8f391962017dfcd289617d5bb272b682e719e454e7e91f1635f18e2dfec129cb726c7e0a2cf4402537b61895476136fd389b4f3442190de9a07d56d9d8737051bbac1a9385dce0329d4fac4c640a10006231a88219a7ae186f89282de1ba039b448f0d412efe132e16b549e74d0a851a1df852dba6e33f7da9feafe55410398b7ed0568c26887c939c7e25e051f50f71d694f7c00a3b14fcf4e9d2bf82db114ea0d8affd9941ff8fcc2a095a5cb716df7816082bc9e97f0d3301efa706d3a88205fa76745b1cb97419446238cc3ba9401bbeaf0216bf5e7dbe59786f463cc18550775bbb26134929b651fdbb64ef0384bae40d2725c201181ae6a42111551868791bce7b950593f962e7d55f4dd30710c723b58cb40f2b9b9c4e64d96d6da36705bea680894d5c88c4c464a99d6ae3aadf1675183545343d58c43c863cd73f3f22532c45f4202d44854e9c8c4e03740991e201c97f89bdb76e218475656aec1cf3ba4bc51460564c062fc0a4b62860f37af4041bedb76c10910c18df5144ee82f5a51fa8beb228d19a8bdf73bded0c628116fe1aa04dde9927823e638e6fdb9c925a02fe8fc8bff9873b3e764b1cce2b7a1aeee55e5a43ed050ae9fe84b2c1a70ca528919eeb3194eb13b29630d49ced2f2f9f9264affa0b2c1aaa0d969ebdc20225f67286f7bef7b2e3e2239aaa6d096980e6f238956a893906990d6b2ef06d66f1703b2868d79bd367fce9fcf20910348b163ba2e64f243cae51c9c5b67f29", 0x1000, 0x7}, {&(0x7f00000016c0)="2e43a6d67b3e76b7ad2191d8b0b97fdd3746368e725d64c946060800189d1f92386dd1c2d9aa81b716317b8bbdc68e69507884a13671bc53df0442aa4402477b5b4718ec7d37e71bedd335d80e32ae34768c3e955dbf66dff3d35ff8ff30102edca3c7a9a25f418841261d45da61c2cc9cc94ff164b7e72e3ec70f9baa84f7817f7be8d3cfa36d9f703dce3add1ba53de02f83af691f304eb813bb875b1ce4728859a24ff136090accdfa05e81ce74dd69db939bf906a76a5f1bbe86bbc61ae043978952fafb02a50f9357f9e601ae9bf3b3", 0xd2, 0x1}, {&(0x7f0000000480)="f80de1197d8034382536b34361f5c4820e68846f1c3924a8760b9dc20f02bca4740e0bab0071575c5b69689fe61d056ff79be8e3d8cfdecf50ed9d1e46c27b383cfe99ec94d6ccc907ed973349d74c674e01eb16273e5f20ab525476e4eb009a1f8f4c4a0652cb2262b25f5a018445c463a628f837f8117217f8967dc5eaa48b83f292dc5897800abc3b50a33efa2a4989d3e9d4103475456c34680430de3780c76479498ace82ef102117eb", 0xac, 0x7ba}], 0x200080, &(0x7f0000001880)={[{@fsync_mode_posix='fsync_mode=posix'}, {@resgid={'resgid', 0x3d, r2}}]}) write$P9_RREADDIR(r1, &(0x7f00000003c0)={0x49, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}, {{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x49) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) [ 377.011069] binder: BINDER_SET_CONTEXT_MGR already set [ 377.016963] binder: 25799:25809 ioctl 40046207 0 returned -16 [ 377.017954] binder_alloc: 25799: binder_alloc_buf, no vma [ 377.017975] binder: 25799:25852 transaction failed 29189/-3, size 24-8 line 3136 [ 377.023322] binder: 25799:25852 ERROR: BC_REGISTER_LOOPER called without request [ 377.026048] binder: 25799:25855 got transaction to invalid handle [ 377.026055] binder: 25799:25855 transaction failed 29201/-22, size 0-0 line 3013 [ 377.026385] binder: undelivered TRANSACTION_ERROR: 29189 [ 377.026448] binder: undelivered TRANSACTION_ERROR: 29189 13:55:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$inet(0x2, 0x80004, 0x0, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1163484001"], 0x25, 0x0, &(0x7f0000000180)="ca37fb4f82c0c146e12b10c2e7dd1efcd1f9ec85d51973ad563ae81bceb8bfa01e21461b69"}) 13:55:00 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1000000000004, 0x45f3) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000001000)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}}}}, 0x108) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x10000, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000001c0)=0x0) mq_notify(r2, &(0x7f0000000200)={0x0, 0x38, 0x0, @tid=r3}) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f000014f000)={&(0x7f00003c7ff4), 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) tkill(r5, 0x36) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000002000000000a00000000000000ff02000000000200000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000477dfe6229e4fb1776abf8d8be2a010ba9db4ad3c551bcefc82ca61db0d0abdf31ae9f4a42a744412d72a33d3a0e0512e362ecd6a541794e3006f9d4e39474"], 0x90) 13:55:00 executing program 1: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)) ioctl$KDENABIO(0xffffffffffffffff, 0x4b36) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000740)={0x3, 0x70, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4, 0x0, 0xd71, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x1, 0x4, 0xffffffff, 0xe5, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x2, 0xc778, 0x0, 0xfffffffffffffffc, 0x0, @perf_config_ext={0x3}, 0x200, 0x0, 0x5, 0x0, 0x0, 0x2, 0x7}, 0x0, 0x0, r0, 0xa) ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, "cf2cb9a7113173fc6986603a3837d9caafc04d07eb9d002c15683c8aa3b018f2daac6777996078996cbced40649836e363bd046db94c3f503ab68ee659910291", "26f1e6bbf425451334cf4a44ef5c1e56aafef99cb257d17d07a360ecad172e27e9c6658e3cac7dc9c74d51064cb0c4273213119304ee8dbd4bfe6703936dbc13", "5aaa4ce022c864ceef9b1a21a775bab03b027490ca633b5a587df0e18fd03462", [0x1]}) r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10003, 0x80011, r1, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='comm\x00') writev(r0, &(0x7f0000000680)=[{&(0x7f0000000100)="5cc2d08efe8c981dc032568bfda699cd2c821c031d92c786f0445a62648d5c90984658ce5c7b3c264abef85464505f8ccb7e96450adad2c254379d2e73a21d697db3a326bb6d8c7000d3ce140e062e6432558c0e94e5d3318cd0662708afa624e1e8704a3622bb74be5f574b6b75ad57e01cc799990bfe48c898e30d3a177ec2f53bfb7a42e7d586943cf5332d3495f23beabdf45bf31e4752d54d32580e85893d525a9bb53a2a38198ae5e9055611428402f22c755f4a9c7700000000000000000000000000000000000000000000"}, {&(0x7f0000000380)="0d4cd916e2f31fd83ae400cad0f581d1a80a19faa8257365aa6d87af8051fdfbd27660c6b7d1ac97678b5ca6af5d1804d02875346510932522466628c2d9f69c46b7605c807007b47e259d05476fc7718536824561f899aa8c17e28523333a7a42b4f1bedb41aec786c348f6e3aa009c0609c46bc0b3c8949f3306b2e96004fcd4dceb590bd08ec3f137473eac5f287e0909b24cdbf5e931735484540fcfc02869a600e6166753a62bceff5b2d1cec5183e36ed22ffb2fd1c649d7eb47f49aa14b32f665c7c485bce0c7627394c2c5db15bedfbd117b1f06656fd463615885d9ca451d3c"}, {&(0x7f00000007c0)="34be8d1d251b819e90280bb8aea91def281de810de59ed9f30b33e9f009a5868cf0592667cc5b0053aee820ecd23a437ac869eb05b2c8ef2a83bfdd3f31024b91f06a4e185ee7c81e30b9346152d743f7001724ddee95aa6896520eb5cfeda7da0a909b5bb407b2a7933e8c563416763304be540abe4f86aafa67bf68030ac643bccc24a216fd7a9f3fe5262e40b77912d99b5e2c5819744ca3caebb2b74916cd4e9ed6e0a2e2db9bcc7cd63db77f22891c01a7c35eed7798b6b432a85f9c4f2056c4e7671171c95cc0583cc0a8d43a60099fef92a7a975467ab4ad847bf31bbacb85b9454b2be0949d13e7aa698833141385f0782d0ff04c398a92acde5eb76ad75927303ba3792e5563ff14dcce2bb301d2ed85447d6f65df07f5623235674cf45e581aae958366749f7dc172a7b8ffeabe710f202f448e94729998c8f19e03227c98686e1c0cae7dc683169e64b0f7714629800cc4051ce1564a2cb9f6ac69a0bb7ac771602e48c736a76fd9e82dd6fcd1e690057b73b0e877fc1db4535873c6a30e50a7bd9793c57b095f028551fc9e63a4afaa2c1d5a5c674b3299bdd23289524128975dfaf489b6424ef90842491f6305496cc082455037f2dbf5be7fadd0fe5b8817d5d9feb11a1c66fe7f15e9c918330fb954a56100fb9748ae5cff16e865d47ef0e2598f06db50f430773fa504beb61473d12c3051eae29d4b16912f53370a6452e2f2882cca15c77a8dad5a720c917c81289f8bb4efc3fd8633436615beb2e348164c348e0d3ee28521f8545968fbc6df1def2d8b37bed42dfee014bde724a8386c5b923ff0508579d0a39e698969eeae73a45a3b121856d003480cd053187b3826bd079d9cd124be98e93e4821b950565b63398ca126b10550751e301339a2fb05cf12991954ce5807de10ddb1b8b12996e81b4392ba4a515e274266dc7bf387623a5e0380c89e09ddb4d259ae203fce31b68146987c123ca0e24cd9babeb9412f781573dc8e26f27bf1745c250919c79e80d45660722f71b4b2d2b5fdca5a0d33f3e5563719e800177fc8b246923c88752f0d49f28e083d47347e33dbaf59075f7ce8bd28289a1c6dafad210afa5941ca8ba93c6f627553b9bdf41f6973a2ee5a755fe3f1a07cd1b0a34d0605516a8ccd6cb6f92b91aad590ecb3ea12ae36e2cfb28c4162d2286c511303aabe5f51a838a8852cd29d3ed4214b8ae790c9958217a1f9ce3a36e514fbb649efcdd86ce8a78c9c0f82ff136a15e5dd8c904c67f5d9b1d7c90a72a958ce505fdca12259d23f94639522a21dcfe60af08d761a16dd263555d1d6b948af12459898805c78b78c8f2bb45dad8284b637559dd475a1affc8a8dc7fdf845fa5a87df2eb04ac424c4d0509d7ffa428a4affb8176a85b0d76f32465f6fbf84a4c3b151366a9d64762a8e405c9169a395e25a091b036f298a7369b8b39c3187107f9053e149150c299994dd10a0042e488c0b70ab8c83122f2bc93cc348d650f469a3771c52792cf793cb864b8b3a5ec9c0c78ba2da84424ce64c63824a1fc2221535e172903712180ef0047724002d4efd80663aa512b2449ac0d54f429a07cc818bcd97790d4abe219366d98227bd186851dc0892a1208324ec0aa93e758445527a4f3678572b85e5073d1f87de909848d31e46f1496ac63dd1d453f5b81bfe73747489e754b88a71807067fa2d894bf71f15fbb10b949f74842cb895826c2b6de47f875734dbfd0326072efeaefda67f78b7f2586335c9f3d77979e24e424a585bcd69c02baf47bf8a85e919aa10d2dc16183db25e14c6a07891d1152f73714ab4b3b74b332d6b3104b0413fae6e37f2cc7a0e9002663b91bf18a9aec6f69a3a0067a5b4965aa0a0001fad45684815b74c6974d6ac7660eb8911bd55634a76498989c245070cc76be3965610424d19669379cd21f94e7184f7ad3c9fbe1c8aeeaaa171350e648cc043fd44b1c7edc17a859b270b1bfba5337177588a0ef96dbba557d159fd2dedefebd5263ae94b1522165451e4bf49eb387148afe1b04af1ab4c7dcca642f1a37eb2fea6e1248c4d49fe6c15438cd6c03c6b5eaaaedf42850230fed3c41de44c2c0093bfb7a8ec72014b710fd3bf3ab5beeaff01a197f7cbf6df456924b245655e577cac1c000e385558e94383e6f8d58d056c5c925249231874aea88a3b15a155dc3cef8ea7b439a8a052882cecd319e5cedcae4975a8c8bfc1eb2a4964272b1bf24c88a3e1414199f227c22b656db9e2f66f7f5cca1d1bc71882c4023b12a0ff3bd5a31708f92cc042a48d316e81802124a73297a762cca9ba74b2e22e22d80652184d40be06a8966f563df4472d9045fd07462b12bc5774e191ed9038139f60b9cd0292e8d8ca35475832559c4a042a437e1f45fd1b605b1398f49906c748eb3ce86ca00eff4872118722df68878c6444024140e8e11dc90795d5228e4b08639344d0d25bf7aae6ee399174e491192826a9d2254bee4efc4081e9670f351fbcfbfa86e03230309f152636b28f78734722ab6254380e71acd9d2d0983c616a65fd7d567a2bae40323e605fa42eda8a257284c261eac3222e2837a9cd08d9d64ffcfdcb4d472c283177c4439d7f2e2b02856c3ec6e63ba9ad676bf7eddaad2d3468df79297d9cf931ef4635222701c329810cfad28a7a43e183f9ffb06ed9c294e165d6e0f5df559913b914c54869b4871f0bc714475840a90e150ad44ef7dd9055aa5cbe732873a3de66788a16990f2872672265dd5f1253bf199d496263b5f7c0999e61931671f3c4d0baede7785c408879882acc99ede32382bc2143e557c05198b4092eba5ba3642e90f12e237e79eafbdeefdbc9b3404ecf939ea2d271050d5cd4bb7051106550a266a8a0ea6d90f59bdc473b33db8d1cd1cc89a422e73645d99c86e085487018ef165d7f0cadd5b4a81c25bcb0b0713112347d986af68ac9224c7b5e6cc47d9f281b68f7be98b14efe9f53450322f786d0e8f5e2e48c827f21883ed51e80f286aaefdee6a02a2290c571cb7290b56de087c07037c8679f56709b9296c422e4340c26ec9388bf81619fbf5c99ce9f27844df278ec6375b6d397afa86588e232c0c0307041f8dac40fd50716cb8eef8c26a278b3acb7884afe158e2b5f0a1f55084c4b0bcaf284da9ef32135c45fc02c6887c2e900bf7eae68d5ca463165305d496177034ed42b54d797b3c6c5862f4d3541cec914bd943846ed9eb7b8960efa9881152fd8b6fcb4732ca2d1c6d0bc23fe453b6d6fe9d5aa79624beb4673b5fd143fb1251120873b38871a8577fe4e5005ee11a4a87770412a957a782d57a79ebad297290eb1832d349b478869ad6904ff889f1a9e176b84bbd5eed1938592381dcd93787e562bbf3dd185c04d46cb5ac567332c405116279fe73fad79b2d2e3de403bff4ac1fdda2428e27665b8e24b2bedd92fc679c8ac8f2cecf678b20006fbc7eb71971775fb23026e95d40f3659aeb8be1b2d6f3d339378fe74b3b4c0cec25bc4afc57fd11947f8f818a592eb935ef80ca9d59d97764065d4270529f8d3e57d4d0b42c5469dba2ffa019e721e3e725435c5fb1c7480ff344636ff492a0db3bddbd56213d606af69536c16cae9ce1435ca87838eaebd5e018e35e848c47104b93312e5bc3a6e23f19d18853466d97fd050f51a68f0e8d3fc80493fd391a28ea6ef3fd826f16b4d09754641d0a7e65e4e6149fb7fb6807a0956b7e97a02b9a7662130050ba86110881d1a156f12af19ea47379b658c6188ca68664585c6d449ebc4b238ee26cacfbc1cfc5e2a24040602bdc45a415cc6fc709430e32a2671733746c0ee5f3b17ab1e8021f99ba986e7d4cdce662399e52cab4133b464f1ccf49e9794cb4781cdf9154461056922a15692dc0c682d0f3789e38b8edcc8872faf85d49022852ef905ffb26de5a4417d21e7e6397eb88c1a3569c85f9a80b4ef0eb2c477bec5e07465f65b11c5dec550a02c61789cfa5ed42c3d94a266262fe20a5f31858a18694db08f475295a8652d08c79243d2646a9343ee37ce7db581a03af6d3afd935cdd87097b345df6f20d6f44d6ff3fd6c5f3858dbc12dec50db4067737e49f0f83439bd1cdb2d88959e00fee2c39129dab611d36c73539dcb6c36decb1f686812a0c4f8a35fe06493e5ccc25b906d29a93f51503a343a53f5b8eee69d2bbc85ed6e815243f8fdde4c3f25fa0241e4e849d3e6fd99f013b79bd3c7448b4d3c2491d2d7b6a26b8e8a8fbfc72427cad7f5d17f21b538b2be13e85cf0e1829216ce65f733506c59e147bf13a30d88b59b19fb31ae25e2e63b1fe5bb3d451d598d50e4b3af1c940fac5ec0da63a7bccde1e6fc0983ed547b0ed6869d97bc74cc26e87e03a6cd24464a4551c98eea16f91723119ea9a384a64c8c8e8c4aaa55c2e51918f224b33dffd6409be403f470bccecc4dc6bd1cc6ceb28f096cd494c022d217d3730ea1ac47d7e8c61eef76320b01d8afb5823b3b52c3665d16a2ba2205b94d5438da1360750887f4a4ec073fc029c1690b74b178fc8fb406466463a19b68841b147c6ad580761b0bec173d47d7272c3c7de89aa8fbe277d0f5e68c2b4256e080baf47f0aa40582da3aedb18bb2e8a1b1036b922f18a114416409b2e8d9f3b61c9c3eedc23510e847fc52f39f56ec681b2cf3a3e4ad4d1b7e3096ea445993fa4512ecccb614efc6c97ca31202dbbfa0fad9e04a5dd7c401508ddef23f51893968ba029931c58077f927e43a88713453f7a59d8a58a32302dc717904bea72b9c421a949965f29bf0ddfbbe32908f41ad9533279e8b8d9a66f57ae2b6b8f87b84acb22cb367e88481545a1cf0f648bfcc76a79f3c465ebe0e18b8294eb7b7852a31ed6601729de86bcb8a2f6a5c75d81db7e78cc85b3ef2be1994dfd2dadfa96f9f418c1c74cecbfed4ed3aa1d3a588d4e3536d482bf36cd6f64c538abb81d81f60762b0575c6848805e1f4d95fbc6c21a6a28e50e26e31c0ff0119b8c0e42b0b4275fc1ef20f7d34fa1e3665435603ace57dfc79120c9916a136d2f02f5bdcd9c6ac8f37ace27b895a943aa93c2931edce2c0076bcd9cc7b9a90b12e6f4f005183c29082b5ec6243c117b1f6bd07475aa89a7f3b5bffe968c4ea0976ccaf3faa4b2b0609e449fad2268f7ef1ba59b126ddf030878f911281ac1b30cb8c1dd03651345fcb9e27dc6b416922af74aadf778e20af812e66bf0b2efc0681cd2d312dd01d74c37280a40fd797923047ceea96b8db90eab7cf2a66f81624753d318ef10fecaabac8217f8ea21d89509fa99be7364c5e42db275dc55ba9720ac4b5bd5c57e1f5198003ec32e5d5c28585cd5a87c4e2b16658393ce1aeb89c26df0909b06a80c5eec5faf63665db085978fab58406c727650b81c3838b5e81d7f0bbea1eb161d8d20998279502b8741ac746881947bf3738338f5a5c7f312055eb8319c298b29b1b2ab25c96b688424ce147e0b154ff64bfab56f0a3b7cadaaad0b0cd63f6e77841706ce8215527eda8cdb9075ad73ecefaa721556912bd69c34b5e440639babce69c6f67ebfe5f2d43a74bcecb00318ebd9352292cf9105b5200fdd4383180c9e146aedeb83313368ef2f17138d36da7dd6695937071409c50e7636b2ca15d7506ed53cff862a658c5047eef1424277b26385298750994d442491b2e38a9530fb63b6fa8a21f68aa785374722403f71e4b683e01f4fb1f247a4d1ae78c652af4340440a5086bce12f89ca716b1a7e759111db8a91fcb45ade32"}, {&(0x7f0000000200)="a44c582e3ac23c7709860b5f0657d8990cd722eaa04c5766f1dd156432facaf55e88f72b4b"}, {&(0x7f0000000480)="817604e640a700247b4c07527138d796c834ba7c03113310c533337410e56bf289beac1ee302df0d45db2e1f3609a4e0983896828181cf49a82de0756766bdd22bab00d4d56a5fc7d3c12224a2179b058db027cbf7d9c82b79d529d90c43499f5a5ea44ab17186958588cd2a0cc15d12007a3a24c8a032e329bcc53d9779c176177ba0ff04256baa89a391ce1d50497ffd57c03a371d4e2e4b5305883e3194e14cdd9de2c3448ed1882bc6958e42e2cea7ad7ae25ea679594a2524188ba90cc0c3dd99c9d4f6c4927a1a0680615abf32ea7ad1e9043403a1ba8169e42a211429d475b3d54964d8cc509909"}, {&(0x7f0000000580)="5cec381dccc41d2c0c51b3ad5e8af67382a18b1b954f3a3ebc8ecf7272fa45452facb30d91ce63ba9b618ea8ad9790c005000000000000002f926a029b"}, {&(0x7f00000005c0)="eb609d882ac174953b620d9daf31f14cac56a32659e8641dc42df537ca3da8d4e8ea9fb278f29e12d934229164fd4c4bd555c2c1cff818acefc6ee47368f251f2506f9b9aa95db52f45f7c926bc4f645ae23c82b9516ccb8fe547bc358d630b22c41ebd7cda8a6779c38da4feaec3f3d9d86163ffdbd3cb30f72920b1bfb571d731866b7741b6fa297e4546c150b44d233a2add0ba2adead4a4ed6916cd75cfe95611365f8cb"}], 0x546) 13:55:00 executing program 2: setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x1b, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f00000001c0)={0x8000000020, @time, 0x0, {0x0, 0x401}, 0x35}) r1 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/pktcdvd/control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000a00)={0x0, 0x0}) fcntl$getownex(r1, 0x10, &(0x7f0000000800)={0x0, 0x0}) getpgrp(r4) getpid() getpgrp(0x0) getpgid(0x0) getuid() stat(&(0x7f00000045c0)='./file0\x00', &(0x7f0000004600)) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000006640)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000005900), &(0x7f0000005940)=0xc) gettid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000006140)={0x0}, &(0x7f0000006180)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000061c0)={{{@in6=@mcast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f00000062c0)=0xe8) lstat(&(0x7f0000006300)='./file0\x00', &(0x7f0000006340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000063c0)='/dev/ptmx\x00', 0x10100, 0x0) sendmsg$netlink(r1, &(0x7f0000006500)={&(0x7f00000007c0)=@kern={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000006080)=[{&(0x7f0000000840)=ANY=[@ANYBLOB="100000004200070306000000fbdbdf2522bbf5f6fd197f5686a8958023f0c58a8dee1dd59373369c924f71c2458449def9b719f29447e49565f454606f0c841d166e4331c2e046ad84443d08934edce4df5677afa8192b425c80c247bbc3b46ba7"], 0x1}], 0x1, &(0x7f00000008c0)=ANY=[@ANYBLOB="30000000000000000100000001000000", @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="0000000020000000000000000100007a39000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r8, @ANYRES32=r1, @ANYRES32=r9, @ANYBLOB="0000d9001800000000000000010000000f249e0fc3c05ae901ee2b725f18d3d8d1fd1264498d399e7ed97b00a0e9f2bb9c28dc9d7586a6706cc29e698847d52e934fd44ea042b5e9737fc922749a391e7eb04d931cad1c8773684d81df366dbfdc9b531cf64c23242843600ea9ebefc28c7e5fe71944c84f2eedf2badbbe7234d250dfa1dc52354c3b6f5438ce9b66383f65fe097b0c2657315fb09f44a51353f61095682ee271aada", @ANYRES32=r1, @ANYRES32=r0], 0x88, 0x20000090}, 0x20004010) utimes(&(0x7f0000000340)='./file0\x00', &(0x7f0000000480)={{r2, r3/1000+30000}, {0x0, 0x7530}}) mq_notify(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, @thr={&(0x7f0000000140), &(0x7f0000000300)}}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000280)) r10 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, r0, 0x0) unshare(0x42060000) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer2\x00', 0x2, 0x0) r11 = accept4(r1, &(0x7f00000003c0)=@nfc, &(0x7f0000000180)=0x80, 0x80800) r12 = pkey_alloc(0x0, 0x2) pkey_free(r12) read(r11, &(0x7f0000000700)=""/134, 0x4c) getsockopt$inet6_IPV6_IPSEC_POLICY(r10, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000000)=0xe8) recvfrom$packet(r10, &(0x7f0000000500)=""/237, 0xed, 0x40000021, &(0x7f0000000240)={0x11, 0x19, r13, 0x1, 0x0, 0x6, @remote}, 0x14) setsockopt$netlink_NETLINK_CAP_ACK(r10, 0x10e, 0xa, &(0x7f0000000140)=0x3, 0x4) fanotify_init(0x0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) [ 377.026683] binder: undelivered TRANSACTION_ERROR: 29201 [ 377.119579] binder: undelivered TRANSACTION_ERROR: 29201 13:55:00 executing program 7: socket(0xf, 0x4, 0xc0a) r0 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000340)={{0x6, 0x2}, {0x200, 0x11}, 0x1, 0x4, 0x3}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x73, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$netlink(0xffffffffffffffff, &(0x7f0000000000)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f00001bf000/0x1000)=nil, 0x1000, 0x0, 0x4011, r3, 0x0) r4 = fcntl$getown(r1, 0x9) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000440)={[], 0x3, 0x789, 0x1, 0xff, 0x582, r4}) capset(&(0x7f0000000000), &(0x7f0000001fe8)) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fstat(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setfsgid(r6) write$cgroup_type(r5, &(0x7f00000009c0)='threaded\x00', 0xfffffc47) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xfffffc47) sysinfo(&(0x7f00000002c0)=""/99) write$P9_RVERSION(r5, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0x7ff, 0x8, '9P2000.u'}, 0x15) socketpair$inet(0x2, 0x800, 0xab, &(0x7f0000000240)) accept$unix(r5, &(0x7f0000000180), &(0x7f0000000200)=0x6e) ioctl$RTC_VL_CLR(r5, 0x7014) 13:55:00 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 377.240446] binder: undelivered TRANSACTION_ERROR: 29189 [ 377.248577] binder: undelivered TRANSACTION_ERROR: 29201 13:55:00 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") futex(&(0x7f000000cffc), 0x0, 0x0, &(0x7f00006f7000)={0x77359400}, &(0x7f0000000000), 0x0) futex(&(0x7f000000cffc)=0x400000000000, 0x3, 0x2, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000080), 0x0) [ 377.315504] binder: 25869:25876 ERROR: BC_REGISTER_LOOPER called without request [ 377.333765] binder_alloc: 25869: binder_alloc_buf, no vma [ 377.351555] binder: 25869:25876 transaction failed 29189/-3, size 0-0 line 3136 13:55:00 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x80850, r0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) ioctl(r1, 0x100, &(0x7f0000000200)="8d3c4839c45bf64dd5d9b3405742bd327808fcda0169a5c3392218f5e4ed49342dc683b65dcee0ae9d1491b1cdd49b933aa7aa8653dbedf8ad0a1837fec84fbef7eb955334d41fb9d620297cd9dfbad9589ddd6b4fbd84adeb8bf689751bbe22d7b37b6a03350491f9827857b3bf54d46cc16d9ae32c4f530460642c994d3ace9e24f0394c9718ea141682cd7c7ce1fb00ae100d10e254398ca4ef2589338cd79d0ce044d56360bdb7c115196520141d79d9f4e236519491b5ae4af44ea74d7d31ff4d3114f37756d82ae099cbf6c8fa8df59ed7144d2e1a4f2d53f1acdc54c482c744") write$binfmt_elf64(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="7f454c460000040000cb0000000000140000cc0000000000000000000000000004000000000000001cca01010000ff38000000000018b7074db0cb5a8531eb5bd400faffffffffffff2fc9facf929ed50000000000000000082a6babbd23ab163af2967588581da6a3c0adf33b1079519b3b282de4e4f8da530ff6a2f9ef1adba535e7c00fda98726e57c2201d484c7da804a9ba32d30079fad8f23b1ced00450a55b414469b8f01f43bdaf78089a82d126f9c95eafefb53043753979f9b634fc9ba64b9679492e5ed78c1db82587aed4ba6097772d188d3534e797f2154ba291cfb74f4c408c9584a1367f5825075cdb1000000000000000000000000000000a2f7fa7752d2c93b78c40eba37e074576b99a99907308160fdb3"], 0x11a) [ 377.372293] binder: BINDER_SET_CONTEXT_MGR already set [ 377.409858] binder: BINDER_SET_CONTEXT_MGR already set [ 377.415770] binder: 25882:25885 ioctl 40046207 0 returned -16 [ 377.467236] binder: 25882:25897 ERROR: BC_REGISTER_LOOPER called without request [ 377.467917] binder: 25882:25897 got transaction to invalid handle [ 377.467940] binder: 25882:25897 transaction failed 29201/-22, size 0-0 line 3013 [ 377.490061] binder: 25869:25876 ERROR: BC_REGISTER_LOOPER called without request [ 377.499144] binder: 25869:25899 got transaction to invalid handle [ 377.499156] binder: 25869:25899 transaction failed 29201/-22, size 0-0 line 3013 [ 377.595627] binder: 25869:25887 ioctl 40046207 0 returned -16 [ 377.595785] binder_alloc: 25869: binder_alloc_buf, no vma [ 377.595808] binder: 25882:25885 transaction failed 29189/-3, size 24-8 line 3136 [ 377.601721] binder_alloc: 25869: binder_alloc_buf, no vma [ 377.601739] binder: 25869:25893 transaction failed 29189/-3, size 24-8 line 3136 [ 377.602616] binder: release 25869:25876 transaction 568 in, still active [ 377.602624] binder: send failed reply for transaction 568 to 25869:25876 [ 377.602635] binder: undelivered TRANSACTION_ERROR: 29189 [ 377.602735] binder: undelivered TRANSACTION_ERROR: 29201 [ 377.605586] binder: undelivered TRANSACTION_ERROR: 29189 [ 377.605606] binder: undelivered TRANSACTION_ERROR: 29189 [ 377.605626] binder: undelivered TRANSACTION_COMPLETE [ 377.605632] binder: undelivered TRANSACTION_ERROR: 29189 [ 377.650891] f2fs_msg: 6 callbacks suppressed [ 377.650901] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x94d5e9cb) [ 377.650908] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 377.653103] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 377.653110] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock 13:55:00 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/raw\x00') getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in=@remote, @in6=@ipv4={[], [], @multicast1}, 0x4e22, 0x8000, 0x4e20, 0x0, 0xa, 0x80, 0x80, 0x7f, 0x0, r1}, {0x8, 0x6, 0x8, 0x1000, 0x7, 0x100000001, 0x1, 0x11c}, {0x4, 0x3f, 0x80000000, 0x1}, 0xfffffffffffffff8, 0x6e6bba, 0x2, 0x0, 0x3, 0x1}, {{@in6=@dev={0xfe, 0x80, [], 0x14}, 0x4d2, 0xff}, 0x2, @in6, 0x3500, 0x7, 0x3, 0xc0, 0xf81, 0x10000, 0x3f}}, 0xe8) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={&(0x7f0000000080)=@nl, 0x80, &(0x7f0000000540), 0x0, &(0x7f00000001c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f0000000380), 0x10f, 0x400000000008) bind(r0, &(0x7f0000000200)=@rc={0x1f, {0x3ff, 0x3, 0xfffffffffffffff9, 0x2, 0x9992, 0x6}, 0xfffffffffffffff8}, 0x80) 13:55:00 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x8000) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000400), 0x0, 0x0) ioctl$fiemap(r2, 0x40086602, &(0x7f0000000140)=ANY=[]) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) sendfile(r1, r1, &(0x7f00000000c0), 0x80) write$binfmt_elf64(r2, &(0x7f0000000080)=ANY=[], 0xff01) fcntl$setstatus(r3, 0x4, 0x4000) r4 = add_key$keyring(&(0x7f0000000b00)='keyring\x00', &(0x7f0000000b40)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$get_security(0x11, r4, &(0x7f0000000b80)=""/138, 0x8a) write$selinux_access(r3, &(0x7f0000000000)={'system_u:object_r:etc_t:s0', 0x20, '/usr/sbin/ntpd'}, 0xffffffd9) ioctl$sock_inet_tcp_SIOCINQ(r3, 0x541b, &(0x7f0000000140)) r5 = creat(&(0x7f00000002c0)='./file0\x00', 0x80) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="619fb17934b86908de005083cc6d48e345dee7aad39ced304bbf22a09c23c42ebb649faf0dd9ca00bdeda7cf3cd6d78acb1a4ad252d5090ce0c5a3836f8ffa4b114022e0605236620c5180743e1f076560e2a0165005150a3b6c4fe2452e558efadca311baa1eb3a49dd656bd09868228955f585476dfb8b9514d8fed96ab207fb3def99679ca8effae41bc6e14cf16f2e73"], 0x92) ptrace$peekuser(0x3, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f0000000300)=0xc) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000840)={0x0, 0x0}, &(0x7f0000000880)=0xc) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000008c0)={0x0, 0x0, 0x0}, &(0x7f0000000900)=0xc) sendmsg$unix(r3, &(0x7f0000000ac0)={&(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000400)="c75e8e84c99f67713d85de8e695e42064266ed1c90bb8a0a828c516a181fd27e011b1b34e4bb88f477b75e0140b81b10ee96a2192444ececef2261721cf35ee68f82f2795e49c8495d7b30066961990d3582b89c8c0921e056b0048c64ab5d59e63717fb5c9d07d178fa7b1fd49b0564fb6a59766256f16b5a8090b0e5", 0x7d}, {&(0x7f0000000480)="28e4755cbd4bc417ad4dfcc94189d67ee34134632ea5d38710672fa34a78e2de14b1d3445a4ceb8fa5bb4ee7cf9ec39bb5f91b79e1e30f8bf09eb79915548afc49a4602ac029e473eb6870cbd077651af89b8ab84ce49652e7c3fea441bb4e872d8af6e6b2b132f8bca0b0f3b266304e4754b932f79c31a6cce59c47adb1598ec7d63a3db5a9f1a5a593ab24861cd7a33058f265102f33e5a8f320131bd7a2239efc8f3cc6cfd113cdc8b4055a66f2213b24c4543e4dda9f753dace42585f716eaf19c34b6abd512c088835d091ca3473ad38830fc92954890991c731c9cbc966e2cee58d8c609e3009a2f", 0xeb}, {&(0x7f0000000580)="6ad0fb1bdd9322a2f1e512238f9bd12e9a3e9f3b688c63dceeb90ab1bf2fec521d7f8217773779bd22785e65e71c9bed32c22316fc2b497ab0735004f2632f515b85f3c068ea60e9497174c33293ecf4afe299ff15b6d23af7fd75ac04bc30730a37c04ddd3616d80a1d331b39e5a1cb1ea87a0d6ff263e32d7d6149b0bd8c9adf9262d45ca4451405a3ded4116433bbf7feb6515a7f282613ea3879118edbc665", 0xa1}, {&(0x7f0000000640)="4c43c6aaf74ae60ec79bd2b6b24416ddccd540de2f70746700e03a961b72275c4954b30ffc1a55fc6f44898838e5cdb14cc6ddb061d619a5cdc75fad628512c0b015be83ea9801a40ca075ca450f51210e99610df99cf907851577abdd7adfc3d8d51a0be9945013658dec9a21c13c4ffc37f9c8075d7ada8adaee9d11e7b64e8ed10aa58721daa5f9d321a109457c66119a69b1d706eac1bce01723044fcbcf5898b4c8d584d153a6b4f6f094fdb8ded9f77fe5bc865143edbdadb2c090b54694696f2c3590e968cf2c", 0xca}, {&(0x7f0000000740)="1611f55fa5c23af4629d21ca811702272ba29c8cbc42d32108b6b58ec9785307047cbda613a8a1ff91ff95489923f833d17e93b3af6dd3610c359fdad630aba4305161716fac6e86d3dcbed1763867a22d175f0e79578e8dc2c5c25c2bff857b526af955e73f3b65c12e1211", 0x6c}, {&(0x7f0000000180)="383bef6933150605f9d54c937de68b6a0f0d5ebb14da97eb52732cdc3da738b8", 0x20}], 0x6, &(0x7f0000000940)=[@rights={0x18, 0x1, 0x1, [r5, r3]}, @rights={0x18, 0x1, 0x1, [r0, r2]}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @rights={0x30, 0x1, 0x1, [r3, r1, r1, r2, r3, r1, r5]}, @rights={0x10}, @rights={0x38, 0x1, 0x1, [r1, r3, r2, r3, r5, r3, r5, r1, r3]}, @rights={0x30, 0x1, 0x1, [r5, r5, r5, r0, r5, r3, r1, r5]}, @rights={0x38, 0x1, 0x1, [r5, r2, r3, r5, r1, r0, r0, r3, r5, r2]}, @rights={0x28, 0x1, 0x1, [r5, r1, r3, r2, r0, r5]}], 0x158, 0x4}, 0x40) 13:55:00 executing program 4: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f00000002c0)='hybla\x00', 0x6) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, &(0x7f0000000240), 0xffffffffffffffff, &(0x7f00000001c0)=0x2, 0x8, 0x0) r2 = dup3(r1, r1, 0x7fffd) sendmsg$nl_route_sched(r2, &(0x7f00000006c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xfffffdd2, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[]}, 0x1, 0x0, 0x0, 0x4}, 0x8014) syz_open_dev$ndb(&(0x7f0000000100)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) prctl$setfpexc(0xc, 0x80003) ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x4) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYBLOB="e0000000", @ANYRES16=0x0, @ANYBLOB="080026bd7000fbdbdf25090000000c000200080004001c0e000044000300080008000000000008000500ffffffff140002006272694467655f736c6176655f31000014000600fe8000000000000000000000000000aa080007004e2200000800060009000000240002000800070005000000080004000600000008000b000a00000008000700000000004800010014000300ffffffff0000000000000000000000000c4ab468110006006e6f6e650000000008000b00736970000c0006006c626c6300000000080001000200040008000800008000030000000034000000"], 0xe0}, 0x1, 0x0, 0x0, 0x48000}, 0x800) pkey_mprotect(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x8, 0xffffffffffffffff) sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) 13:55:00 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 377.653155] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x94d5e9cb) [ 377.653161] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 377.653170] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) 13:55:01 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r1) removexattr(&(0x7f0000000100)='./file0\x00', &(0x7f00000000c0)=@known='trusted.syz\x00') syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) [ 377.653176] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 377.764838] IPVS: Creating netns size=2536 id=47 [ 378.004300] binder_alloc: 25921: binder_alloc_buf, no vma [ 378.004319] binder: 25921:25925 transaction failed 29189/-3, size 24-8 line 3136 [ 378.004396] binder: 25921:25925 ERROR: BC_REGISTER_LOOPER called without request 13:55:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)={{0x7f, 0x45, 0x4c, 0x46, 0x2, 0x9, 0x7, 0x8, 0xffff, 0x2, 0x3, 0x1f00000000, 0x3bf, 0x40, 0x2de, 0x7, 0x7ff, 0x38, 0x1, 0x48000000000000, 0x7, 0x100000001}, [{0x6474e557, 0x6, 0x6, 0x5, 0x7cc, 0x8, 0x2, 0x9}, {0x60000006, 0x200, 0x800, 0x9, 0x2, 0x4a5, 0x100000000}], "a59b15a756172ec86a984610752e9cd56919d05adbd7dc857c4bc5ace0fb44ab32de16f85f11317457a33dcbe419466ebdbf2e", [[], [], [], [], [], [], [], [], [], []]}, 0xae3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 378.050015] binder: undelivered TRANSACTION_ERROR: 29201 [ 378.056047] binder: 25921:25930 got transaction to invalid handle [ 378.064348] binder: 25921:25930 transaction failed 29201/-22, size 0-0 line 3013 13:55:01 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x20000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x0, 0x80000000000006) r2 = socket$packet(0x11, 0x808000000002, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x7}, 0x4) getsockname$inet6(r1, &(0x7f0000000300)={0xa, 0x0, 0x0, @local}, &(0x7f0000000340)=0x1c) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000140)=0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000200)=r3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x80000001) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = memfd_create(&(0x7f00000001c0)='vboxnet1\x00', 0x3) sendto$inet6(r4, &(0x7f0000000240)="bae709120cf8dff36763ed6012472a9b37eba0954bb81e2cfcd9af85fd46f2973650c23b6e61c9341690c070c117e9dfb4e1b0057efe6bb6e77b1e063a8fdc83fa400bf8f0d394356f378f34d5", 0x4d, 0x800, &(0x7f00000002c0)={0xa, 0x4e20, 0x2, @dev={0xfe, 0x80, [], 0xd}, 0x10001}, 0x1c) ioctl$LOOP_CHANGE_FD(r4, 0x4c06, r0) sendto$inet6(r1, &(0x7f0000000000), 0xffa7, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0x0, 0x8}}, 0x1c) [ 378.200883] pktgen: kernel_thread() failed for cpu 0 [ 378.206366] pktgen: Cannot create thread for cpu 0 (-4) [ 378.240469] pktgen: kernel_thread() failed for cpu 1 [ 378.250075] pktgen: Cannot create thread for cpu 1 (-4) [ 378.259930] binder: BINDER_SET_CONTEXT_MGR already set [ 378.259940] binder: 25937:25944 ioctl 40046207 0 returned -16 [ 378.260192] binder_alloc: 25921: binder_alloc_buf, no vma [ 378.260211] binder: 25937:25944 transaction failed 29189/-3, size 24-8 line 3136 [ 378.260354] binder: 25937:25944 ERROR: BC_REGISTER_LOOPER called without request [ 378.317839] binder: 25937:25948 got transaction to invalid handle [ 378.317851] binder: 25937:25948 transaction failed 29201/-22, size 0-0 line 3013 [ 378.358995] pktgen: Initialization failed for all threads 13:55:01 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="000000000000000000000000000000000010000000000000ed793afe0000000002008201260001000000640000000001270005000000000000006400000000030d0085043100c90000006400000000043200052020002d010000d306000055aa", 0x60, 0x1a0}]) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000300)="9a73d34594932b767967cc70d2ac5954a8a4811a6ed29c02de2168ba67061984656809f3e2713dcdf776efc02f0a9968efb0ff13c4e2c604c2b4e043044efa1f81e39bc692fb6563e39854801752aa3b13bc9d258fa3e3c668ed0572f3a294ed486ece19dd4a5b4580d66744895fdaeb9651c7bc7674af8fd734dcd9cf9093d1a160479a32143e48b059422f24295d3bababf24ae39198d8319f8c9a63a9ed245b41fddd9a5303bc5a27d695c78280e814b1be6dca06ff24e7a60a21f3aaeeaf1ffdf3e296a1fe62888939a0a237e5552db5370bc03b64ca6b", 0xd9, 0xfffffffffffffffc) r2 = add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r1, 0xda, 0x81, r2) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x800000000fe, 0x0) getpid() mkdir(&(0x7f0000000480)='./file0\x00', 0x40) getsockopt$inet6_int(r3, 0x29, 0xb, &(0x7f00000000c0), &(0x7f00000004c0)=0x4) mkdir(&(0x7f0000000100)='./file0\x00', 0x2) read$FUSE(r3, &(0x7f0000003100), 0x101b) r4 = dup2(r0, 0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000140)='127.0.0.1\x00', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='9p\x00', 0x3400, &(0x7f00000005c0)=ANY=[@ANYBLOB="7472616e733d72646d612c706f727435303830303030303030303030000000968c884e0000000000006d957aee1ffb2fc7adee0012da77252b409d41e5a8862a1b0dac000100563d6267b75940391b469f60b123d75892a43eaa3d64e0a3e0cb8312ad7cbcc231f9c1dfd65fc79cc702d07f41e06de841a67e7fdfcc6c365240f43040b5053cd5b4f25b514fa736"]) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r4) 13:55:01 executing program 7: gettid() r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f000000b000)=[{&(0x7f0000000140)="5500000020007fafb72d00b2a4a2809302000000030343ee6b26236925000234f7555e6262c3af17987cd4b80a0000000000130000008848a3c728f1c46b7b31afdc1338d5440000000000000000000000088daa722733c43ab8220000bfbdba6b0600d417ca6bcb44dfc96c68e0de0164c810576cbad490ca83b3ff555dbd233da8e8132705df6ed0fb7c07149dda7b1f99dde1179694", 0x77}], 0x100000000000000a, &(0x7f0000016000), 0xffffffffffffff86}, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x20000, 0x0) getpeername$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000100)=0x14) readlink(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=""/57, 0x39) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80040000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0xa4, r2, 0xf04, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x80}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x81}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xd6d8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3a48}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xff}]}, 0xa4}}, 0x20004000) lsetxattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)=@known='com.apple.FinderInfo\x00', &(0x7f0000000280)='\'%md5sum\x00', 0x9, 0x3) 13:55:01 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580)='/dev/zero\x00', 0x0, 0x0) linkat(0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', r2, &(0x7f00000008c0)='./file0\x00', 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/loop-control\x00', 0x40, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000700)) r4 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r4) sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000300)={&(0x7f0000000200), 0xc, &(0x7f0000000280)={&(0x7f0000000900)=ANY=[@ANYBLOB="00042bbd7000fcdb00080000000000000200080002004e2067fc13630800040000000000080006000800050001040000b444c6394dd573eddca5be9e4a392a792b88e8ca012ad9bc3e8a409cdf9c2d93f94ff6563d393c891ed9c3e701000000000000007ab5626abb78eed078218b951a15817fa0dd86f5d2e62fd073adb728992b7481f84d46fa476bcbc92204e263162189d7b9ec0000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0xc000}, 0x40) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x2, &(0x7f0000000340)=[{0x0, 0x1008001}, {0xfffffffffffffffd, 0x8ae}]}) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r2, 0x5386, &(0x7f0000000480)) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) r5 = request_key(&(0x7f0000000640)='syzkaller\x00', &(0x7f0000000680)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000006c0)='\x00', 0xfffffffffffffff9) keyctl$set_timeout(0xf, 0x0, 0x0) ioctl$TIOCGPTPEER(r2, 0x5441, 0x0) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000600)) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000140)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)=0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00') mount(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='pstore\x00', 0x4, 0x0) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000180)={0x30, 0x5, 0x0, {0x0, 0x2, 0x9, 0x4}}, 0x30) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) keyctl$get_keyring_id(0x0, r5, 0x1) ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f00000003c0)=""/12) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000400), 0x4) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x3, 0x7, 0x100000001, 0x8, 0x0, 0x2, 0x800, 0x0, 0xfffffffffffffffa, 0xa3, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4355, 0x0, 0x800, 0x0, 0x0, 0x5, 0xff, 0x1, 0x400, 0x2, 0xfffffffffffffff9, 0x8001, 0x0, 0x0, 0x8, 0x2, 0x3, 0xe3f0, 0x8000, 0x6, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000040), 0x2}, 0x0, 0x0, 0x1f, 0x0, 0xff, 0x6}, r6, 0x0, r0, 0x8) 13:55:01 executing program 1: rt_sigprocmask(0x0, &(0x7f0000039ff8)={0xfffffffffffffffa}, 0x0, 0x8) r0 = gettid() timer_create(0x7, &(0x7f0000044000)={0x0, 0x8, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000004a000)={{0x0, 0x1}, {0x0, 0xe4c}}, &(0x7f0000040000)) getpgrp(r0) rt_sigtimedwait(&(0x7f00000000c0)={0x27fffffff}, &(0x7f0000000000), &(0x7f0000000100)={0x77359400}, 0x8) 13:55:01 executing program 2: setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x1b, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f00000001c0)={0x8000000020, @time, 0x0, {0x0, 0x401}, 0x35}) r1 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/pktcdvd/control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000a00)={0x0, 0x0}) fcntl$getownex(r1, 0x10, &(0x7f0000000800)={0x0, 0x0}) getpgrp(r4) getpid() getpgrp(0x0) getpgid(0x0) getuid() stat(&(0x7f00000045c0)='./file0\x00', &(0x7f0000004600)) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000006640)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000005900), &(0x7f0000005940)=0xc) gettid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000006140)={0x0}, &(0x7f0000006180)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000061c0)={{{@in6=@mcast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f00000062c0)=0xe8) lstat(&(0x7f0000006300)='./file0\x00', &(0x7f0000006340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000063c0)='/dev/ptmx\x00', 0x10100, 0x0) sendmsg$netlink(r1, &(0x7f0000006500)={&(0x7f00000007c0)=@kern={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000006080)=[{&(0x7f0000000840)=ANY=[@ANYBLOB="100000004200070306000000fbdbdf2522bbf5f6fd197f5686a8958023f0c58a8dee1dd59373369c924f71c2458449def9b719f29447e49565f454606f0c841d166e4331c2e046ad84443d08934edce4df5677afa8192b425c80c247bbc3b46ba7"], 0x1}], 0x1, &(0x7f00000008c0)=ANY=[@ANYBLOB="30000000000000000100000001000000", @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="0000000020000000000000000100007a39000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r8, @ANYRES32=r1, @ANYRES32=r9, @ANYBLOB="0000d9001800000000000000010000000f249e0fc3c05ae901ee2b725f18d3d8d1fd1264498d399e7ed97b00a0e9f2bb9c28dc9d7586a6706cc29e698847d52e934fd44ea042b5e9737fc922749a391e7eb04d931cad1c8773684d81df366dbfdc9b531cf64c23242843600ea9ebefc28c7e5fe71944c84f2eedf2badbbe7234d250dfa1dc52354c3b6f5438ce9b66383f65fe097b0c2657315fb09f44a51353f61095682ee271aada", @ANYRES32=r1, @ANYRES32=r0], 0x88, 0x20000090}, 0x20004010) utimes(&(0x7f0000000340)='./file0\x00', &(0x7f0000000480)={{r2, r3/1000+30000}, {0x0, 0x7530}}) mq_notify(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, @thr={&(0x7f0000000140), &(0x7f0000000300)}}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000280)) r10 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, r0, 0x0) unshare(0x42060000) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer2\x00', 0x2, 0x0) r11 = accept4(r1, &(0x7f00000003c0)=@nfc, &(0x7f0000000180)=0x80, 0x80800) r12 = pkey_alloc(0x0, 0x2) pkey_free(r12) read(r11, &(0x7f0000000700)=""/134, 0x4c) getsockopt$inet6_IPV6_IPSEC_POLICY(r10, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000000)=0xe8) recvfrom$packet(r10, &(0x7f0000000500)=""/237, 0xed, 0x40000021, &(0x7f0000000240)={0x11, 0x19, r13, 0x1, 0x0, 0x6, @remote}, 0x14) setsockopt$netlink_NETLINK_CAP_ACK(r10, 0x10e, 0xa, &(0x7f0000000140)=0x3, 0x4) fanotify_init(0x0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) 13:55:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pipe2(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x0) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) socket$inet_tcp(0x2, 0x1, 0x0) write$cgroup_type(r5, &(0x7f0000000000)='threaded\x00', 0xfffffdb9) fallocate(r4, 0x10, 0x0, 0xfffe) dup2(r3, r4) 13:55:01 executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000001300010031ebf051115c299c8ede2800", @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f31000004002b00"], 0x38}}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) r2 = geteuid() r3 = getgid() ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000100)=r1) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={r1, r2, r3}, 0xc) 13:55:01 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffff8001}) openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ashmem\x00', 0x0, 0x0) write$P9_RSTAT(r0, &(0x7f0000000040)={0x64, 0x7d, 0x1, {0x0, 0x5d, 0x4, 0x1, {0x44, 0x4, 0x2}, 0x80000, 0x401, 0x7fff, 0x44, 0x1, '/', 0xc, '/dev/ashmem\x00', 0x11, ')posix_acl_access', 0xc, 'systemvmnet0'}}, 0x64) chmod(&(0x7f0000000280)='./file0\x00', 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) 13:55:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000100)=""/175, &(0x7f0000000000)=0xaf) sendto$inet6(r1, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) r2 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f00000000c0)=ANY=[@ANYBLOB="008be469257ce5623daaad9d8f9f0a73d6e548a1f3a50dc08208b08eaeffffc4260dd9393c0d4154379aa092355fe3cc34"], 0x8) setsockopt$inet6_opts(r2, 0x29, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="f00000010000e800cdb18c844f6b640de7220153f332ee1f856f852e1fe937ccf6f81946d6728685601d5e9549be010000000a6f7740fcfa7f57bbdf2de2b1958383353c4405aadde6d273780efb2fb7176264a1cb2bcec62f3e5171ed0e2f87cbb778e4219936caaeb6feadd50e00003f3ba34775390fce9b509ca7c5023d74d491d38432ad9e85be0f1652da21dff2cd5fda70df5a97b4f60bb5352180517c2350c127a0c2034dbdc2bac6556cf594946d49a0232d07fca5a73f8ea1b1dd19cf7f837eb74025be1e4a3db061d2a3cfac054f1c3ca21b684a768ee3c5109a47621627dfd07c98faacfc389275"], 0x8) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0xcc6e470b133e0158, 0x0) 13:55:01 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 378.784869] binder: undelivered TRANSACTION_ERROR: 29201 [ 378.793023] binder: undelivered TRANSACTION_ERROR: 29189 [ 378.812465] loop3: p1 p2 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 p217 p218 p21 loop3: partition table partially beyond EOD, truncated [ 378.911908] loop3: p1 start 1 is beyond EOD, truncated [ 378.918120] loop3: p2 size 2 extends beyond EOD, truncated 13:55:02 executing program 7: process_vm_writev(0x0, &(0x7f0000000000), 0x0, &(0x7f0000003000)=[{&(0x7f0000000040)=""/2, 0xffffffffffffffef}], 0x1, 0x0) sigaltstack(&(0x7f0000004000/0x3000)=nil, &(0x7f0000006ffc)) socketpair(0xa, 0x800, 0x6, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18) sendto$inet(r0, &(0x7f0000000600)="04e6b21af5ed69bf8816d5f9345c8324737929fe33ab3703fe3bb9ee70edb41bc78cb1783549a67581c1a539e81ed7f8013e4a5317873afc8be44274eccb572f44d260e8fa831e43d3a041925c584b163efe651aea48288912198d912c889e332c2224c3048bcc2697fea757f5e4fc8095ce875ebae0596a6d4318fe91f2ec43d09698b180d4a17cdfe8f2589887c4f9f193ae7edd46ab8b3b801e7c721f4837", 0xa0, 0x1, &(0x7f00000006c0)={0x2, 0x4e24, @local}, 0x10) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0xfffffffffffffffa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000140)) write$P9_RLERRORu(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="d5180f7884cac9e0"], 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = syz_open_dev$ndb(&(0x7f0000000300)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r4 = fcntl$getown(r1, 0x9) sched_getparam(r4, &(0x7f00000001c0)) write(r3, &(0x7f0000000380)="8f0552f908a58f5ca13da56559dd7fcd26d9b545ed8f5fb79276eeca408ef83aebfc668536169c041c0efe3e6061bcc213be8cb11bdcb3663f4e818ed8b4d0fe1557ee889f69fba3700e862f6052623a652c132b84fe257a8f85527d0424b36c8ef3adf0f0afd13a0cb0678c355b3a2f02dd21911769a64e4b893b3b0230e46319327da6673ed7b745d57dc118b84cc4d233ea29085dcba374c6112ad3baea21286dcaa89e94566930a66b825eda3d17fe2e0a43d590c09a78d028c59154d183aeb636034c0015b66ffda3c41d771b", 0xcf) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={[], 0xfffffffffffffffe, 0x9, 0x0, 0x0, 0x40}) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) prctl$setfpexc(0xc, 0x80003) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000740)=0x7, 0x4) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000700)={'erspan0\x00'}) sendto$inet(r1, &(0x7f0000a88f88), 0xffffffffffffff35, 0x200007f9, &(0x7f00000005c0)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r0, 0x111, 0x5, 0x0, 0x4) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f0000000340)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) 13:55:02 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, &(0x7f0000000140)="affd8dfc38ba7d9dfca524a1ea516aaa544ed800ebe76d52c6d0bf354c0b0fadf2a91085c056b335ceff56034d31985572c5dabbbb6e4087e5c3048c3fe8cf9490d12e24fb9099613bfea1c1a4ef2d1accb02f146dc85eecb8acf79217be7fff561fcf8ac145e530ed6087601c86920ea06b9279e646726c321e46471a1f1df6907f7abbee28982252b7312815a2ade46ffe1e364935076d81ef74d30a335ea6dee351ac7e58e55579661a7ca1ab8cfac4357599131532bdae454582803dd697b5c342d22baaf53679f9cb7a7bb354e8e5e92e28a5305b8ab01900bb444e8608fc2443ea8af7998e1284dfc29d56e455de", 0xf1, 0x4800, &(0x7f0000000240)={0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, [], 0x1f}, 0x9}, 0x1c) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0xffffffffffffff62) fremovexattr(r0, &(0x7f00000000c0)=@known='user.syz\x00') ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00') recvfrom(r2, &(0x7f0000000640)=""/239, 0xef, 0x0, &(0x7f0000000740)=@in6={0xa, 0x4e22, 0x6, @dev={0xfe, 0x80, [], 0x14}, 0x8}, 0x80) inotify_init() sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, r3, 0x414, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000011}, 0x80) r4 = dup(r2) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000380)=0x1) ioctl$TIOCLINUX3(r1, 0x541c, &(0x7f0000000340)) r5 = socket$netlink(0x10, 0x3, 0x6) ioctl$TIOCCBRK(r1, 0x5428) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000200)="390000001300090468fe000081000000c9ffff3f03000000450001070000003719001a000400020007e91ee400538a274d69a26cdf12f24006", 0x39}], 0x1) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r6 = add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000002c0)="93e5f5e0489292b06997d4022fabfe9ff1fa38a759e9ebff7770db9d03634c46a6d019933e7ee03b81e980f6e19b1f481a7e91495fc14bcc481f6233f932cd990245976e12de7cb9b128da7c4cddee325af24981552e4693a2659e8859db3647eb", 0x61, 0xfffffffffffffff8) keyctl$assume_authority(0x10, r6) sendto$inet6(r2, &(0x7f0000000080), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x2007fff) sendfile(r4, r7, &(0x7f0000d83ff8), 0x8000fffffffe) [ 378.957203] loop3: p3 start 201 is beyond EOD, truncated [ 378.967443] loop3: p4 start 301 is beyond EOD, truncated [ 378.990878] IPVS: length: 175 != 24 [ 378.991952] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 13:55:02 executing program 1: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) write$input_event(r0, &(0x7f0000000140)={{0x0, 0x2710}, 0x5, 0x2, 0x9}, 0x18) r1 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0xb8, 0x0) ioctl$LOOP_CLR_FD(r1, 0x4c01) unshare(0x0) r2 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x7aba8fbc7bbab973, 0x10, r2, 0x5b) sendmsg$nl_route(r3, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="a09f0000520011a4b5fe6bb29031ee03000000a48de8cf7b17b29f90c2110400000000020000cdc984ad6338dc9a79915c8a0dc3b19d95ad80b1fedf3a6e2fa4feddf39b10eb363ba05f3e2e29501d2c05531a0c969bde7edcd41ac35926d31a0718d98a586b3533503f44ffd4f03688c26dde3a82479bcfd275593555f0be17de6f73210b88e0905703e21bb119a90d270b727bcdf81b6aba449d4af463558a8dd28055e55351635610f54d620e2ebf2f5230edb89c3d446677df8bbd4c40ba6c4d782985fb798a48f80d3f306f81746d5b8c96b9d56ab3dfcc655813ad6e9f560ed2e738a80ff5210dcb15eeab1ffee56fd1b816ec1e3208d598f30b6a0e5592fcdaecb2310ce4ce60db1345c5301d694b64941ef0a3f7cc4ae41ab48991096959dd23c17fb29a97a238f05b3e02b1ba5b2de69c72030edb98c76126704eb2eb84b1d43654a4c8a8ee81b7794c643600f212a6f2f3d035f3b62915c647fd421cb4ccd670bbda6d537f74"], 0x14}}, 0x0) 13:55:02 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:02 executing program 0: openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x10080, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 379.010022] IPVS: length: 175 != 24 [ 379.031033] binder: 25999:26006 transaction failed 29189/-22, size 24-8 line 3013 [ 379.041270] binder: 25937:25948 ERROR: BC_REGISTER_LOOPER called without request [ 379.041688] binder_alloc: 25937: binder_alloc_buf, no vma [ 379.041710] binder: 25937:26007 transaction failed 29189/-3, size 0-0 line 3136 [ 379.042365] binder: release 25937:26007 transaction 583 out, still active [ 379.042370] binder: unexpected work type, 4, not freed [ 379.042373] binder: undelivered TRANSACTION_COMPLETE [ 379.042408] binder: undelivered TRANSACTION_ERROR: 29201 [ 379.042521] binder: undelivered TRANSACTION_ERROR: 29189 [ 379.042788] binder: undelivered TRANSACTION_ERROR: 29189 [ 379.061438] binder: release 25937:25948 transaction 583 in, still active [ 379.061444] binder: send failed reply for transaction 583, target dead [ 379.061457] binder: undelivered TRANSACTION_ERROR: 29189 [ 379.138293] loop3: p5 start 1 is beyond EOD, truncated [ 379.144126] loop3: p6 start 1 is beyond EOD, truncated [ 379.149918] loop3: p7 start 1 is beyond EOD, truncated [ 379.155544] loop3: p8 start 1 is beyond EOD, truncated [ 379.161586] loop3: p9 start 1 is beyond EOD, truncated [ 379.167173] loop3: p10 start 1 is beyond EOD, truncated [ 379.174623] loop3: p11 start 1 is beyond EOD, truncated [ 379.180442] loop3: p12 start 1 is beyond EOD, truncated [ 379.186453] loop3: p13 start 1 is beyond EOD, truncated [ 379.192661] loop3: p14 start 1 is beyond EOD, truncated [ 379.198420] loop3: p15 start 1 is beyond EOD, truncated [ 379.204773] loop3: p16 start 1 is beyond EOD, truncated [ 379.211609] loop3: p17 start 1 is beyond EOD, truncated [ 379.217854] loop3: p18 start 1 is beyond EOD, truncated [ 379.223727] loop3: p19 start 1 is beyond EOD, truncated [ 379.230355] loop3: p20 start 1 is beyond EOD, truncated [ 379.237712] loop3: p21 start 1 is beyond EOD, truncated [ 379.244012] loop3: p22 start 1 is beyond EOD, truncated [ 379.249963] loop3: p23 start 1 is beyond EOD, truncated [ 379.256078] loop3: p24 start 1 is beyond EOD, truncated 13:55:02 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 379.275836] loop3: p25 start 1 is beyond EOD, [ 379.281782] binder: 26014:26020 transaction failed 29189/-22, size 24-8 line 3013 [ 379.282245] binder: undelivered TRANSACTION_ERROR: 29189 [ 379.305163] truncated [ 379.307700] loop3: p26 start 1 is beyond EOD, truncated [ 379.316608] loop3: p27 start 1 is beyond EOD, truncated [ 379.322356] loop3: p28 start 1 is beyond EOD, truncated [ 379.338556] loop3: p29 start 1 is beyond EOD, truncated [ 379.346526] loop3: p30 start 1 is beyond EOD, truncated [ 379.353771] loop3: p31 start 1 is beyond EOD, truncated [ 379.359887] loop3: p32 start 1 is beyond EOD, truncated [ 379.374880] loop3: p33 start 1 is beyond EOD, truncated [ 379.387929] loop3: p34 start 1 is beyond EOD, truncated [ 379.393560] loop3: p35 start 1 is beyond EOD, truncated [ 379.401274] binder: 26017:26025 ERROR: BC_REGISTER_LOOPER called without request [ 379.401392] binder_alloc: 26017: binder_alloc_buf, no vma [ 379.401411] binder: 26017:26025 transaction failed 29189/-3, size 0-0 line 3136 [ 379.416155] binder_alloc: binder_alloc_mmap_handler: 26017 20001000-20004000 already mapped failed -16 [ 379.416417] binder: BINDER_SET_CONTEXT_MGR already set [ 379.416454] binder: 26017:26025 ioctl 40046207 0 returned -16 [ 379.422269] binder_alloc: 26017: binder_alloc_buf, no vma [ 379.422288] binder: 26017:26026 transaction failed 29189/-3, size 24-8 line 3136 [ 379.422388] binder: 26017:26025 ERROR: BC_REGISTER_LOOPER called without request [ 379.428982] binder: 26017:26026 got transaction to invalid handle [ 379.429016] binder: 26017:26026 transaction failed 29201/-22, size 0-0 line 3013 [ 379.436921] binder: undelivered TRANSACTION_ERROR: 29201 [ 379.436943] binder: undelivered TRANSACTION_ERROR: 29189 [ 379.437015] binder: release 26017:26025 transaction 589 in, still active [ 379.437063] binder: send failed reply for transaction 589 to 26017:26025 [ 379.437073] binder: undelivered TRANSACTION_ERROR: 29189 [ 379.437234] binder: undelivered TRANSACTION_COMPLETE [ 379.437241] binder: undelivered TRANSACTION_ERROR: 29189 [ 379.524434] binder: 26029:26031 transaction failed 29189/-22, size 24-8 line 3013 [ 379.524844] binder: undelivered TRANSACTION_ERROR: 29189 [ 379.678181] loop3: p36 start 1 is beyond EOD, truncated [ 379.685629] loop3: p37 start 1 is beyond EOD, [ 379.692403] pktgen: kernel_thread() failed for cpu 0 [ 379.692412] pktgen: Cannot create thread for cpu 0 (-4) [ 379.692427] pktgen: kernel_thread() failed for cpu 1 [ 379.692435] pktgen: Cannot create thread for cpu 1 (-4) [ 379.692438] pktgen: Initialization failed for all threads [ 379.719533] truncated [ 379.721971] loop3: p38 start 1 is beyond EOD, truncated [ 379.727469] loop3: p39 start 1 is beyond EOD, truncated [ 379.748975] loop3: p40 start 1 is beyond EOD, truncated [ 379.754471] loop3: p41 start 1 is beyond EOD, truncated [ 379.768971] loop3: p42 start 1 is beyond EOD, truncated [ 379.774935] loop3: p43 start 1 is beyond EOD, truncated [ 379.786245] loop3: p44 start 1 is beyond EOD, truncated [ 379.797110] loop3: p45 start 1 is beyond EOD, truncated [ 379.809247] loop3: p46 start 1 is beyond EOD, truncated [ 379.827855] loop3: p47 start 1 is beyond EOD, truncated [ 379.835462] loop3: p48 start 1 is beyond EOD, truncated [ 379.841037] loop3: p49 start 1 is beyond EOD, truncated [ 379.846643] loop3: p50 start 1 is beyond EOD, truncated [ 379.852309] loop3: p51 start 1 is beyond EOD, truncated [ 379.857958] loop3: p52 start 1 is beyond EOD, truncated [ 379.863593] loop3: p53 start 1 is beyond EOD, truncated [ 379.869293] loop3: p54 start 1 is beyond EOD, truncated [ 379.874877] loop3: p55 start 1 is beyond EOD, truncated [ 379.880460] loop3: p56 start 1 is beyond EOD, truncated [ 379.886117] loop3: p57 start 1 is beyond EOD, truncated [ 379.892014] loop3: p58 start 1 is beyond EOD, truncated [ 379.900040] loop3: p59 start 1 is beyond EOD, truncated [ 379.907158] loop3: p60 start 1 is beyond EOD, truncated [ 379.912770] loop3: p61 start 1 is beyond EOD, truncated [ 379.918379] loop3: p62 start 1 is beyond EOD, truncated [ 379.923944] loop3: p63 start 1 is beyond EOD, truncated [ 379.929486] loop3: p64 start 1 is beyond EOD, truncated [ 379.935029] loop3: p65 start 1 is beyond EOD, truncated [ 379.940721] loop3: p66 start 1 is beyond EOD, truncated [ 379.946236] loop3: p67 start 1 is beyond EOD, truncated [ 379.951828] loop3: p68 start 1 is beyond EOD, truncated [ 379.957398] loop3: p69 start 1 is beyond EOD, truncated [ 379.962948] loop3: p70 start 1 is beyond EOD, truncated [ 379.968541] loop3: p71 start 1 is beyond EOD, truncated [ 379.974137] loop3: p72 start 1 is beyond EOD, truncated [ 379.979674] loop3: p73 start 1 is beyond EOD, truncated [ 379.985212] loop3: p74 start 1 is beyond EOD, truncated [ 379.990814] loop3: p75 start 1 is beyond EOD, truncated [ 379.996321] loop3: p76 start 1 is beyond EOD, truncated [ 380.002174] loop3: p77 start 1 is beyond EOD, truncated [ 380.007696] loop3: p78 start 1 is beyond EOD, truncated [ 380.013368] loop3: p79 start 1 is beyond EOD, truncated [ 380.018968] loop3: p80 start 1 is beyond EOD, truncated [ 380.024571] loop3: p81 start 1 is beyond EOD, truncated [ 380.030250] loop3: p82 start 1 is beyond EOD, truncated [ 380.035840] loop3: p83 start 1 is beyond EOD, truncated [ 380.041463] loop3: p84 start 1 is beyond EOD, truncated [ 380.047049] loop3: p85 start 1 is beyond EOD, truncated [ 380.052678] loop3: p86 start 1 is beyond EOD, truncated [ 380.058336] loop3: p87 start 1 is beyond EOD, truncated [ 380.063900] loop3: p88 start 1 is beyond EOD, truncated [ 380.069443] loop3: p89 start 1 is beyond EOD, truncated [ 380.074981] loop3: p90 start 1 is beyond EOD, truncated [ 380.080579] loop3: p91 start 1 is beyond EOD, truncated [ 380.086086] loop3: p92 start 1 is beyond EOD, truncated [ 380.091663] loop3: p93 start 1 is beyond EOD, truncated [ 380.097212] loop3: p94 start 1 is beyond EOD, truncated [ 380.102751] loop3: p95 start 1 is beyond EOD, truncated [ 380.108596] loop3: p96 start 1 is beyond EOD, truncated [ 380.114190] loop3: p97 start 1 is beyond EOD, truncated [ 380.119789] loop3: p98 start 1 is beyond EOD, truncated [ 380.125299] loop3: p99 start 1 is beyond EOD, truncated [ 380.130870] loop3: p100 start 1 is beyond EOD, truncated [ 380.136516] loop3: p101 start 1 is beyond EOD, truncated [ 380.142146] loop3: p102 start 1 is beyond EOD, truncated [ 380.147818] loop3: p103 start 1 is beyond EOD, truncated [ 380.153687] loop3: p104 start 1 is beyond EOD, truncated [ 380.159330] loop3: p105 start 1 is beyond EOD, truncated [ 380.164888] loop3: p106 start 1 is beyond EOD, truncated [ 380.170571] loop3: p107 start 1 is beyond EOD, truncated [ 380.176267] loop3: p108 start 1 is beyond EOD, truncated [ 380.181972] loop3: p109 start 1 is beyond EOD, truncated [ 380.187654] loop3: p110 start 1 is beyond EOD, truncated [ 380.193378] loop3: p111 start 1 is beyond EOD, truncated [ 380.199147] loop3: p112 start 1 is beyond EOD, truncated [ 380.204826] loop3: p113 start 1 is beyond EOD, truncated [ 380.210560] loop3: p114 start 1 is beyond EOD, truncated [ 380.216247] loop3: p115 start 1 is beyond EOD, truncated [ 380.222211] loop3: p116 start 1 is beyond EOD, truncated [ 380.227966] loop3: p117 start 1 is beyond EOD, truncated [ 380.233574] loop3: p118 start 1 is beyond EOD, truncated [ 380.239271] loop3: p119 start 1 is beyond EOD, truncated [ 380.244907] loop3: p120 start 1 is beyond EOD, truncated [ 380.250635] loop3: p121 start 1 is beyond EOD, truncated [ 380.256231] loop3: p122 start 1 is beyond EOD, truncated [ 380.261903] loop3: p123 start 1 is beyond EOD, truncated [ 380.267570] loop3: p124 start 1 is beyond EOD, truncated [ 380.273195] loop3: p125 start 1 is beyond EOD, truncated [ 380.278859] loop3: p126 start 1 is beyond EOD, truncated [ 380.284506] loop3: p127 start 1 is beyond EOD, truncated [ 380.290133] loop3: p128 start 1 is beyond EOD, truncated [ 380.295759] loop3: p129 start 1 is beyond EOD, truncated [ 380.301441] loop3: p130 start 1 is beyond EOD, truncated [ 380.307060] loop3: p131 start 1 is beyond EOD, truncated [ 380.312720] loop3: p132 start 1 is beyond EOD, truncated [ 380.318404] loop3: p133 start 1 is beyond EOD, truncated [ 380.323998] loop3: p134 start 1 is beyond EOD, truncated [ 380.329933] loop3: p135 start 1 is beyond EOD, truncated [ 380.335594] loop3: p136 start 1 is beyond EOD, truncated [ 380.341241] loop3: p137 start 1 is beyond EOD, truncated [ 380.346869] loop3: p138 start 1 is beyond EOD, truncated [ 380.352570] loop3: p139 start 1 is beyond EOD, truncated [ 380.358190] loop3: p140 start 1 is beyond EOD, truncated [ 380.363832] loop3: p141 start 1 is beyond EOD, truncated [ 380.369505] loop3: p142 start 1 is beyond EOD, truncated [ 380.375101] loop3: p143 start 1 is beyond EOD, truncated [ 380.380762] loop3: p144 start 1 is beyond EOD, truncated [ 380.386418] loop3: p145 start 1 is beyond EOD, truncated [ 380.392110] loop3: p146 start 1 is beyond EOD, truncated [ 380.397765] loop3: p147 start 1 is beyond EOD, truncated [ 380.403407] loop3: p148 start 1 is beyond EOD, truncated [ 380.409029] loop3: p149 start 1 is beyond EOD, truncated [ 380.414654] loop3: p150 start 1 is beyond EOD, truncated [ 380.420325] loop3: p151 start 1 is beyond EOD, truncated [ 380.425910] loop3: p152 start 1 is beyond EOD, truncated [ 380.431568] loop3: p153 start 1 is beyond EOD, truncated [ 380.437212] loop3: p154 start 1 is beyond EOD, truncated [ 380.443049] loop3: p155 start 1 is beyond EOD, truncated [ 380.448719] loop3: p156 start 1 is beyond EOD, truncated [ 380.454371] loop3: p157 start 1 is beyond EOD, truncated [ 380.459998] loop3: p158 start 1 is beyond EOD, truncated [ 380.465628] loop3: p159 start 1 is beyond EOD, truncated [ 380.471288] loop3: p160 start 1 is beyond EOD, truncated [ 380.476877] loop3: p161 start 1 is beyond EOD, truncated [ 380.482545] loop3: p162 start 1 is beyond EOD, truncated [ 380.488260] loop3: p163 start 1 is beyond EOD, truncated [ 380.493863] loop3: p164 start 1 is beyond EOD, truncated [ 380.499539] loop3: p165 start 1 is beyond EOD, truncated [ 380.505185] loop3: p166 start 1 is beyond EOD, truncated [ 380.510809] loop3: p167 start 1 is beyond EOD, truncated [ 380.516436] loop3: p168 start 1 is beyond EOD, truncated [ 380.522120] loop3: p169 start 1 is beyond EOD, truncated [ 380.527703] loop3: p170 start 1 is beyond EOD, truncated [ 380.533367] loop3: p171 start 1 is beyond EOD, truncated [ 380.539053] loop3: p172 start 1 is beyond EOD, truncated [ 380.544642] loop3: p173 start 1 is beyond EOD, truncated [ 380.550527] loop3: p174 start 1 is beyond EOD, truncated [ 380.556216] loop3: p175 start 1 is beyond EOD, truncated [ 380.561848] loop3: p176 start 1 is beyond EOD, truncated [ 380.567475] loop3: p177 start 1 is beyond EOD, truncated [ 380.573214] loop3: p178 start 1 is beyond EOD, truncated [ 380.578913] loop3: p179 start 1 is beyond EOD, truncated [ 380.584548] loop3: p180 start 1 is beyond EOD, truncated [ 380.590232] loop3: p181 start 1 is beyond EOD, truncated [ 380.595818] loop3: p182 start 1 is beyond EOD, truncated [ 380.601474] loop3: p183 start 1 is beyond EOD, truncated [ 380.607136] loop3: p184 start 1 is beyond EOD, truncated [ 380.612755] loop3: p185 start 1 is beyond EOD, truncated [ 380.618477] loop3: p186 start 1 is beyond EOD, truncated [ 380.624141] loop3: p187 start 1 is beyond EOD, truncated [ 380.629758] loop3: p188 start 1 is beyond EOD, truncated [ 380.635448] loop3: p189 start 1 is beyond EOD, truncated [ 380.641129] loop3: p190 start 1 is beyond EOD, truncated [ 380.646713] loop3: p191 start 1 is beyond EOD, truncated [ 380.652443] loop3: p192 start 1 is beyond EOD, truncated [ 380.658300] loop3: p193 start 1 is beyond EOD, truncated [ 380.663895] loop3: p194 start 1 is beyond EOD, truncated [ 380.669549] loop3: p195 start 1 is beyond EOD, truncated [ 380.675192] loop3: p196 start 1 is beyond EOD, truncated [ 380.680809] loop3: p197 start 1 is beyond EOD, truncated [ 380.686431] loop3: p198 start 1 is beyond EOD, truncated [ 380.692102] loop3: p199 start 1 is beyond EOD, truncated [ 380.697694] loop3: p200 start 1 is beyond EOD, truncated [ 380.703358] loop3: p201 start 1 is beyond EOD, truncated [ 380.709037] loop3: p202 start 1 is beyond EOD, truncated [ 380.714627] loop3: p203 start 1 is beyond EOD, truncated [ 380.720284] loop3: p204 start 1 is beyond EOD, truncated [ 380.725918] loop3: p205 start 1 is beyond EOD, truncated [ 380.731608] loop3: p206 start 1 is beyond EOD, truncated [ 380.737247] loop3: p207 start 1 is beyond EOD, truncated [ 380.742908] loop3: p208 start 1 is beyond EOD, truncated [ 380.748522] loop3: p209 start 1 is beyond EOD, truncated [ 380.754170] loop3: p210 start 1 is beyond EOD, truncated [ 380.759840] loop3: p211 start 1 is beyond EOD, truncated [ 380.765428] loop3: p212 start 1 is beyond EOD, truncated [ 380.771307] loop3: p213 start 1 is beyond EOD, truncated [ 380.776947] loop3: p214 start 1 is beyond EOD, truncated [ 380.782570] loop3: p215 start 1 is beyond EOD, truncated [ 380.788247] loop3: p216 start 1 is beyond EOD, truncated [ 380.793894] loop3: p217 start 1 is beyond EOD, truncated [ 380.799509] loop3: p218 start 1 is beyond EOD, truncated [ 380.805136] loop3: p219 start 1 is beyond EOD, truncated [ 380.810803] loop3: p220 start 1 is beyond EOD, truncated [ 380.816391] loop3: p221 start 1 is beyond EOD, truncated [ 380.822078] loop3: p222 start 1 is beyond EOD, truncated [ 380.827724] loop3: p223 start 1 is beyond EOD, truncated [ 380.833358] loop3: p224 start 1 is beyond EOD, truncated [ 380.839017] loop3: p225 start 1 is beyond EOD, truncated [ 380.844661] loop3: p226 start 1 is beyond EOD, truncated [ 380.850295] loop3: p227 start 1 is beyond EOD, truncated [ 380.855918] loop3: p228 start 1 is beyond EOD, truncated [ 380.861584] loop3: p229 start 1 is beyond EOD, truncated [ 380.867189] loop3: p230 start 1 is beyond EOD, truncated [ 380.872870] loop3: p231 start 1 is beyond EOD, truncated [ 380.878682] loop3: p232 start 1 is beyond EOD, truncated [ 380.884315] loop3: p233 start 1 is beyond EOD, truncated [ 380.890001] loop3: p234 start 1 is beyond EOD, truncated [ 380.895667] loop3: p235 start 1 is beyond EOD, truncated [ 380.901336] loop3: p236 start 1 is beyond EOD, truncated [ 380.906960] loop3: p237 start 1 is beyond EOD, truncated [ 380.912625] loop3: p238 start 1 is beyond EOD, truncated [ 380.918247] loop3: p239 start 1 is beyond EOD, truncated [ 380.923878] loop3: p240 start 1 is beyond EOD, truncated [ 380.929574] loop3: p241 start 1 is beyond EOD, truncated [ 380.935176] loop3: p242 start 1 is beyond EOD, truncated [ 380.940838] loop3: p243 start 1 is beyond EOD, truncated [ 380.946491] loop3: p244 start 1 is beyond EOD, truncated [ 380.952127] loop3: p245 start 1 is beyond EOD, truncated [ 380.957818] loop3: p246 start 1 is beyond EOD, truncated [ 380.963536] loop3: p247 start 1 is beyond EOD, truncated [ 380.969175] loop3: p248 start 1 is beyond EOD, truncated [ 380.974801] loop3: p249 start 1 is beyond EOD, truncated 13:55:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/snmp\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000000c0), 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000140)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0xa, &(0x7f0000000100)=0x3, 0x4) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000000)) sendto$inet6(r1, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000280)) sendfile(r2, r3, &(0x7f0000d83ff8), 0x8000fffffffe) 13:55:04 executing program 1: r0 = socket(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendto$inet6(r0, &(0x7f0000000080), 0x0, 0x8081, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000280), 0x1b2, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0x0, 0x8}}, 0x1c) 13:55:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) mount(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000280)='affs\x00', 0x81, &(0x7f0000000380)="4de5ab4460c2de1d67535f3818c3d36f9ae576baa87fb3b7a1705133be1340f2a326240af15a63eda21cdd6b3199a39c9d5b4718af5ea192aae422bafdb371107fda1c9243856068d1e99352f3") r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f00000007c0)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0000000000000000fce330e005d0adc3feeb7e0ee500870647ae8ac49e84347553e22b98e203db2c32dd1f83855aaf3ab0a1a297302bb6a5d01c9aa206d1b034e5ca11520b3855decdd002053b8dd5ae7b0b65093bb78c91b7b097c7ff6a6b876cb131867beb32ec1b28ae06752c731202974a2879b591c9066ca84591136a2b12a4f609ed536aecbcaf36f4544553d9c11395475f6084af5b7ac8b16b38a556dc0404b4ddf6f2fe7c60601d2d7c564456844e417478b249086a8e58e2c4bd5131de870d30821b3e202f4e242174fcb0a402a8ce467eda1735a3a43c2a273adc83e0f3c4360185c80bf36e95399681ff1563438691cbce3e6c3234b3c4fc2c714ae825b2"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x29, 0x0, &(0x7f00000002c0)="066f611070a1e4e57ea1e0c85a8520503e26419aefe0fa66839fb3a153b400444983381a368a224244"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x3, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)="a438832bc8728ec439278905b817a42128228729a4b04b0f86f153f5c5a4cf31d1852514b210ee318a05fc0e87ec8d993277887721608a3d18b5c269b2536f385962d809e91b0a66cdde8bdba2c5eacba74152c47ca14918d38346df0547f327920605a8a8b03b7b705e19191ab39d959ca48478af9b6c7f03aa7de6ef67016f32200fdd7bd7b19081f21cb915cd7bbfa7e83583b58e0d90a108dfd9717396761533fe65786f74c1ec52386ec15040769df6e639d8e5dfd7944819beab801b1ae4fdc273eeea159dd54788dfa651ab1954dc"}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x4c0101, 0x0) write$UHID_CREATE(r2, &(0x7f0000000680)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000580)=""/220, 0xdc, 0x77, 0xe0ca, 0x1, 0x6, 0x7}, 0x120) mmap$binder(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x80000000000008, 0x12, r2, 0x0) 13:55:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:04 executing program 7: process_vm_writev(0x0, &(0x7f0000000000), 0x0, &(0x7f0000003000)=[{&(0x7f0000000040)=""/2, 0xffffffffffffffef}], 0x1, 0x0) sigaltstack(&(0x7f0000004000/0x3000)=nil, &(0x7f0000006ffc)) socketpair(0xa, 0x800, 0x6, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18) sendto$inet(r0, &(0x7f0000000600)="04e6b21af5ed69bf8816d5f9345c8324737929fe33ab3703fe3bb9ee70edb41bc78cb1783549a67581c1a539e81ed7f8013e4a5317873afc8be44274eccb572f44d260e8fa831e43d3a041925c584b163efe651aea48288912198d912c889e332c2224c3048bcc2697fea757f5e4fc8095ce875ebae0596a6d4318fe91f2ec43d09698b180d4a17cdfe8f2589887c4f9f193ae7edd46ab8b3b801e7c721f4837", 0xa0, 0x1, &(0x7f00000006c0)={0x2, 0x4e24, @local}, 0x10) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0xfffffffffffffffa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000140)) write$P9_RLERRORu(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="d5180f7884cac9e0"], 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = syz_open_dev$ndb(&(0x7f0000000300)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r4 = fcntl$getown(r1, 0x9) sched_getparam(r4, &(0x7f00000001c0)) write(r3, &(0x7f0000000380)="8f0552f908a58f5ca13da56559dd7fcd26d9b545ed8f5fb79276eeca408ef83aebfc668536169c041c0efe3e6061bcc213be8cb11bdcb3663f4e818ed8b4d0fe1557ee889f69fba3700e862f6052623a652c132b84fe257a8f85527d0424b36c8ef3adf0f0afd13a0cb0678c355b3a2f02dd21911769a64e4b893b3b0230e46319327da6673ed7b745d57dc118b84cc4d233ea29085dcba374c6112ad3baea21286dcaa89e94566930a66b825eda3d17fe2e0a43d590c09a78d028c59154d183aeb636034c0015b66ffda3c41d771b", 0xcf) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={[], 0xfffffffffffffffe, 0x9, 0x0, 0x0, 0x40}) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) prctl$setfpexc(0xc, 0x80003) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000740)=0x7, 0x4) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000700)={'erspan0\x00'}) sendto$inet(r1, &(0x7f0000a88f88), 0xffffffffffffff35, 0x200007f9, &(0x7f00000005c0)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r0, 0x111, 0x5, 0x0, 0x4) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f0000000340)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) 13:55:04 executing program 4: r0 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) bind$unix(r0, &(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) rt_sigqueueinfo(r1, 0x27, &(0x7f00000001c0)={0x1a, 0x9, 0x300000000, 0x100000001}) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000040)=""/33, &(0x7f0000000080)=0x21) mount(&(0x7f00000012c0)='./file0\x00', &(0x7f0000001300)='./file0\x00', &(0x7f0000000100)='tmpfs\x00', 0x0, &(0x7f0000000080)) 13:55:04 executing program 2: r0 = socket$inet(0x2, 0x3, 0x19) getsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000100)=""/103, &(0x7f00000001c0)=0x67) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0xf5) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000340)={0x3, 0x8, 0xfc, &(0x7f0000000240)="6eb42efbda14ebd7350b3cb865ba9ee070933f3f66c581b1845d3f9a6638b6d43d9ab7d874211ce580dffa9ad9ed8a119164431f0b9edceeb90e0716c13d8836836b0c699ba548ce0fc861c759674c92d9280c104d65d839549c4fdd37ab3df786b7039b6b6ffe26696427ab34b032c47b18bcc48508be2645d27a01be0389ba131aa72f0700cfaabf624533eecad2aa6285f24d0053f57ea3c5a8722d6b5f3ab105a48ea5bca805a7bfe27fbb1a2d71390692f75ca8805d63f6b1df50cc8cac3127fb7845042729425650bd65e86d40a06ad432af8fc245c389825ae0eb227f3369eed331c026c80c148677f0a3b235e58668d3dbeb7be9bd77e9dd"}) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast2, @local, 0x0, 0x2, [@local, @multicast2]}, 0x18) setsockopt$inet_mreqn(r0, 0x0, 0x26, &(0x7f0000000200)={@multicast2, @local}, 0xc) 13:55:04 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x408100, 0x0) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000100)) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0xb08, &(0x7f0000000000)="025c3f0a00145f8f764070fb4b6d6b77c62102576226da137adf7e55957d067d735c94d5d49219dac66a30101aff3b8aa75892072c4a87eaafc117382e5ce5b0edecac92f05195c4263333a65951fed9d8b2c3356fa4abed58c8b5fb8d4b05eb6136cada61993dfaf6a4ab78ed2140d77ce73fcabd3c553c34addfff97838b225a1947a54229ada63e56530a648787ef28052955b81d23ca7152bff60a5f366de457e2f1b302f5581d02cd78") setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000140)="ad076c84a0d63fbf3bb669041d036842", 0x10) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x11) [ 380.980478] loop3: p250 start 1 is beyond EOD, truncated [ 380.986084] loop3: p251 start 1 is beyond EOD, truncated [ 380.991964] loop3: p252 start 1 is beyond EOD, truncated [ 380.997610] loop3: p253 start 1 is beyond EOD, truncated [ 381.003251] loop3: p254 start 1 is beyond EOD, truncated [ 381.008924] loop3: p255 start 1 is beyond EOD, truncated 13:55:04 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./file0\x00', 0x0, 0x0) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000980)) fstat(r0, &(0x7f0000000200)) r1 = socket$inet6(0xa, 0x8f, 0x3) ustat(0x0, &(0x7f0000000080)) ioctl(r1, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070") r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(r0, &(0x7f0000000040)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=@getrule={0x14, 0x22, 0x401}, 0x14}}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={&(0x7f0000000480), 0xc, &(0x7f0000000180)={&(0x7f00000004c0)=@getpolicy={0x58, 0x15, 0x305, 0x0, 0x0, {{@in=@multicast1, @in6=@ipv4={[], [], @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0, 0x3a}, 0x6e6bbe}, [@extra_flags={0x8}]}, 0x58}, 0x8}, 0x0) 13:55:04 executing program 1: mkdir(&(0x7f0000cb3ff8)='./file0\x00', 0x0) r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000200)={0x0, &(0x7f00000001c0)}, 0xfffffffffffffe89) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000500)={0x0, 0x0, 0x0}, &(0x7f0000000540)=0xc) write$selinux_access(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB='sxstem_u:object_r:console_device_t:s0 unconfined 00000000000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x46) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x5612, 0x0, 0x19, 0x0, "a04caeac0e5aa40eb75d5a7dea7a4204b2f5f22195f365cad379befe7785d9c29f487b9fb3b6d17794cc151a432c008f7375a302b3bb9625d4b33eb1624ec685", "e441db7501f40018acf0c11f749a595c417fa75e0cc3af3874452c09a243c26e", [0x7]}) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0, r1}, 0xc) fcntl$getflags(0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x181000, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(r2, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) dup2(r0, r2) r4 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) mkdirat(r4, &(0x7f0000643ff8)='./file0\x00', 0x0) r5 = open$dir(&(0x7f00004daff8)='./file0\x00', 0x0, 0x0) ioctl$TCSETS(r4, 0x5402, &(0x7f0000000040)={0x2, 0x401, 0x0, 0x9, 0x101, 0x3, 0xc84, 0x3f, 0x7fffffff, 0x100, 0x6b, 0x4}) openat(r5, &(0x7f00006e9ff8)='./file0\x00', 0x0, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) mount(&(0x7f0000000240)='./file0\x00', &(0x7f00000003c0)='./file0\x00', &(0x7f00009b9000)="0500de00667300", 0x1008, &(0x7f00000002c0)) 13:55:04 executing program 2: syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000100)="024344303031", 0x6, 0x9000}], 0x0, &(0x7f0000000300)=ANY=[]) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x80, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000140)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) [ 381.084102] binder: 26048:26056 ERROR: BC_REGISTER_LOOPER called without request [ 381.094607] tmpfs: No value for mount option '!' [ 381.095695] binder: BINDER_SET_CONTEXT_MGR already set [ 381.095704] binder: 26050:26061 ioctl 40046207 0 returned -16 [ 381.095897] binder: 26050:26061 ERROR: BC_REGISTER_LOOPER called without request [ 381.125091] binder_alloc: 26048: binder_alloc_buf, no vma [ 381.125103] binder: 26048:26056 transaction failed 29189/-3, size 0-0 line 3136 [ 381.146330] binder: 26050:26065 got transaction to invalid handle [ 381.146340] binder: 26050:26065 transaction failed 29201/-22, size 0-0 line 3013 [ 381.153343] binder_alloc: binder_alloc_mmap_handler: 26048 20001000-20004000 already mapped failed -16 [ 381.153495] binder: BINDER_SET_CONTEXT_MGR already set [ 381.153503] binder: 26048:26056 ioctl 40046207 0 returned -16 13:55:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) signalfd(r0, &(0x7f00000000c0)={0x100}, 0x8) [ 381.161020] binder_alloc: 26048: binder_alloc_buf, no vma [ 381.161039] binder: 26048:26066 transaction failed 29189/-3, size 24-8 line 3136 [ 381.161202] binder: 26048:26056 ERROR: BC_REGISTER_LOOPER called without request [ 381.170662] binder: 26048:26066 got transaction to invalid handle [ 381.170672] binder: 26048:26066 transaction failed 29201/-22, size 0-0 line 3013 [ 381.177976] binder: undelivered TRANSACTION_ERROR: 29189 [ 381.177999] binder: undelivered TRANSACTION_ERROR: 29189 [ 381.178045] binder: send failed reply for transaction 597 to 26048:26056 [ 381.178056] binder: send failed reply for transaction 600 to 26050:26061 [ 381.181978] binder: undelivered TRANSACTION_COMPLETE [ 381.181984] binder: undelivered TRANSACTION_ERROR: 29189 [ 381.182289] binder: undelivered TRANSACTION_ERROR: 29201 13:55:04 executing program 4: mkdir(&(0x7f0000000500)='./file0\x00', 0x0) mount(&(0x7f00000003c0)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x40000, &(0x7f0000000600)="6e59bcb7990532ea8611d8ffe2a46f424ffdbd8b44f62660dfdb6f170d32e2183e1b504c9e4d7180414704327d316c7bd06a7f1b9386") r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/uinput\x00', 0x400800, 0x0) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mknod$loop(&(0x7f00000002c0)='./file0\x00', 0x200000000000000, 0x0) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000100)='.', &(0x7f00000001c0)='loefs\x00', 0x9004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f0000000ac0)) mount(&(0x7f0000000400)='./file0\x00', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000540)='ramfs\x00', 0x2000006, &(0x7f0000000580)) mount(&(0x7f0000377ff8)='.', &(0x7f0000002e80)='./file0\x00', &(0x7f0000753000)='msdos\x00', 0x0, &(0x7f0000000380)) mkdir(&(0x7f0000000180)='./file0\x00', 0x8) umount2(&(0x7f0000000440)='./file0\x00', 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000880)='IPVS\x00') mkdir(&(0x7f0000000380)='./file0\x00', 0x40) sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f00000009c0)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRESHEX=r0], 0x1}, 0x1, 0x0, 0x0, 0x20000090}, 0x200488d0) 13:55:04 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip6_mr_vif\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f00000000c0)=0x2000000, 0x10000000000443) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000001c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0xff) setsockopt$inet6_int(r1, 0x29, 0x35, &(0x7f0000000240)=0x3, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000380)=0x1, 0xff0f) r2 = socket(0xa, 0x2, 0x0) ioctl(r2, 0x9, &(0x7f0000000200)="2894ba9157f2fd7464231bc335c80ab46311209daf180bd969256196f49435468f5d906c") ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000080)={{0x2, 0x0, @loopback}, {0x0, @remote}, 0x2, {0x2, 0x0, @broadcast}, 'bond_slave_1\x00'}) syz_genetlink_get_family_id$team(&(0x7f0000000880)='team\x00') getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000480)={@multicast2, @broadcast}, &(0x7f00000004c0)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000008c0)={'team_slave_0\x00'}) accept$packet(r0, &(0x7f00000009c0), &(0x7f0000000a00)=0x14) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000a40)={0x0, @multicast2, @multicast2}, &(0x7f0000000a80)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000ac0)={{{@in=@dev, @in=@remote}}, {{@in6=@remote}, 0x0, @in6=@mcast2}}, &(0x7f0000000bc0)=0xe8) accept$packet(r0, &(0x7f0000000c00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000c40)=0x14) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000000d40)={@mcast2}, &(0x7f0000000d80)=0x14) getsockname$packet(r2, &(0x7f0000000f40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000f80)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000fc0)={0x0, @local, @local}, &(0x7f0000001000)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@ipv4}, 0x0, @in=@local}}, &(0x7f0000001140)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000001180)={{{@in6=@mcast1, @in=@rand_addr}}, {{@in6=@mcast1}, 0x0, @in6=@remote}}, &(0x7f0000001280)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000012c0)={{{@in=@remote, @in=@multicast1}}, {{@in=@loopback}}}, &(0x7f00000013c0)=0xe8) getpeername(r0, &(0x7f00000014c0)=@xdp, &(0x7f0000001540)=0x80) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000001580)={{{@in6=@mcast1, @in6=@mcast2}}, {{@in=@rand_addr}, 0x0, @in=@broadcast}}, &(0x7f0000001680)=0xe8) recvmsg(r2, &(0x7f0000001dc0)={&(0x7f00000016c0)=@hci, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001740)=""/227, 0xe3}, {&(0x7f0000001840)=""/121, 0x79}, {&(0x7f00000018c0)=""/72, 0x48}, {&(0x7f0000001940)=""/171, 0xab}, {&(0x7f0000001a00)=""/88, 0x58}, {&(0x7f0000001a80)=""/12, 0xc}, {&(0x7f0000001ac0)=""/118, 0x76}, {&(0x7f0000001b40)=""/67, 0x43}, {&(0x7f0000001bc0)=""/51, 0x33}, {&(0x7f0000002040)=""/4096, 0x1000}], 0xa, &(0x7f0000001cc0)=""/247, 0xf7, 0x97b}, 0x2000) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001e00)={{{@in6=@remote, @in=@broadcast}}, {{@in=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000500)=0xffde) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000003040)={{{@in, @in=@broadcast}}, {{@in=@loopback}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000001f80)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000005c0)={{{@in6=@ipv4={[], [], @rand_addr}, @in6=@dev}}, {{@in6=@local}, 0x0, @in6=@mcast2}}, &(0x7f00000006c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000540)={'bridge_slave_0\x00'}) recvmsg(r1, &(0x7f00000054c0)={&(0x7f0000004bc0)=@can, 0x80, &(0x7f0000005340)=[{&(0x7f0000004c40)=""/213, 0xd5}, {&(0x7f0000004d40)=""/224, 0xe0}, {&(0x7f0000004e40)=""/234, 0xea}, {&(0x7f0000004f40)=""/44, 0x2c}, {&(0x7f0000004f80)=""/203, 0xcb}, {&(0x7f0000005080)=""/215, 0xd7}, {&(0x7f0000005180)=""/209, 0xd1}, {&(0x7f0000005280)=""/167, 0xa7}], 0x8, &(0x7f00000053c0)=""/247, 0xf7, 0x8}, 0x2002) getsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000005500)={@loopback}, &(0x7f0000005540)=0x14) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000005580)={@ipv4}, &(0x7f00000055c0)=0x14) getpeername$packet(r2, &(0x7f0000005600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000005640)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000005680)={{{@in=@loopback, @in=@dev}}, {{@in=@multicast2}, 0x0, @in6=@dev}}, &(0x7f0000005780)=0xe8) accept4$packet(r2, &(0x7f0000005880)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000058c0)=0x14, 0x800) recvmmsg(r1, &(0x7f0000009400)=[{{&(0x7f00000059c0)=@xdp, 0x80, &(0x7f0000005d40)=[{&(0x7f0000005a40)=""/125, 0x7d}, {&(0x7f0000005ac0)=""/38, 0x26}, {&(0x7f0000005b00)=""/13, 0xd}, {&(0x7f0000005b40)=""/11, 0xb}, {&(0x7f0000005b80)=""/109, 0x6d}, {&(0x7f0000005c00)=""/171, 0xab}, {&(0x7f0000005cc0)=""/124, 0x7c}], 0x7, &(0x7f0000005dc0)=""/40, 0x28, 0x7ff}, 0xe5}, {{&(0x7f0000005e00)=@in={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000006e80)=[{&(0x7f0000005e80)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x85}, 0x5}, {{&(0x7f0000006ec0)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f00000092c0)=[{&(0x7f0000006f40)=""/81, 0x51}, {&(0x7f0000006fc0)=""/4096, 0x1000}, {&(0x7f0000007fc0)=""/10, 0xa}, {&(0x7f0000008000)=""/252, 0xfc}, {&(0x7f0000008100)=""/137, 0x89}, {&(0x7f00000081c0)=""/254, 0xfe}, {&(0x7f00000082c0)=""/4096, 0x1000}], 0x7, &(0x7f0000009340)=""/142, 0x8e, 0x1e}, 0xfb}], 0x3, 0x2, &(0x7f00000094c0)={0x0, 0x989680}) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000009f40)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000009f00)={&(0x7f0000003c00)=ANY=[@ANYBLOB="4400020040000100240001007072696f72697479000000000000000000000000000000000000000000000000000003000e000000080004000300000008000600"], 0x1}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f00000003c0)={@mcast1, 0x0}, &(0x7f0000000400)=0x14) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000440)={@local, 0x6, r3}) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f000074fffc), 0xb73d37fda2d17bc9) r4 = dup(r1) setsockopt$inet6_tcp_int(r4, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendfile(r4, r2, &(0x7f0000000000), 0x4b5) ioctl$TIOCGSID(r4, 0x5429, &(0x7f0000000040)=0x0) fcntl$setown(r1, 0x8, r5) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000140)={0x6, @loopback, 0x0, 0x0, 'sh\x00', 0x1, 0x1, 0x7c}, 0x2c) ioctl$KDSETLED(r4, 0x4b32, 0x0) open(&(0x7f0000000300)='./bus\x00', 0x101442, 0x10) fcntl$addseals(r4, 0x409, 0x7126464d2de421cf) sendto$inet6(r1, &(0x7f0000000280), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20}, 0x1c) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x7fff) sendfile(r4, r6, &(0x7f0000d83ff8), 0x8000fffffffe) poll(&(0x7f00000002c0)=[{r6, 0x1108}, {r0, 0x10}, {r1, 0x2008}], 0x3, 0x56fc) [ 381.291829] netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. [ 381.326175] netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. 13:55:04 executing program 2: r0 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000000)=0xffd7) add_key(&(0x7f0000000080)='trusted\x00', &(0x7f0000000180), &(0x7f0000000240), 0x0, 0xffffffffffffffff) setreuid(0x0, r1) [ 381.416776] binder: 26082:26085 ERROR: BC_REGISTER_LOOPER called without request [ 381.449933] binder_alloc: 26082: binder_alloc_buf, no vma [ 381.469395] binder: 26082:26085 transaction failed 29189/-3, size 0-0 line 3136 13:55:04 executing program 2: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000d80)=@ipv4_newroute={0x28, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@RTA_MULTIPATH={0xc, 0x5, {0x8}}]}, 0x28}}, 0x0) r1 = dup2(r0, r0) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x8, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r2, 0xc08c5335, &(0x7f0000000080)={0x7fff, 0x7, 0x5, 'queue0\x00', 0x3ff}) [ 381.472777] IPv6: ADDRCONF(NETDEV_UP): bond_slave_0: link is not ready [ 381.510429] IPv6: ADDRCONF(NETDEV_UP): bond_slave_1: link is not ready [ 381.552151] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 381.599443] binder: BINDER_SET_CONTEXT_MGR already set [ 381.602517] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready 13:55:04 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000005c0)={&(0x7f0000000100), 0xc, &(0x7f0000000580)={&(0x7f00000003c0)={0x14, 0x22, 0x101}, 0x14}}, 0x0) sendmsg(r0, &(0x7f0000000540)={&(0x7f0000000080)=@sco={0x1f, {0x8, 0x2, 0x1f, 0x0, 0x1}}, 0x80, &(0x7f0000000980)=[{&(0x7f0000000140)="091b70cbbd1da9075f21ca0c1d65fef5cb2af6e5327bdd7ddc4098dd9274623ee96b2328db1b10dccb759db4a99c192a583f2c3c3ae194fb83ece44e62d1c87b32d34af07565ca798e7b75988e31d0fd185701ab3774502af971574464eaf1d97d0eb022cb5689f2a7e004faba4fa88773e4418d65f623bffcff1305916d06835526053714a55a240e9576f81d415941c9531b855218b5ff1bd5de059485ae3f46cf29353160d67a55b1f5771c2d54dc15d43774de5046015f1962a17ca6e826139a4d", 0xc3}, {&(0x7f0000000280)="723aa8fa40d150720007b4db2daf4bb6deff", 0x12}, {&(0x7f00000002c0)="8adb3b9a84c8efc4d3a2ff6a418972b1e7251fbc6193cea00648bdd3eebfce949dccb8e32ed96cbab62f04890e4d763c3c65f9e4e45c4ef3e853f1922197f3912da3ba1d3e7de9737fe5521d0225ede2054e4e158112cf871e797de53f132adcbdf1993f90fa5d7f7887bd7e6de9539eccc034d17b3884aa754f427c37ea8a81cefc12479298430ccf4bb57818a50ccb558450becf04b98f077a8d646d45e2ea1eaa728f353ec88362660f66d91ef3bfd8da8a2bbdada3c53bcf8b612fb30725c9bacd358060a99a092b7417f656603c80f6316c1b08c1ecc38beb672a21b5d1b478913e1efed41ef6411fb684cec6e02c8599f4bd9a", 0xf6}, {&(0x7f0000000400)="c8a08ae0c76596fa49e8080cf0ba5813bb0bb9f60afa62149fc3f78239e579138b0d67ed02bf6b895ab266d67a31a58adda79a6ae7ba02646d128509d6f79d6e5d7aa0541be14fe86c0313ad22db9efda57ea1a3d611cf03aa657522b201cc46ae8680b3977c13", 0x67}, {&(0x7f0000000480)="aab84b665b2d73b96e75aad77b1a768ae4e422080cb6623a78c2211f99f143534570291c3f419f1b410c60263f4aab4bdb19774587646e02b47d305596824d633317c5210ded25b22f56a9754a115787d2530ea9609707af9ea1f0fad4a1dfa3273c5cf438e077102b44f12ca941829a6149ff067d79009cb562e8672050d194c45b1b5ef586d09ce55642f01dc996", 0x8f}, {&(0x7f0000000600)="32e1e7a672b95f84a716d944cac5f3321706fa41ef406c00b42f3aeb742c7142054a653183ac2f405dd1ac091538f2a4577c30792b483cc13fc8c37d141c7ed1ce942a56467ac15186eab1e91a1bc70f8f2bf2fd0a37bb678c138fc4db90b9bc7514b4d6b7ccadf1347fa2640759dfe6fffaeaa2c69fe8adf1c23d0a2efa26af671ade34fc33bc7641646aa610b74343c812fc75c66c913f01d06f95d62da94c2955866a3229f20dd42df71ad1774f", 0xaf}, {&(0x7f00000006c0)="58f52efae35455d17f564379879cb14898d7f1950b9f301595bd9f26cf492011e40906df108f6d1d0fda4d736e9fd8f9b89478e356c652a87cdcb62a107faca8db97498a484b512d7b8e74eba556e4832a1f18848d4a2a4ac488d307e740473f681faf2ad4206eea8034cc03a39f7e5dd4b49e062b0ff862e3e241103de73e7786aa0fcc8dd7a35854280d46962f24117385f266efd328286ae9794ec9941010ed92ff753dbbe1080ab977c946a060034cc50c64d3d74647537826bf2578c1c866ce0dea72d766e83e790578a61dd76839df63b551ad509af381a89388ad8d85e14b84bfd9db57e0291e6d0b7dcac84d9e0a99e324e63293", 0xf8}, {&(0x7f00000007c0)="be7e4231bdf94c312468d8a893b0aa3fc61d7cddc428aa5ac275a86ad40969fc6a44083254fdaff405644e7914daec11d716b0b32d4219f1bf691a88518f3ca8cb91c6b30f0115f7d617fe97d2b2cebb266175eb9824ed63fcb88dfdc982831210c24fd86da9a4370d3d37bda0d4bf0e992a8eb99456e8c8b7b7da72c15fe455d5aba6cbdcdb510d9415165653ea8e8c24c3aa9e303d7e03230f68423a8cbf7478dfdb5b8a3f6f680bc203d42a6b1987b20f", 0xb2}, {&(0x7f0000000880)="c7f1f79404b8d4c163f7e14e843dbd79b866fe8db54dd1d48c76823fec5231677e0c2e9752b919b3353894488f3d6b4a755399b30bacf212ec185e7096c5125a7c21b03891fe802b614191123888d28d59f43f9b15d09f8b734622e28d4f37fea6d1ae23e8f015c9dd13530e4620fd63ddbf124c20625d565b", 0x79}, {&(0x7f0000000900)="732a646bb7996edce3f03821c4bb784593218e59f37b403f8fb82cfa598a22fed27ef93b12dd6587802a000a0c6c00aae88d9eb17be3f0191c5de00ce2cf48d8c68b985e0121", 0x46}], 0xa, &(0x7f0000000a40)=[{0x70, 0x110, 0x9, "356873afcb795fefa8c7464790d13a32c8444b7fc5946fcaf0eadc68fecfc645b7354356470cd5c78d6c5bb970b61a34601e35bfdeb45f88ed980d2d1feff3ec8f9a506bb82f11a7bed9d843abe42bad5127dc3bd68c1a9d93e05cca367058"}], 0x70, 0x4000}, 0x0) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000000)=@rc, 0x80, &(0x7f00000000c0)}, 0x0) 13:55:04 executing program 2: open(&(0x7f0000000080)='./file0/file0\x00', 0x0, 0x0) waitid(0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000340)) gettid() r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback, 0x800, 0x0, 0xff, 0x1}, 0x20) r1 = socket$inet6(0xa, 0x802, 0x0) fsetxattr(r0, &(0x7f0000000000)=@known='security.capability\x00', &(0x7f0000000100)='md5sum\x00', 0x7, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@loopback, 0x0, 0x0, 0x3, 0x3}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f000088c000)={@remote, 0x0, 0x0, 0x2000ff, 0x41}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x800, 0x2}, 0x20) [ 381.604740] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 381.604995] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 381.605204] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready 13:55:04 executing program 1: mkdir(&(0x7f0000cb3ff8)='./file0\x00', 0x0) r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000200)={0x0, &(0x7f00000001c0)}, 0xfffffffffffffe89) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000500)={0x0, 0x0, 0x0}, &(0x7f0000000540)=0xc) write$selinux_access(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB='sxstem_u:object_r:console_device_t:s0 unconfined 00000000000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x46) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x5612, 0x0, 0x19, 0x0, "a04caeac0e5aa40eb75d5a7dea7a4204b2f5f22195f365cad379befe7785d9c29f487b9fb3b6d17794cc151a432c008f7375a302b3bb9625d4b33eb1624ec685", "e441db7501f40018acf0c11f749a595c417fa75e0cc3af3874452c09a243c26e", [0x7]}) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0, r1}, 0xc) fcntl$getflags(0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x181000, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(r2, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) dup2(r0, r2) r4 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) mkdirat(r4, &(0x7f0000643ff8)='./file0\x00', 0x0) r5 = open$dir(&(0x7f00004daff8)='./file0\x00', 0x0, 0x0) ioctl$TCSETS(r4, 0x5402, &(0x7f0000000040)={0x2, 0x401, 0x0, 0x9, 0x101, 0x3, 0xc84, 0x3f, 0x7fffffff, 0x100, 0x6b, 0x4}) openat(r5, &(0x7f00006e9ff8)='./file0\x00', 0x0, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) mount(&(0x7f0000000240)='./file0\x00', &(0x7f00000003c0)='./file0\x00', &(0x7f00009b9000)="0500de00667300", 0x1008, &(0x7f00000002c0)) [ 381.605440] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 381.605736] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 381.606064] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 381.606278] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 381.606483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 381.641873] binder: 26082:26092 ERROR: BC_REGISTER_LOOPER called without request [ 381.642110] binder: 26082:26092 got transaction to invalid handle [ 381.642120] binder: 26082:26092 transaction failed 29201/-22, size 0-0 line 3013 [ 381.780376] binder_alloc: 26082: binder_alloc_buf, no vma [ 381.785993] binder: release 26082:26085 transaction 608 in, still active [ 381.786000] binder: send failed reply for transaction 608 to 26082:26085 [ 381.786010] binder: undelivered TRANSACTION_ERROR: 29189 [ 381.786042] binder: undelivered TRANSACTION_COMPLETE [ 381.786048] binder: undelivered TRANSACTION_ERROR: 29189 [ 381.795088] binder: 26082:26098 ioctl 40046207 0 returned -16 [ 381.825464] binder: 26082:26085 transaction failed 29189/-3, size 24-8 line 3136 [ 381.833341] binder: undelivered TRANSACTION_ERROR: 29189 [ 381.845869] binder: undelivered TRANSACTION_ERROR: 29201 13:55:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 381.896711] binder: undelivered TRANSACTION_COMPLETE [ 381.913803] binder: undelivered TRANSACTION_ERROR: 29189 13:55:05 executing program 7: process_vm_writev(0x0, &(0x7f0000000000), 0x0, &(0x7f0000003000)=[{&(0x7f0000000040)=""/2, 0xffffffffffffffef}], 0x1, 0x0) sigaltstack(&(0x7f0000004000/0x3000)=nil, &(0x7f0000006ffc)) socketpair(0xa, 0x800, 0x6, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18) sendto$inet(r0, &(0x7f0000000600)="04e6b21af5ed69bf8816d5f9345c8324737929fe33ab3703fe3bb9ee70edb41bc78cb1783549a67581c1a539e81ed7f8013e4a5317873afc8be44274eccb572f44d260e8fa831e43d3a041925c584b163efe651aea48288912198d912c889e332c2224c3048bcc2697fea757f5e4fc8095ce875ebae0596a6d4318fe91f2ec43d09698b180d4a17cdfe8f2589887c4f9f193ae7edd46ab8b3b801e7c721f4837", 0xa0, 0x1, &(0x7f00000006c0)={0x2, 0x4e24, @local}, 0x10) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0xfffffffffffffffa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000140)) write$P9_RLERRORu(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="d5180f7884cac9e0"], 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = syz_open_dev$ndb(&(0x7f0000000300)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r4 = fcntl$getown(r1, 0x9) sched_getparam(r4, &(0x7f00000001c0)) write(r3, &(0x7f0000000380)="8f0552f908a58f5ca13da56559dd7fcd26d9b545ed8f5fb79276eeca408ef83aebfc668536169c041c0efe3e6061bcc213be8cb11bdcb3663f4e818ed8b4d0fe1557ee889f69fba3700e862f6052623a652c132b84fe257a8f85527d0424b36c8ef3adf0f0afd13a0cb0678c355b3a2f02dd21911769a64e4b893b3b0230e46319327da6673ed7b745d57dc118b84cc4d233ea29085dcba374c6112ad3baea21286dcaa89e94566930a66b825eda3d17fe2e0a43d590c09a78d028c59154d183aeb636034c0015b66ffda3c41d771b", 0xcf) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={[], 0xfffffffffffffffe, 0x9, 0x0, 0x0, 0x40}) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) prctl$setfpexc(0xc, 0x80003) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000740)=0x7, 0x4) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000700)={'erspan0\x00'}) sendto$inet(r1, &(0x7f0000a88f88), 0xffffffffffffff35, 0x200007f9, &(0x7f00000005c0)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r0, 0x111, 0x5, 0x0, 0x4) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f0000000340)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) 13:55:05 executing program 4: syz_read_part_table(0x80200000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000000)="5244534ba7011c0000000000009c9ba2040000000a74b8b5ca71a68025", 0x1d}]) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) write$selinux_access(r0, &(0x7f00000000c0)={'system_u:object_r:dhcpd_var_run_t:s0', 0x20, '/sbin/dhclient', 0x20, 0x5}, 0x49) 13:55:05 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip6_mr_vif\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f00000000c0)=0x2000000, 0x10000000000443) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000001c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0xff) setsockopt$inet6_int(r1, 0x29, 0x35, &(0x7f0000000240)=0x3, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000380)=0x1, 0xff0f) r2 = socket(0xa, 0x2, 0x0) ioctl(r2, 0x9, &(0x7f0000000200)="2894ba9157f2fd7464231bc335c80ab46311209daf180bd969256196f49435468f5d906c") ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000080)={{0x2, 0x0, @loopback}, {0x0, @remote}, 0x2, {0x2, 0x0, @broadcast}, 'bond_slave_1\x00'}) syz_genetlink_get_family_id$team(&(0x7f0000000880)='team\x00') getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000480)={@multicast2, @broadcast}, &(0x7f00000004c0)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000008c0)={'team_slave_0\x00'}) accept$packet(r0, &(0x7f00000009c0), &(0x7f0000000a00)=0x14) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000a40)={0x0, @multicast2, @multicast2}, &(0x7f0000000a80)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000ac0)={{{@in=@dev, @in=@remote}}, {{@in6=@remote}, 0x0, @in6=@mcast2}}, &(0x7f0000000bc0)=0xe8) accept$packet(r0, &(0x7f0000000c00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000c40)=0x14) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000000d40)={@mcast2}, &(0x7f0000000d80)=0x14) getsockname$packet(r2, &(0x7f0000000f40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000f80)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000fc0)={0x0, @local, @local}, &(0x7f0000001000)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@ipv4}, 0x0, @in=@local}}, &(0x7f0000001140)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000001180)={{{@in6=@mcast1, @in=@rand_addr}}, {{@in6=@mcast1}, 0x0, @in6=@remote}}, &(0x7f0000001280)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000012c0)={{{@in=@remote, @in=@multicast1}}, {{@in=@loopback}}}, &(0x7f00000013c0)=0xe8) getpeername(r0, &(0x7f00000014c0)=@xdp, &(0x7f0000001540)=0x80) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000001580)={{{@in6=@mcast1, @in6=@mcast2}}, {{@in=@rand_addr}, 0x0, @in=@broadcast}}, &(0x7f0000001680)=0xe8) recvmsg(r2, &(0x7f0000001dc0)={&(0x7f00000016c0)=@hci, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001740)=""/227, 0xe3}, {&(0x7f0000001840)=""/121, 0x79}, {&(0x7f00000018c0)=""/72, 0x48}, {&(0x7f0000001940)=""/171, 0xab}, {&(0x7f0000001a00)=""/88, 0x58}, {&(0x7f0000001a80)=""/12, 0xc}, {&(0x7f0000001ac0)=""/118, 0x76}, {&(0x7f0000001b40)=""/67, 0x43}, {&(0x7f0000001bc0)=""/51, 0x33}, {&(0x7f0000002040)=""/4096, 0x1000}], 0xa, &(0x7f0000001cc0)=""/247, 0xf7, 0x97b}, 0x2000) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001e00)={{{@in6=@remote, @in=@broadcast}}, {{@in=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000500)=0xffde) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000003040)={{{@in, @in=@broadcast}}, {{@in=@loopback}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000001f80)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000005c0)={{{@in6=@ipv4={[], [], @rand_addr}, @in6=@dev}}, {{@in6=@local}, 0x0, @in6=@mcast2}}, &(0x7f00000006c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000540)={'bridge_slave_0\x00'}) recvmsg(r1, &(0x7f00000054c0)={&(0x7f0000004bc0)=@can, 0x80, &(0x7f0000005340)=[{&(0x7f0000004c40)=""/213, 0xd5}, {&(0x7f0000004d40)=""/224, 0xe0}, {&(0x7f0000004e40)=""/234, 0xea}, {&(0x7f0000004f40)=""/44, 0x2c}, {&(0x7f0000004f80)=""/203, 0xcb}, {&(0x7f0000005080)=""/215, 0xd7}, {&(0x7f0000005180)=""/209, 0xd1}, {&(0x7f0000005280)=""/167, 0xa7}], 0x8, &(0x7f00000053c0)=""/247, 0xf7, 0x8}, 0x2002) getsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000005500)={@loopback}, &(0x7f0000005540)=0x14) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000005580)={@ipv4}, &(0x7f00000055c0)=0x14) getpeername$packet(r2, &(0x7f0000005600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000005640)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000005680)={{{@in=@loopback, @in=@dev}}, {{@in=@multicast2}, 0x0, @in6=@dev}}, &(0x7f0000005780)=0xe8) accept4$packet(r2, &(0x7f0000005880)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000058c0)=0x14, 0x800) recvmmsg(r1, &(0x7f0000009400)=[{{&(0x7f00000059c0)=@xdp, 0x80, &(0x7f0000005d40)=[{&(0x7f0000005a40)=""/125, 0x7d}, {&(0x7f0000005ac0)=""/38, 0x26}, {&(0x7f0000005b00)=""/13, 0xd}, {&(0x7f0000005b40)=""/11, 0xb}, {&(0x7f0000005b80)=""/109, 0x6d}, {&(0x7f0000005c00)=""/171, 0xab}, {&(0x7f0000005cc0)=""/124, 0x7c}], 0x7, &(0x7f0000005dc0)=""/40, 0x28, 0x7ff}, 0xe5}, {{&(0x7f0000005e00)=@in={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000006e80)=[{&(0x7f0000005e80)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x85}, 0x5}, {{&(0x7f0000006ec0)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f00000092c0)=[{&(0x7f0000006f40)=""/81, 0x51}, {&(0x7f0000006fc0)=""/4096, 0x1000}, {&(0x7f0000007fc0)=""/10, 0xa}, {&(0x7f0000008000)=""/252, 0xfc}, {&(0x7f0000008100)=""/137, 0x89}, {&(0x7f00000081c0)=""/254, 0xfe}, {&(0x7f00000082c0)=""/4096, 0x1000}], 0x7, &(0x7f0000009340)=""/142, 0x8e, 0x1e}, 0xfb}], 0x3, 0x2, &(0x7f00000094c0)={0x0, 0x989680}) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000009f40)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000009f00)={&(0x7f0000003c00)=ANY=[@ANYBLOB="4400020040000100240001007072696f72697479000000000000000000000000000000000000000000000000000003000e000000080004000300000008000600"], 0x1}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f00000003c0)={@mcast1, 0x0}, &(0x7f0000000400)=0x14) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000440)={@local, 0x6, r3}) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f000074fffc), 0xb73d37fda2d17bc9) r4 = dup(r1) setsockopt$inet6_tcp_int(r4, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendfile(r4, r2, &(0x7f0000000000), 0x4b5) ioctl$TIOCGSID(r4, 0x5429, &(0x7f0000000040)=0x0) fcntl$setown(r1, 0x8, r5) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000140)={0x6, @loopback, 0x0, 0x0, 'sh\x00', 0x1, 0x1, 0x7c}, 0x2c) ioctl$KDSETLED(r4, 0x4b32, 0x0) open(&(0x7f0000000300)='./bus\x00', 0x101442, 0x10) fcntl$addseals(r4, 0x409, 0x7126464d2de421cf) sendto$inet6(r1, &(0x7f0000000280), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20}, 0x1c) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x7fff) sendfile(r4, r6, &(0x7f0000d83ff8), 0x8000fffffffe) poll(&(0x7f00000002c0)=[{r6, 0x1108}, {r0, 0x10}, {r1, 0x2008}], 0x3, 0x56fc) 13:55:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) signalfd(r0, &(0x7f00000000c0)={0x100}, 0x8) 13:55:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x35, 0x0, &(0x7f0000000180)=ANY=[@ANYRES32=r0, @ANYRESHEX=r1, @ANYRESOCT=r2, @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYRESDEC=0x0, @ANYRESOCT=r2, @ANYRES16=r0]], 0x0, 0x0, &(0x7f0000000480)}) 13:55:05 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x200200, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getegid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000000240)=0xe8) getgroups(0x9, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0x0, 0xee00, 0x0, 0xee00, 0xee01, 0xee00, 0xee01]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000400)={0x0, 0x0}, &(0x7f0000000440)=0xc) getresgid(&(0x7f0000000480), &(0x7f00000004c0)=0x0, &(0x7f0000000500)) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@mcast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000640)=0xe8) getresgid(&(0x7f0000000680), &(0x7f00000006c0)=0x0, &(0x7f0000000700)) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f0000000a80)) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000740)={0x338, 0x0, 0x1, [{{0x0, 0x1, 0x8, 0x4, 0x6, 0x7ff, {0x5, 0x7, 0xd4, 0xffffffffffffff5b, 0x3ff, 0x7, 0x457, 0x800, 0x400, 0x8001, 0x2, r3, r4, 0x82b, 0x2}}, {0x6, 0x3, 0x0, 0xc37}}, {{0x2, 0x2, 0xfff, 0x3, 0x300000, 0x8, {0x3, 0x2, 0x0, 0x3f, 0x10001, 0x0, 0x0, 0x3, 0x0, 0x8, 0x727f, r5, r6, 0x7fffffff, 0x4}}, {0x6, 0x4, 0x7, 0x7ff, 'ns/uts\x00'}}, {{0x6, 0x3, 0x8001, 0xaf, 0x0, 0x325c, {0x1, 0x3ff, 0x7fff, 0x7fffffff, 0x5, 0x3, 0x5, 0x3, 0x57, 0x0, 0x4, r7, r8, 0x4, 0x9}}, {0x2, 0x4000000000000, 0x7, 0x1, 'ns/uts\x00'}}, {{0x4, 0x3, 0x0, 0x3ff, 0x1, 0x2, {0x5, 0x485, 0x1, 0x400, 0x91, 0xb45b, 0x2, 0x3, 0x400, 0x0, 0x9a64, r9, r10, 0x2, 0xfffffffffffffffb}}, {0x6, 0xfff, 0x18, 0x3, "747275737465642a6e6f6465768b73797374656d2b656d30"}}, {{0x3, 0x0, 0x0, 0x4, 0x8, 0x2d31, {0x1, 0x20, 0xa664, 0x3f, 0x8, 0x6f, 0x7, 0x4, 0x1f, 0x55, 0x1, r11, r12, 0x8, 0x2328}}, {0x2, 0xff, 0x7, 0x9, 'ns/uts\x00'}}]}, 0x338) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r13 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/uts\x00') ioctl$VT_RELDISP(r13, 0xb701) [ 381.939649] binder: undelivered TRANSACTION_ERROR: 29201 [ 382.016341] binder: 26121:26126 transaction failed 29189/-22, size 24-8 line 3013 [ 382.028590] binder: BINDER_SET_CONTEXT_MGR already set [ 382.029823] binder: 26121:26126 ERROR: BC_REGISTER_LOOPER called without request [ 382.043150] binder: 26122:26127 ioctl 40046207 0 returned -16 [ 382.051768] binder: 26122:26127 ERROR: BC_REGISTER_LOOPER called without request [ 382.052068] binder_alloc: 26122: binder_alloc_buf, no vma 13:55:05 executing program 3: r0 = socket(0x800000000000000e, 0xa, 0x3) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000080), 0xc, &(0x7f0000000180)={&(0x7f0000000900)=@ipv6_delroute={0x28, 0x19, 0x701, 0x0, 0x0, {}, [@RTA_MULTIPATH={0xc}]}, 0x28}}, 0xfffffffffffffffc) 13:55:05 executing program 1: r0 = socket$netlink(0x10, 0x3, 0xc) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x408000, 0x0) sendmsg$netlink(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000800)={0x10, 0x10}, 0x10}], 0x1}, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000000)=0x9, 0x4) [ 382.052086] binder: 26121:26126 transaction failed 29189/-3, size 0-0 line 3136 [ 382.052515] binder: undelivered TRANSACTION_ERROR: 29189 [ 382.062985] binder: release 26121:26126 transaction 616 in, still active [ 382.062992] binder: send failed reply for transaction 616 to 26122:26127 [ 382.063001] binder: undelivered TRANSACTION_ERROR: 29189 [ 382.100275] binder: 26122:26133 unknown command 3 [ 382.105578] binder: 26122:26133 ioctl c0306201 20000080 returned -22 13:55:05 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 382.113521] binder: 26125:26132 ERROR: BC_REGISTER_LOOPER called without request [ 382.121936] binder_alloc: 26125: binder_alloc_buf, no vma [ 382.127836] binder: 26125:26132 transaction failed 29189/-3, size 0-0 line 3136 [ 382.136504] binder: release 26125:26132 transaction 621 out, still active [ 382.143610] binder: unexpected work type, 4, not freed [ 382.150392] binder: undelivered TRANSACTION_COMPLETE [ 382.157039] binder: release 26125:26132 transaction 621 in, still active 13:55:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer\x00', 0x0, 0x0) r1 = creat(&(0x7f0000001380)='./file0\x00', 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000000c0)=0xfffffffffffffffb) ioctl$fiemap(r1, 0xc0185879, &(0x7f0000000040)=ANY=[@ANYRES64=r1, @ANYRES32]) 13:55:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") r1 = open(&(0x7f00009e1000)='./file0\x00', 0x8040, 0x0) fcntl$setsig(r1, 0xa, 0x18) fcntl$setlease(r1, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, &(0x7f0000d31ff0), &(0x7f00007adff0)={0x77359400}, 0x8) r2 = open(&(0x7f0000000000)='./file0\x00', 0x8200, 0x0) fcntl$setlease(r1, 0x400, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f00000000c0)={0x198, r3, 0xb01, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x20080000000}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x200}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7fff}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xff}, @IPVS_CMD_ATTR_DAEMON={0x6c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x43a0}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'gretap0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip_vti0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x80}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8000}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xb2d8}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xc08}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team_slave_1\x00'}]}]}, 0x198}, 0x1, 0x0, 0x0, 0x4045}, 0x10) [ 382.164246] binder: send failed reply for transaction 621, target dead [ 382.171018] binder: undelivered TRANSACTION_ERROR: 29189 13:55:05 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TCXONC(r0, 0x540a, 0x2) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) [ 382.293710] binder: 26142:26148 ERROR: BC_REGISTER_LOOPER called without request 13:55:05 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x8000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$KDSKBLED(r0, 0x4b65, 0x8) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f0000000040)) r1 = gettid() ptrace$getregs(0xe, r1, 0x81, &(0x7f00000001c0)=""/243) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000015c0), 0x0, 0x0, 0xfffffffffffffffc) openat$cgroup_subtree(r0, &(0x7f0000000080)='cgroup.subtree_control\x00', 0x2, 0x0) [ 382.340974] binder: 26142:26154 got transaction to invalid handle [ 382.356462] binder: 26142:26154 transaction failed 29201/-22, size 0-0 line 3013 13:55:05 executing program 3: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x8) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000000004, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$int_in(r1, 0x5421, &(0x7f0000000000)) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000000c0)={@local, @local, 0x0}, &(0x7f0000000100)=0xc) setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000140)={@mcast2, r2}, 0x14) 13:55:05 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0a5cc80700315f85715070") r1 = perf_event_open(&(0x7f0000000380)={0x2, 0x70, 0x11, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000026c0)='/dev/rtc0\x00', 0x101000, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000002cc0)={'team_slave_1\x00', 0x1000}) r3 = openat$cgroup_ro(r1, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$TIOCLINUX3(r3, 0x541c, &(0x7f0000000080)) rt_sigprocmask(0xfffffffffffffffe, &(0x7f0000000200), &(0x7f0000000140), 0x8) write$FUSE_NOTIFY_POLL(r3, &(0x7f0000002d00)={0x18, 0x1, 0x0, {0x1}}, 0x18) recvmmsg(r0, &(0x7f0000002700)=[{{&(0x7f00000000c0)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)=""/53, 0x35}], 0x1, &(0x7f0000000240)=""/100, 0x64, 0x7ff}, 0x7}, {{&(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000400)=""/95, 0x5f}, {&(0x7f0000000340)=""/14, 0xe}, {&(0x7f0000000480)=""/219, 0xdb}, {&(0x7f0000000580)=""/170, 0xaa}], 0x4, &(0x7f0000000680)=""/123, 0x7b, 0x40}, 0x1}, {{&(0x7f0000000700)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, 0x80, &(0x7f0000000b00)=[{&(0x7f0000000780)=""/13, 0xd}, {&(0x7f00000007c0)=""/196, 0xc4}, {&(0x7f00000008c0)=""/135, 0x87}, {&(0x7f0000000980)=""/81, 0x51}, {&(0x7f0000000a00)=""/242, 0xf2}], 0x5, &(0x7f0000000b80)=""/131, 0x83, 0x9}, 0x5}, {{&(0x7f0000000c40)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000f00)=[{&(0x7f0000000cc0)=""/158, 0x9e}, {&(0x7f0000000d80)=""/42, 0x2a}, {&(0x7f0000000dc0)=""/126, 0x7e}, {&(0x7f0000000e40)=""/183, 0xb7}], 0x4, &(0x7f0000000f40)=""/153, 0x99, 0x4}, 0x20}, {{&(0x7f0000001000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000001300)=[{&(0x7f0000001080)=""/90, 0x5a}, {&(0x7f0000001100)=""/230, 0xe6}, {&(0x7f0000001200)=""/226, 0xe2}], 0x3, &(0x7f0000001340)=""/4096, 0x1000}, 0x9}, {{&(0x7f0000002340)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f00000025c0)=[{&(0x7f00000023c0)=""/217, 0xd9}, {&(0x7f00000024c0)=""/198, 0xc6}], 0x2, &(0x7f0000002600)=""/40, 0x28, 0x1}, 0x1}, {{&(0x7f0000002640)=@un=@abs, 0x80, &(0x7f00000026c0), 0x0, 0x0, 0x0, 0x9}, 0x51441935}], 0x7, 0x40012100, &(0x7f00000028c0)) write$binfmt_aout(r0, &(0x7f0000002d40)=ANY=[@ANYBLOB="08010409af0100008603000007000000f10000000900000000000000000000007b337c8405a6b9146bf67318c3b040f74686699f21e063f33037e8cdb616846f011f36fa06e7249a5e1291052c0538ee3c5d3d4de08fd349d23dd8aee0440eb54e6452cf41c060d65b83fa500c898f66de57265a1710d89a86e3993c191904f4a7360d924a5217201d21ab62d1988d2e05bbe6463921c10938eb8d92edcfa08936c965cb265c3a28c7c4fb04ce1f3c950fbf77050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007f8151883ec16c6a0e10a28749e444b252b4ec"], 0x3b4) 13:55:05 executing program 5: r0 = memfd_create(&(0x7f0000000340)='^vmnet1posix_acl_access+vboxnet1\x00', 0x0) fsetxattr(r0, &(0x7f00000000c0)=@known='trusted.syz\x00', &(0x7f0000000100)='^vmnet1posix_acl_access+vboxnet1\x00', 0x21, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fsetxattr(r0, &(0x7f0000000240)=@known='trusted.syz\x00', &(0x7f0000000280)='em1\x00', 0x4, 0x0) timerfd_gettime(r0, &(0x7f0000000040)) sigaltstack(&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000)) mmap(&(0x7f00002f5000/0x4000)=nil, 0x4000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) [ 382.810179] binder: BINDER_SET_CONTEXT_MGR already set [ 382.815665] binder: 26122:26133 ioctl 40046207 0 returned -16 [ 382.822864] binder: 26122:26186 ERROR: BC_REGISTER_LOOPER called without request [ 382.831877] binder: release 26122:26133 transaction 627 out, still active [ 382.841491] binder: unexpected work type, 4, not freed [ 382.853367] binder: undelivered TRANSACTION_COMPLETE [ 382.860800] binder: release 26142:26148 transaction 627 in, still active [ 382.868120] binder: send failed reply for transaction 627, target dead [ 382.875100] binder: undelivered TRANSACTION_ERROR: 29201 [ 382.881599] binder: undelivered TRANSACTION_COMPLETE [ 382.886775] binder: undelivered TRANSACTION_ERROR: 29189 13:55:06 executing program 7: process_vm_writev(0x0, &(0x7f0000000000), 0x0, &(0x7f0000003000)=[{&(0x7f0000000040)=""/2, 0xffffffffffffffef}], 0x1, 0x0) sigaltstack(&(0x7f0000004000/0x3000)=nil, &(0x7f0000006ffc)) socketpair(0xa, 0x800, 0x6, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18) sendto$inet(r0, &(0x7f0000000600)="04e6b21af5ed69bf8816d5f9345c8324737929fe33ab3703fe3bb9ee70edb41bc78cb1783549a67581c1a539e81ed7f8013e4a5317873afc8be44274eccb572f44d260e8fa831e43d3a041925c584b163efe651aea48288912198d912c889e332c2224c3048bcc2697fea757f5e4fc8095ce875ebae0596a6d4318fe91f2ec43d09698b180d4a17cdfe8f2589887c4f9f193ae7edd46ab8b3b801e7c721f4837", 0xa0, 0x1, &(0x7f00000006c0)={0x2, 0x4e24, @local}, 0x10) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0xfffffffffffffffa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000140)) write$P9_RLERRORu(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="d5180f7884cac9e0"], 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = syz_open_dev$ndb(&(0x7f0000000300)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r4 = fcntl$getown(r1, 0x9) sched_getparam(r4, &(0x7f00000001c0)) write(r3, &(0x7f0000000380)="8f0552f908a58f5ca13da56559dd7fcd26d9b545ed8f5fb79276eeca408ef83aebfc668536169c041c0efe3e6061bcc213be8cb11bdcb3663f4e818ed8b4d0fe1557ee889f69fba3700e862f6052623a652c132b84fe257a8f85527d0424b36c8ef3adf0f0afd13a0cb0678c355b3a2f02dd21911769a64e4b893b3b0230e46319327da6673ed7b745d57dc118b84cc4d233ea29085dcba374c6112ad3baea21286dcaa89e94566930a66b825eda3d17fe2e0a43d590c09a78d028c59154d183aeb636034c0015b66ffda3c41d771b", 0xcf) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={[], 0xfffffffffffffffe, 0x9, 0x0, 0x0, 0x40}) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) prctl$setfpexc(0xc, 0x80003) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000740)=0x7, 0x4) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000700)={'erspan0\x00'}) sendto$inet(r1, &(0x7f0000a88f88), 0xffffffffffffff35, 0x200007f9, &(0x7f00000005c0)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r0, 0x111, 0x5, 0x0, 0x4) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f0000000340)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) 13:55:06 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) setsockopt$packet_buf(r1, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0xb0) mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000000)) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f00000001c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[]}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) read$FUSE(r1, &(0x7f00000020c0), 0x1000) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000002000)={0x90}, 0x90) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000400)) 13:55:06 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x80, 0x0) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x2, 0x6, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, [@sadb_x_sa2={0x2}]}, 0x20}}, 0x0) 13:55:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer\x00', 0x0, 0x0) r1 = creat(&(0x7f0000001380)='./file0\x00', 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000000c0)=0xfffffffffffffffb) ioctl$fiemap(r1, 0xc0185879, &(0x7f0000000040)=ANY=[@ANYRES64=r1, @ANYRES32]) 13:55:06 executing program 1: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00007a0000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={0xffffffffffffffff, 0xffffffffffffffff}) setrlimit(0x7, &(0x7f0000a9cff8)) sendmsg$unix(r3, &(0x7f0000bba000)={&(0x7f00003a2000)=@abs, 0x8, &(0x7f00006c6ff0), 0x0, &(0x7f00009dffb8)=[@rights={0x18, 0x1, 0x1, [r1]}], 0x18}, 0x0) r4 = dup2(r2, r2) sendmsg$netlink(r4, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000002d40), 0x0, &(0x7f0000000000)=[@rights={0x18, 0x1, 0x1, [r0]}], 0x18}, 0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f00000001c0)) getpeername$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, @loopback}, &(0x7f0000000280)=0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ustat(0x6, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r6, 0x4, 0x2800) ioctl$KDSKBLED(r4, 0x4b65, 0x1) sendmmsg(r5, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002240), 0x1ba, &(0x7f00000022c0)}}, {{0x0, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002700)}}], 0x75a, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x4c831, 0xffffffffffffffff, 0x0) 13:55:06 executing program 5: setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x1b, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f00000001c0)={0x8000000020, @time, 0x0, {0x0, 0x401}}) r1 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/pktcdvd/control\x00', 0x0, 0x0) mq_notify(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, @thr={&(0x7f0000000140), &(0x7f0000000300)}}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000280)) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x100000000, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, r0, 0x0) unshare(0x42060000) accept4(r1, &(0x7f00000003c0)=@nfc, &(0x7f0000000180)=0x80, 0x80800) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000700)={{0xa, 0x4e23, 0x4, @dev, 0x9}, {0xa, 0x4e21, 0x9, @remote, 0xb23b}, 0x0, [0x4e, 0x2, 0x90, 0xfffffffffffffff8, 0x57b5, 0x5, 0x5, 0x1ff]}, 0x5c) r3 = pkey_alloc(0x0, 0x2) pkey_free(r3) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000000)=0xe8) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000780)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r1, &(0x7f0000000880)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x50, r5, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'rose0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_0\x00'}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000004}, 0x20000880) recvfrom$packet(r2, &(0x7f0000000500)=""/237, 0xed, 0x40000021, &(0x7f0000000240)={0x11, 0x19, r4, 0x1, 0xcf50, 0x6, @remote}, 0x14) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000140)=0x3, 0x4) getpeername$packet(r1, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000340)=0x14) fanotify_init(0x0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000000440)=""/19) 13:55:06 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x204102, 0x0) ioctl$TIOCCONS(r2, 0x541d) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 383.098043] binder: 26194:26201 ERROR: BC_REGISTER_LOOPER called without request [ 383.111816] binder: BINDER_SET_CONTEXT_MGR already set [ 383.124437] binder: 26195:26203 ioctl 40046207 0 returned -16 13:55:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = fcntl$dupfd(r0, 0x1, 0xffffffffffffffff) splice(r0, &(0x7f0000000080), r1, &(0x7f00000000c0), 0x1, 0x0) r2 = inotify_init1(0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="040326bd7000fbdbdf250500000014000100080005000000000008000100020000ff72000400080000040012000000000000"], 0x38}, 0x1, 0x0, 0x0, 0x24004800}, 0x24048084) r4 = syz_open_dev$loop(&(0x7f0000002a80)='/dev/loop#\x00', 0xffff, 0x20000) stat(&(0x7f0000002b80)='./file0\x00', &(0x7f0000002bc0)) stat(&(0x7f0000002c40)='./file0\x00', &(0x7f0000002c80)) fcntl$setstatus(r2, 0x4, 0x40000) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000fa4000)) r5 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x4082) setsockopt$IP_VS_SO_SET_STARTDAEMON(r5, 0x0, 0x48b, &(0x7f0000000140)={0x1, 'veth1\x00', 0x4}, 0x18) r7 = fcntl$dupfd(r0, 0x0, r5) r8 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(r8, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) r9 = gettid() ioctl$EVIOCSABS20(r8, 0x401845e0, &(0x7f00000002c0)={0x830a, 0x3, 0x70000, 0x4, 0x82d, 0x6e371b8c}) r10 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000440)='/dev/vga_arbiter\x00', 0x101800, 0x0) ioctl$LOOP_CHANGE_FD(r10, 0x4c00, r2) r11 = add_key$user(&(0x7f0000002780)='user\x00', &(0x7f00000027c0)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000002800)="1632e37280209fe726b47057bd88d4e1c06b95e071bb3827159d0b3b1cbba1295611d0796ab731eb61b49c9c9f8457cd5fe7ab4d08ad7fa873a3c5a849739b8a1c7e4f2c045f75059422f84db01d5a8e164923bd086591a7d8d0eddf64428d9beae84c1857e278db0b3eb0592deb84dfa62f1fa29e5550b3b743b9f51e7f13215abe27f76c736ec6756ee84a608f706281a4ecef5a3658b97813052f4dfe8d79bd91e02985e69d04dabaad07c31e5ea6a83cec7c144f10a31a6f25623ee91bcf771c1e255d0956124010485bb709f645060f6f02b6651e312e1f591e0224f52a5a36cb5ce7e3313efd9a6032d90221716c5bb8305e6f31c53b2dbd8e9fd2", 0xfe, 0x0) keyctl$get_security(0x11, r11, &(0x7f0000002900)=""/213, 0xd5) ioprio_set$pid(0x2, r9, 0x2) ioctl$LOOP_CHANGE_FD(r7, 0x4c06, r4) sendfile(r6, r6, &(0x7f0000000000), 0x2000005) sendmsg$IPVS_CMD_NEW_DEST(r8, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x104000c}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x40, r3, 0x0, 0x70bd29, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3ff}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x1}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000002a00), &(0x7f0000002a40)=0x8) ioctl$void(r7, 0xc0045878) ioctl$LOOP_CLR_FD(r6, 0x4c01) 13:55:06 executing program 3: set_thread_area(&(0x7f0000000280)={0x120000, 0x0, 0xffffffffffffffff, 0x3, 0xfff, 0x5, 0x7fff, 0x3e6, 0x401, 0x1}) r0 = gettid() perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @tid=r0}, &(0x7f0000000340)) r1 = eventfd(0x0) setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000240), 0x4) r2 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000180)='/dev/pktcdvd/control\x00', 0x101000, 0x0) ptrace$setopts(0x4206, r0, 0x1, 0x2a) ioctl$sock_SIOCGSKNS(r2, 0x894c, &(0x7f0000000400)) openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x80, 0x0) write$P9_RUNLINKAT(0xffffffffffffffff, &(0x7f0000000100)={0x7, 0x4d, 0x2}, 0x7) getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='pagemap\x00') timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r3, &(0x7f0000000000), 0x1000000008) tgkill(r0, r0, 0x3f) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer\x00', 0x4200, 0x0) tkill(r0, 0x15) ioctl$SG_SCSI_RESET(r2, 0x2284, 0x0) write$P9_RRENAMEAT(r4, &(0x7f00000003c0)={0x7, 0x4b, 0x2}, 0x7) 13:55:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer\x00', 0x0, 0x0) r1 = creat(&(0x7f0000001380)='./file0\x00', 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000000c0)=0xfffffffffffffffb) ioctl$fiemap(r1, 0xc0185879, &(0x7f0000000040)=ANY=[@ANYRES64=r1, @ANYRES32]) [ 383.144475] binder: 26195:26203 ERROR: BC_REGISTER_LOOPER called without request [ 383.155731] binder_alloc: 26195: binder_alloc_buf, no vma [ 383.173210] binder: 26194:26206 transaction failed 29189/-3, size 0-0 line 3136 13:55:06 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 383.200377] binder: 26195:26209 got transaction to invalid handle [ 383.212663] binder: release 26194:26201 transaction 631 in, still active [ 383.219736] binder: send failed reply for transaction 631 to 26195:26203 [ 383.227146] binder: 26195:26209 transaction failed 29201/-22, size 0-0 line 3013 [ 383.239624] binder: undelivered TRANSACTION_ERROR: 29189 [ 383.321915] IPVS: Creating netns size=2536 id=48 13:55:06 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="025cc83d6d345f8f762070") sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) pipe2(&(0x7f0000000900), 0x4000) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) renameat2(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x8100, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) fstat(r2, &(0x7f00000003c0)) getegid() lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)) getuid() fchown(r1, 0x0, 0x0) fadvise64(0xffffffffffffffff, 0x0, 0x200, 0x0) r3 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000500)) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000180)={'vlan0\x00', &(0x7f0000000140)=@ethtool_sfeatures={0x3b, 0x5, [{0xdd, 0x4}, {0xf44, 0xffffffff}, {0x393f, 0x4}, {0x40, 0x8}, {0x100, 0x156aba79}]}}) [ 383.355619] binder: 26221:26226 ERROR: BC_REGISTER_LOOPER called without request 13:55:06 executing program 2: r0 = socket$inet6(0xa, 0xadf87c2256893a05, 0xed35) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000000000)=""/146, &(0x7f0000000100)=0x92) r1 = socket$inet6(0xa, 0x1, 0x3c) connect$inet6(r1, &(0x7f00000009c0)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)="2c0271ca8b080aae33", 0x9}], 0x1, &(0x7f0000000140)}, 0xc100) sendmsg(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000001180)="b10b9386", 0x4}], 0x1, &(0x7f0000000e00)}, 0x8000) membarrier(0x8, 0x0) exit(0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x200080, 0x0) write$FUSE_NOTIFY_STORE(r2, &(0x7f00000001c0)={0x2c, 0x4, 0x0, {0x3, 0x7, 0x4, 0x0, [0x0, 0x0, 0x0, 0x0]}}, 0x2c) write(r1, &(0x7f0000001480)="315602e340961e1e6fa59033d79acf3337e6f077c142e053f33b91e63dea1de22a51c7a9912b0e37913342a45531e6658b91dc1a1506da83b2df055fee6750e8f1ef3cd93be6a73969237df2b400d071dfb0c8ee97926c83bb877660c1611372fe5f125444fcfdb535b7647d159944c4ad244be807adb78124f4bad832af462474724466862c244d86c888372ab824a5b65fb558ae938276501174d6c9db1298d1e31019e5e9f89478e2dc6c6885d4a1759c4779f2b4ba7ed17e841b81d918e55f800768573e148073dd11971d10b31cc5849c9a438dd31cd4d1ccd5ed75556991740f643f1c91c26801d1691af894be5e88091388ff92f1313a2593af3471f2c855bd4888b65e9125c755ae7a17347a68714790b0cf54f3721b708e69fee8aeb0aa8be9021bf08527c566deba7661e48893ce809d5ebf830af035ccf6dc2d11cfdc10e047ab4fa4a660af73601e4cdf1a6efb826d645ddf88b698352307a61cb57a3d57acce96d7615ee9d9d48bdb1e019cee40e0d1eb83b80e719ad75468d13d7923c57e447d1a17b1e8b4f6c334075e48ce514df5433c931f851e040f6630673c3138ca36151e1ee5f2586ce27176df8d69978cbce0496a1c1e9bf03ac39b58070031ecae121b3f08137ad41de4a6c79d3d178998b7f963315e74b2956579fa63d2d52a77d277c92def04a63cf17f8bd947c848edfb5947098a915e3da948e3170daf5782f0382e54f879a868cb73979fc5b4e0b162bb57d8dda7bf32dd546e6f10b21ffe57e2121cb2282b98c7784ecdaaf9e4ca44258ab231b7fd8804cbb552986ae8a7d0779a288921402b54eeb7add6412b4454ad94dd1af74123f07d361d513c198b82cd8519ea70d0f33bde02a6f2ff998c218a13f34527c3f16d0670c9457f6cee097cb6fab2c7ccbdb9f4621a9439cc58c830fa1c11d71b47ab25f79b210937f42fad601111391fd58146e12f2ac9cb36b9d1a59446b3ba805470d5f1e2ae948a711501ce99343435fe71bfa3ef08dfa430360ffae0452a1b4159180b03c344aee53dc1eb68882cd73b1bd9b0bc80", 0x2f4) [ 383.411903] binder: 26221:26230 got transaction to invalid handle [ 383.443976] binder: 26221:26230 transaction failed 29201/-22, size 0-0 line 3013 13:55:06 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200040}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fedbdf2511000098e13174224f531bdaffff0000000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40000) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x24, r2, 0x21, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0x24}}, 0x0) signalfd(r0, &(0x7f0000000300)={0x1}, 0x8) r3 = memfd_create(&(0x7f0000000240)='IPVS\x00', 0x3) setsockopt$inet_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f00000002c0), 0x4) 13:55:06 executing program 3: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) r2 = open(&(0x7f0000000440)='./file0\x00', 0x501000, 0x80) ioctl$PPPIOCGMRU(r2, 0x80047453, &(0x7f0000000540)) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) write$P9_RREADDIR(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="2a000000290100000000b631c7fc370fc31a0000b5e6bdbed0770cf084fe43e0d316683ee0ffa63d1110"], 0x2a) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000380)='/dev/full\x00', 0x2682, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r3, 0x402c5342, &(0x7f00000003c0)={0x8, 0x0, 0x2, {0x0, 0x989680}, 0x3c55, 0xa736}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RFSYNC(r1, &(0x7f0000000300)={0x7, 0x33, 0x1}, 0x7) getxattr(&(0x7f00000005c0)='./file0/file0\x00', &(0x7f0000000600)=@known='trusted.syz\x00', &(0x7f0000000640)=""/113, 0x71) write$P9_RAUTH(r1, &(0x7f0000000580)={0x14, 0x67, 0x2, {0x37, 0x0, 0x6}}, 0x14) write$P9_RREADDIR(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="2a0000002f01008bce1f5e2190a090a4e0624cddc301464e77b84e86f38a2e543f7d5c4aee9979416e32374e9151998f1336"], 0x7) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x1, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000004c0)) [ 383.817570] IPVS: Creating netns size=2536 id=49 [ 383.898528] binder: BINDER_SET_CONTEXT_MGR already set [ 383.907590] binder: 26195:26255 ioctl 40046207 0 returned -16 [ 383.921085] binder: 26195:26255 ERROR: BC_REGISTER_LOOPER called without request [ 383.927278] binder: release 26221:26226 transaction 638 in, still active [ 383.927284] binder: send failed reply for transaction 638 to 26195:26209 [ 383.927299] binder: undelivered TRANSACTION_ERROR: 29201 [ 383.966870] binder: 26195:26209 got transaction to invalid handle [ 383.967021] binder: undelivered TRANSACTION_COMPLETE [ 383.967029] binder: undelivered TRANSACTION_ERROR: 29189 [ 383.967053] binder: undelivered TRANSACTION_COMPLETE [ 383.967059] binder: undelivered TRANSACTION_ERROR: 29189 [ 383.967991] binder: undelivered TRANSACTION_ERROR: 29201 [ 384.000345] binder: 26195:26209 transaction failed 29201/-22, size 0-0 line 3013 13:55:07 executing program 5: r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0xf5) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)={@multicast2, @local, 0x0, 0x1, [@empty]}, 0x14) setsockopt$inet_mreqn(r0, 0x0, 0x26, &(0x7f0000000200)={@multicast2, @local}, 0xc) 13:55:07 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004900)=[{{&(0x7f0000001680)=@nfc, 0x80, &(0x7f0000001780)=[{&(0x7f0000001700)=""/91, 0x5b}], 0x1, &(0x7f00000017c0)=""/116, 0x74}}], 0x1, 0x0, &(0x7f0000004a40)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000e95fe0)={@remote={0xfe, 0x80, [], 0xffffffffffffffff}}, 0x20) r1 = memfd_create(&(0x7f00000000c0)='@user+\x00', 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/anycast6\x00') setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000140)={0x3ff}, 0x4) preadv(r3, &(0x7f0000000140), 0x391, 0x51) ustat(0x9, &(0x7f0000000100)) 13:55:07 executing program 7: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x200000, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc9, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffffffffffff004}, {0x6}]}, 0x10) socketpair(0xd, 0x1, 0x9, &(0x7f0000000100)={0xffffffffffffffff}) accept4$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000200)=0x14, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@remote}}, &(0x7f0000000380)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000004c0)={0x0, @local, @remote}, &(0x7f0000000500)=0xc) sendmsg$nl_route(r1, &(0x7f0000000640)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000600)={&(0x7f0000000540)=@mpls_newroute={0xa0, 0x18, 0x218, 0x70bd26, 0x25dfdbfb, {0x1c, 0xa0, 0x80, 0x1, 0x0, 0x4, 0x0, 0x1}, [@RTA_TTL_PROPAGATE={0x8, 0x1a, 0xd5e3}, @RTA_DST={0x1c, 0x1, [{0x8000, 0x0, 0x81, 0x6}, {0xf8f, 0x3, 0x4, 0x9}, {0x31, 0x5, 0x6, 0x3}, {0xffffffffffff81fe, 0x10001, 0x7ff, 0x5}, {0x1ff, 0x5, 0x9, 0x7}, {0x40, 0x0, 0x4, 0x7}]}, @RTA_OIF={0x8, 0x4, r2}, @RTA_OIF={0x8, 0x4, r3}, @RTA_DST={0x18, 0x1, [{0x5, 0x9, 0xd1ad, 0x6c8}, {0x7, 0xfffffffffffffffc, 0x6}, {0x8, 0x6, 0x2, 0x5}, {0x3, 0x80, 0x500000000, 0xffffffffffffff01}, {0xffff, 0x101, 0x5, 0x401}]}, @RTA_TTL_PROPAGATE={0x8, 0x1a, 0x800}, @RTA_OIF={0x8, 0x4, r4}, @RTA_DST={0x8, 0x1, [{0x4994ea77, 0xf4d4, 0x1, 0xfff}]}, @RTA_DST={0x18, 0x1, [{0x0, 0x8, 0x80000001, 0xf61d}, {0x10000, 0x6, 0xe19b}, {0x5, 0x40, 0xa312, 0x7ff}, {0x4, 0xffffffffffff70be, 0x8001, 0x1}, {0xc88d, 0x0, 0x10000, 0x800}]}, @RTA_DST={0x8, 0x1, [{0x1, 0x20, 0x4, 0x2}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x8011}, 0x20044010) 13:55:07 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:07 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) setsockopt$packet_buf(r1, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0xb0) mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000000)) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f00000001c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[]}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) read$FUSE(r1, &(0x7f00000020c0), 0x1000) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000002000)={0x90}, 0x90) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000400)) 13:55:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)={{0x7f, 0x45, 0x4c, 0x46, 0xffff, 0x8, 0xa017, 0x7fff, 0x1000, 0x3, 0x3e, 0x7f, 0x260, 0x40, 0x3dc, 0x9, 0x0, 0x38, 0x1, 0x6, 0x1, 0x4}, [{0x70000007, 0x3b33, 0x7, 0x1ec, 0x400, 0x101, 0x6, 0x6}], "7c6e42441ed00bdbef898b72174774115730e53339103399f2d5ac02381a8a97136faa17550165ae5c34074a1b33947dcf6dced238d1ba0a6c8386618f35584ef7a6b4772770f1e77700854ff22fa426bca0fd57f771b2b8dcbc8a76954115dc428885a2c6ca59f90819a0dc67bddc9fe9c008b2188dea4852c24a5dc0545bd2da52e53e67686c0e4504755fbb00efbd57723f9a149f2f1dd86f582411502272a47b2d275534aed1e9e3a4dfb7d40ee0c524634eb34c9c9b5cb40638e32766138dc409070894038292090438830f3850230e7d04a9e730c60fee2fae575ef5920082ff0c47834041af7829444f19a44cf359f00fd736b0827deca90863", [[]]}, 0x275) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:07 executing program 3: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x88d9, @loopback}, 0x1c) setsockopt$netlink_NETLINK_PKTINFO(0xffffffffffffffff, 0x10e, 0x3, &(0x7f00000000c0)=0x6, 0x4) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000300)={@local}, &(0x7f0000000340)=0x20) personality(0x6040000) [ 384.018744] binder: undelivered TRANSACTION_ERROR: 29201 13:55:07 executing program 5: r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0xf5) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)={@multicast2, @local, 0x0, 0x1, [@empty]}, 0x14) setsockopt$inet_mreqn(r0, 0x0, 0x26, &(0x7f0000000200)={@multicast2, @local}, 0xc) 13:55:07 executing program 3: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) renameat2(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) fchown(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup/syz1\x00', 0x200002, 0x0) r1 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0xfdb8, 0x4008080, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer\x00', 0x4000, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[]}}, 0x0) 13:55:07 executing program 1: getxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@known='security.capability\x00', &(0x7f0000000200)=""/17, 0x11) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080), 0x3) r1 = memfd_create(&(0x7f0000000040)='ifb0\x00', 0x3) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x11) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000140)={'tunl0\x00', {0x2, 0x4e20, @local}}) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000000c0), &(0x7f0000000100)=0x8) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000000)={'ifb0\x00', {0x2, 0x4e22, @broadcast}}) [ 384.111262] binder_alloc: 26265: binder_alloc_buf, no vma [ 384.117355] binder: 26265:26272 transaction failed 29189/-3, size 24-8 line 3136 [ 384.130250] binder: 26265:26272 ERROR: BC_REGISTER_LOOPER called without request [ 384.181932] binder: 26265:26276 got transaction to invalid handle [ 384.190334] binder: BINDER_SET_CONTEXT_MGR already set [ 384.195572] binder: 26265:26276 transaction failed 29201/-22, size 0-0 line 3013 [ 384.220708] binder: 26273:26277 ioctl 40046207 0 returned -16 13:55:07 executing program 7: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x200000, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc9, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffffffffffff004}, {0x6}]}, 0x10) socketpair(0xd, 0x1, 0x9, &(0x7f0000000100)={0xffffffffffffffff}) accept4$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000200)=0x14, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@remote}}, &(0x7f0000000380)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000004c0)={0x0, @local, @remote}, &(0x7f0000000500)=0xc) sendmsg$nl_route(r1, &(0x7f0000000640)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000600)={&(0x7f0000000540)=@mpls_newroute={0xa0, 0x18, 0x218, 0x70bd26, 0x25dfdbfb, {0x1c, 0xa0, 0x80, 0x1, 0x0, 0x4, 0x0, 0x1}, [@RTA_TTL_PROPAGATE={0x8, 0x1a, 0xd5e3}, @RTA_DST={0x1c, 0x1, [{0x8000, 0x0, 0x81, 0x6}, {0xf8f, 0x3, 0x4, 0x9}, {0x31, 0x5, 0x6, 0x3}, {0xffffffffffff81fe, 0x10001, 0x7ff, 0x5}, {0x1ff, 0x5, 0x9, 0x7}, {0x40, 0x0, 0x4, 0x7}]}, @RTA_OIF={0x8, 0x4, r2}, @RTA_OIF={0x8, 0x4, r3}, @RTA_DST={0x18, 0x1, [{0x5, 0x9, 0xd1ad, 0x6c8}, {0x7, 0xfffffffffffffffc, 0x6}, {0x8, 0x6, 0x2, 0x5}, {0x3, 0x80, 0x500000000, 0xffffffffffffff01}, {0xffff, 0x101, 0x5, 0x401}]}, @RTA_TTL_PROPAGATE={0x8, 0x1a, 0x800}, @RTA_OIF={0x8, 0x4, r4}, @RTA_DST={0x8, 0x1, [{0x4994ea77, 0xf4d4, 0x1, 0xfff}]}, @RTA_DST={0x18, 0x1, [{0x0, 0x8, 0x80000001, 0xf61d}, {0x10000, 0x6, 0xe19b}, {0x5, 0x40, 0xa312, 0x7ff}, {0x4, 0xffffffffffff70be, 0x8001, 0x1}, {0xc88d, 0x0, 0x10000, 0x800}]}, @RTA_DST={0x8, 0x1, [{0x1, 0x20, 0x4, 0x2}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x8011}, 0x20044010) 13:55:07 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)) r3 = accept$inet6(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) setsockopt$inet6_icmp_ICMP_FILTER(r3, 0x1, 0x1, &(0x7f0000000040)={0x6}, 0x4) clock_gettime(0x0, &(0x7f0000000500)={0x0, 0x0}) ppoll(&(0x7f00000004c0)=[{r1}], 0x1, &(0x7f0000000540)={0x0, r4+10000000}, &(0x7f0000000580), 0x8) r5 = syz_open_pts(r0, 0x0) dup2(r2, r5) [ 384.231872] binder_alloc: 26265: binder_alloc_buf, no vma [ 384.247957] binder: 26273:26277 transaction failed 29189/-3, size 24-8 line 3136 [ 384.265744] binder: 26273:26277 ERROR: BC_REGISTER_LOOPER called without request 13:55:07 executing program 2: getdents(0xffffffffffffffff, &(0x7f0000000040)=""/205, 0xcd) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000140)='dctcp-reno\x00', 0xb) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, &(0x7f0000000480)={0xc9b0, 0x0, 0x4, 0x4, 0x401}) socket$netlink(0x10, 0x3, 0x5) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000340)={{0x2, 0x4e24, @broadcast}, {0x306, @local}, 0x0, {0x2, 0x4e23, @loopback}, 'erspan0\x00'}) r0 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x8c, r0, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffffffffff7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xc000000000000000}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x34}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40091}, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000500)=""/216, 0xd8, 0x3, 0x0) r1 = socket(0xa, 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000003800700000000000000000001"]) ioctl(r1, 0x8916, &(0x7f0000000000)) ioctl(r1, 0x8936, &(0x7f0000000000)) [ 384.316069] binder: 26273:26300 got transaction to invalid handle [ 384.323359] binder: 26273:26300 transaction failed 29201/-22, size 0-0 line 3013 13:55:07 executing program 1: r0 = socket$inet6(0xa, 0x800, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$packet(0x11, 0x3, 0x300) fcntl$dupfd(r1, 0x0, r1) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x4006, 0x4) sendto$inet6(r1, &(0x7f0000000240)="0581c7000500000000000000ffa2ad88050000000000008c39160aaacb57a80000067d1a80e19e33e3c2e7725f4a5861153709000000f7402810247f0139d643ba0708e265756fe5eb8f5972eaecfffc2bd9e9aba5568a12843d4342277bd6adf74af03e90f5490f2a38ff07e4b0a084b53a683747f955a47ddc7100080000395da1a7ba8a7069cdb5f4eff4aae8b98ccd4245ad64ceaa7ad4974418b715a624f2cfdaf236512e17960229a1b3bc79b3603a800292fa7c36fb4f6c1342c60e17e6539f6bfeef0bae71fd57b9798d8b6370", 0xd1, 0x0, &(0x7f0000000000)={0xa, 0x100200000800, 0x8000000000006, @remote}, 0x1c) recvmmsg(r1, &(0x7f0000005740)=[{{&(0x7f00000001c0)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000480)=""/246, 0xf6}], 0x1, &(0x7f00000007c0)=""/52, 0x34}}], 0x1, 0x0, &(0x7f0000005880)={0x0, 0x1c9c380}) pwrite64(r0, &(0x7f00000000c0)="ad477f81be8ba561159e86eafa2baf52295d538f1cb705325b5c84fc4ce5b4ac0802793fe6eb0fa7c8c5606a5407f085368be32cc4dd4b03086f3f34aaa68018a289517ee0f3d55149bc", 0x4a, 0x0) 13:55:07 executing program 7: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(0xffffffffffffffff, 0x40a85321, &(0x7f0000000340)={{}, 'port1\x00', 0x20, 0x40, 0x0, 0x0, 0x7, 0x0, 0x1000, 0x0, 0x2}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, &(0x7f0000000200)={0x6, 0x0, 0x0, 0x2, 0x0, 0x7}) mlockall(0x5) r1 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x10000) preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000400)=""/241, 0xf1}, {&(0x7f0000000500)=""/163, 0xa3}, {&(0x7f00000005c0)=""/163, 0xa3}, {&(0x7f0000000680)=""/101, 0x65}], 0x4, 0x32) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) sigaltstack(&(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0)) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0xffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mq_unlink(&(0x7f0000000280)='\x00') munlockall() getsockopt$ARPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x63, &(0x7f00000001c0)={'TPROXY\x00'}, &(0x7f0000000700)=0x12c) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000040)=0x13) renameat2(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', r2, &(0x7f0000000180)='./file0\x00', 0x4) 13:55:07 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) setsockopt$packet_buf(r1, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0xb0) mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000000)) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f00000001c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[]}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) read$FUSE(r1, &(0x7f00000020c0), 0x1000) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000002000)={0x90}, 0x90) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000400)) 13:55:07 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(0xffffffffffffffff, 0x40a85321, &(0x7f0000000340)={{}, 'port1\x00', 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, &(0x7f0000000200)={0x6, 0x0, 0x5, 0x2, 0x0, 0x7}) mlockall(0x5) setsockopt$inet_mreqsrc(r0, 0x0, 0x0, &(0x7f000001b000)={@dev={0xac, 0x14, 0x14, 0xa}, @loopback, @rand_addr=0xe000000000000000}, 0xffffffffffffffde) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000000c0)={0x0, @empty, @local}, &(0x7f0000000100)=0xc) ioctl$TCSETS(r1, 0x5402, &(0x7f00000002c0)={0x8, 0x100000000, 0x0, 0x9, 0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1000, 0xfffffffffffffffb}) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) munlockall() getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@mcast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}}}, &(0x7f0000000140)=0xe8) setsockopt$inet_mreqsrc(r1, 0x0, 0x2d, &(0x7f0000000180)={@rand_addr=0x8, @multicast2, @broadcast}, 0xc) ioctl$TUNSETOWNER(r0, 0x400454cc, r2) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000040)=0x13) 13:55:07 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x805, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x3, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$TCSBRK(r0, 0x5409, 0x8) dup3(r0, r1, 0x0) 13:55:07 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x1f, 0x8, '9P2000.L'}, 0x15) r2 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001fd) clone(0x50c301, &(0x7f0000001f37), &(0x7f0000001ffc), &(0x7f0000001000), &(0x7f0000001000)) [ 384.821190] IPVS: Creating netns size=2536 id=50 13:55:07 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:07 executing program 1: getsockname(0xffffffffffffffff, &(0x7f00000002c0)=@can, &(0x7f0000000340)=0x8b) unshare(0x4000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000180)='/dev/pktcdvd/control\x00', 0x404240, 0x0) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl(0x9, &(0x7f0000000440)='./file0\x00', r0, &(0x7f00000005c0)="03fa253b75667bacc62935cb37b7a9e636636e861f48bfd6fff16403e84bba2ff78cbfffffe4ea4508af12c754a4764a68500d9f4e5e29") r1 = syz_open_dev$sg(&(0x7f00000003c0)='/dev/sg#\x00', 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x80000001, 0x0, 0x3, 0x3, 0x20, 0x2, 0x3}, &(0x7f0000000200)={0x81, 0x1ff, 0xfffffffffffffff9, 0x6, 0x8001, 0x6, 0x9, 0x16}, &(0x7f0000000400)={0x2, 0x0, 0x80, 0x3, 0x4, 0x1, 0x10001, 0xfaf}, &(0x7f00000004c0)={0x0, 0x1c9c380}, &(0x7f0000000600)={&(0x7f0000000500)={0x8}, 0x8}) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x60, 0x0, @scatter={0x0, 0x0, &(0x7f0000000500)}, &(0x7f0000000100)="da845aca5dc25ccfb98985d85fd5545abd013c3b82b5c3e6fee1e1af2b9a0693a7af3aa9db9a0006584e6fc258d2d3d3a626fffaa0bcf6342594ea8e487109202b9d535a907653c8659d3ea8aba8de60717c3140d21db2d8c1a7ec67cabf17b1", &(0x7f0000001740)=""/208, 0x0, 0x0, 0x0, &(0x7f0000000380)}) [ 384.906267] binder: undelivered TRANSACTION_ERROR: 29189 [ 384.917297] binder: undelivered TRANSACTION_ERROR: 29201 [ 384.997147] binder: 26273:26300 ERROR: BC_REGISTER_LOOPER called without request [ 385.005342] binder_alloc: 26273: binder_alloc_buf, no vma [ 385.017488] binder: 26273:26353 transaction failed 29189/-3, size 0-0 line 3136 [ 385.039342] binder: BINDER_SET_CONTEXT_MGR already set [ 385.039352] binder: 26352:26357 ioctl 40046207 0 returned -16 [ 385.039668] binder: 26352:26357 ERROR: BC_REGISTER_LOOPER called without request [ 385.043079] binder: release 26273:26354 transaction 648 out, still active [ 385.043084] binder: unexpected work type, 4, not freed [ 385.043087] binder: undelivered TRANSACTION_COMPLETE [ 385.043124] binder: undelivered TRANSACTION_ERROR: 29201 [ 385.043161] binder: undelivered TRANSACTION_ERROR: 29189 [ 385.089825] binder: 26352:26361 got transaction to invalid handle [ 385.089836] binder: 26352:26361 transaction failed 29201/-22, size 0-0 line 3013 13:55:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x20c, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f0000000180)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:08 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) fcntl$setlease(r0, 0x400, 0x3) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x6, &(0x7f000059dffc), &(0x7f00000000c0)=0x4) 13:55:08 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") r1 = socket(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'veth1_to_bridge\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={@loopback, @dev, @loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2}) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000180)={@empty, @mcast2, @empty, 0x0, 0xffffffffffff3342, 0x0, 0x400}) 13:55:08 executing program 1: getsockname(0xffffffffffffffff, &(0x7f00000002c0)=@can, &(0x7f0000000340)=0x8b) unshare(0x4000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000180)='/dev/pktcdvd/control\x00', 0x404240, 0x0) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl(0x9, &(0x7f0000000440)='./file0\x00', r0, &(0x7f00000005c0)="03fa253b75667bacc62935cb37b7a9e636636e861f48bfd6fff16403e84bba2ff78cbfffffe4ea4508af12c754a4764a68500d9f4e5e29") r1 = syz_open_dev$sg(&(0x7f00000003c0)='/dev/sg#\x00', 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x80000001, 0x0, 0x3, 0x3, 0x20, 0x2, 0x3}, &(0x7f0000000200)={0x81, 0x1ff, 0xfffffffffffffff9, 0x6, 0x8001, 0x6, 0x9, 0x16}, &(0x7f0000000400)={0x2, 0x0, 0x80, 0x3, 0x4, 0x1, 0x10001, 0xfaf}, &(0x7f00000004c0)={0x0, 0x1c9c380}, &(0x7f0000000600)={&(0x7f0000000500)={0x8}, 0x8}) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x60, 0x0, @scatter={0x0, 0x0, &(0x7f0000000500)}, &(0x7f0000000100)="da845aca5dc25ccfb98985d85fd5545abd013c3b82b5c3e6fee1e1af2b9a0693a7af3aa9db9a0006584e6fc258d2d3d3a626fffaa0bcf6342594ea8e487109202b9d535a907653c8659d3ea8aba8de60717c3140d21db2d8c1a7ec67cabf17b1", &(0x7f0000001740)=""/208, 0x0, 0x0, 0x0, &(0x7f0000000380)}) [ 385.280575] binder: release 26273:26300 transaction 648 in, still active [ 385.291310] binder: send failed reply for transaction 648, target dead 13:55:08 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = epoll_create(0x7ffffffc) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)) dup2(r0, r1) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)) [ 385.322075] binder: undelivered TRANSACTION_ERROR: 29189 [ 385.335803] binder: send failed reply for transaction 652 to 26352:26357 13:55:08 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0a5cc80700315f85715070") timer_create(0x2, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)=0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) timer_settime(r1, 0x10, &(0x7f000004a000)={{0x77359400}, {0x0, 0x989680}}, &(0x7f0000040000)) timer_gettime(0x0, &(0x7f0000000040)) clock_gettime(0xd, &(0x7f0000000000)={0x0, 0x0}) timer_settime(r1, 0x0, &(0x7f0000000080)={{r2, r3+10000000}}, &(0x7f00000000c0)) [ 385.451219] binder: 26387:26391 unknown command 0 [ 385.467524] binder: 26387:26391 ioctl c0306201 20000440 returned -22 13:55:08 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'team_slave_0\x00', 0x0}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/156) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c0001040000000000000000020000006d8a34312c", @ANYRES32=r1, @ANYBLOB="fcff00000c0001000180c20000000000"], 0x2f2}}, 0x0) 13:55:08 executing program 3: mknod$loop(&(0x7f0000000040)='./file0\x00', 0x1, 0xffffffffffffffff) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)=@known='trusted.syz\x00', &(0x7f0000000100)='/vmnet0\x00', 0x11f, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x1000000000800, 0x20) listxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)=""/189, 0x2) [ 385.495083] binder: 26387:26391 ERROR: BC_REGISTER_LOOPER called without request [ 385.547037] binder: 26387:26404 got transaction to invalid handle [ 385.568882] binder: 26387:26404 transaction failed 29201/-22, size 0-0 line 3013 13:55:08 executing program 1: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) socket$netlink(0x10, 0x3, 0x9) openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x2, 0x0) syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0xfffffffffffff410, 0x20000) r1 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) ioctl$BLKRRPART(r1, 0x125f, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000540)=0x1, 0x3, 0x0, &(0x7f0000000580)={0x0, 0x1c9c380}, &(0x7f00000005c0), 0x0) r2 = socket(0x10, 0x2, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000140)=0x7fffffff, 0x4) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='status\x00') sendfile(r2, r3, &(0x7f0000000000), 0x80000002) ioprio_set$uid(0x3, r0, 0x7) [ 385.657689] netlink: 12 bytes leftover after parsing attributes in process `syz-executor5'. [ 385.699123] netlink: 12 bytes leftover after parsing attributes in process `syz-executor5'. [ 385.816724] binder: undelivered TRANSACTION_COMPLETE [ 385.828454] binder: undelivered TRANSACTION_ERROR: 29189 [ 385.847867] binder: undelivered TRANSACTION_ERROR: 29201 [ 385.948882] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 385.992123] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 386.189220] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 386.212376] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 386.258081] binder: BINDER_SET_CONTEXT_MGR already set [ 386.263390] binder: 26387:26461 ioctl 40046207 0 returned -16 [ 386.275844] binder: 26387:26404 unknown command 0 [ 386.277938] binder: 26387:26461 ERROR: BC_REGISTER_LOOPER called without request [ 386.291252] binder: 26387:26404 ioctl c0306201 20000440 returned -22 [ 386.321277] binder: undelivered TRANSACTION_ERROR: 29201 [ 386.350800] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 386.373160] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 386.408831] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 386.431254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 13:55:09 executing program 7: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(0xffffffffffffffff, 0x40a85321, &(0x7f0000000340)={{}, 'port1\x00', 0x20, 0x40, 0x0, 0x0, 0x7, 0x0, 0x1000, 0x0, 0x2}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, &(0x7f0000000200)={0x6, 0x0, 0x0, 0x2, 0x0, 0x7}) mlockall(0x5) r1 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x10000) preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000400)=""/241, 0xf1}, {&(0x7f0000000500)=""/163, 0xa3}, {&(0x7f00000005c0)=""/163, 0xa3}, {&(0x7f0000000680)=""/101, 0x65}], 0x4, 0x32) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) sigaltstack(&(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0)) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0xffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mq_unlink(&(0x7f0000000280)='\x00') munlockall() getsockopt$ARPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x63, &(0x7f00000001c0)={'TPROXY\x00'}, &(0x7f0000000700)=0x12c) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000040)=0x13) renameat2(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', r2, &(0x7f0000000180)='./file0\x00', 0x4) [ 387.413348] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 387.448695] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 387.455085] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 387.462256] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 13:55:11 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x400000, 0x0) sync_file_range(r0, 0x1, 0x8, 0x4) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000080)=0x401, 0x4) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$addseals(r3, 0x409, 0x0) set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) readlinkat(r0, &(0x7f0000001140)='./file0\x00', &(0x7f0000001240)=""/162, 0xa2) bind$inet(r4, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$inet_buf(r1, 0x0, 0x27, &(0x7f00000010c0)="ab9a9e8088ff855e89ad829b85949b1bd8a98f4bc2fa2d8d1872a3cd473c9d26e925ebcec452a26ceb58b1f2a4754902a4c17b163a28285db2c607b412ba74c47bcc6f7151654dc3c04404f6f53495023914e88180ef5805d4dae28e8485df25466bbfe59e612c14a6f1b89e0ea3b8603018ae0fb7cafa10e784fc7c8292", 0x7e) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = add_key(&(0x7f00000013c0)='.dead\x00', &(0x7f00000017c0)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000004640)="e00bfee11203fdf1533e3652176cced83d45ebb53dc09714798bc7ac97204b78d1e325f412e57df98138d3afc06abad5241250d0625250d74aaf4355bb48edc0fffc815f446f4240ce7a03b2ffb592f8fdb6b057539e9acbf5439fec57ec9956d2d1e240d3cd71e17d67e7510e9ddcb47b7b5e53", 0x74, 0xfffffffffffffffa) r8 = add_key(&(0x7f0000001180)='logon\x00', &(0x7f00000011c0), &(0x7f0000001200)="0c1f71eab5ee996493f3f4b4c023ff3ea6ce7a5d7c0d51e8004ca70cc5cff8ad", 0xfffffffffffffc68, r7) keyctl$instantiate(0xc, 0x0, &(0x7f0000001400)="1e847893af60d80263896d91151918af70472d16fdcac0429ceedf09508f80f7ecf64111f9a485a9ecc60b2ae7119366cf883821c4d02b5a40480a85d0a5f899beb1840073b67c061a5c8e2c4dec090471e7fa9864b3d731f4a1169c87ff7a78c7c850770a931aad22a5965708b7c006fc7aa9e4aeca30849a86f7a31f21d1e62a3e9f2343cec6c85828698b43e48fd313f17c5bd84f1e1bb51e18a27db2ece85e63d6119880975727a86e623f95e7aacf3d64dffa6318d28f14f28fe0cef987711333fbd8addbb48d0ae24c9fc3e6762c7331cda87144d1c3a1fb0c71006c18ae63c73899e83dff1520bb5d62d4c662812312df56fb7f8e5e6dc5a3508f3404cd1541a80784bc4c38219ee09b0d92f101faf241e9af2a1ffc30cc322e54ada855230ca185fd5f15e4f439b3699e4721d758156141d592e602a902701af4da97d77a9a65786bd2d5c9360d82fd5f12ba6e77455a32583e2798f4e10866d4583eba8fd91c350efaf8c7fd567c93f5e6526920678fe06766681a06af9b4adfd1c1678e0405d482b490447aa586ca4e4dffde73237eef7b9fb68d209fa5fe7b4631a6c817fdc9bacb23e9667f2e2e5f3051d1e7d0b47a570942758659c9ab8b77dfa7a102bbb86ffcfea25e768be4edf067e2d208b5e3bef68212b00c6e5d31896b486920ec73f38e4b94680f52b757adf0b4bc6b267a7b1237b7761fbe43b7afa57a8982e93adcd6401bfcc9b5d42151cabfe36ab8d0052f24b7ca5fe028d59b5cafd76feee6da9bd55e64283f451f3ce141df1110ffe1d5060216efb25448c850d5222df449e7012d5dc05abd5dd5e064b97add9760e720a86913efe267425b303fe70af5bb0a5aa2b00685f7217f83c985e7a6d7e6f65197e7a706a60b13edd249ab3260336511532e263096acdd45a0499fafc8d5ffddf5d84e00752cc3e80bb0627496356b81b9121b4dec92087fb719a0607cb1a1ebbfc40003062ea8d8f81a225fda4795052be70bdd61816b9173595185b086e8f397859a0296adb6d31aa681f64b84a9864faa7c3c5053ed059d5cc4c4f83b920e436aad0a8d05a4400b538acd03a612d239e025d85f542b617ee2df687d4d53af65550e8caa84cea9c3ddf2df4265acb9bc2e9a17fea40e4bc7cfe1a418602bac5f765a709940b238ea450818aaf83ce1ea26bd7351861aaa4a74e80283efc875609b2264ab4c92d9ad7afb23e41b1c3358ca07f38bf0f9335d2a3129f4a4e62a56d27d38b44bcf27d9ec92882bd4460c358b205a70445234c52a5e0d7335c54b13fc31964a8b87751d1ae405", 0x3a3, r8) r9 = syz_open_dev$ndb(&(0x7f0000000100)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x19, &(0x7f0000000100)=0x4, 0x4) add_key(&(0x7f00000001c0)='rxrpc_s\x00', &(0x7f00000002c0), &(0x7f0000000300)="fd4d9b6fa325fe0f9c34c09570b969ddea3fe28afe87258116c58b02d217d6955090ca0b192512de2e4f2e3465ec6aa16bdfd158afec41d87a89bcd440e396a03d253792db314e99dd320a5951802b05e6cf10779293e0e8bc91406994f75259deacff72341a698a2e09d6457feca571f3bd0b94994419c08538d06433336d31d1a47eb50ae1aee3bddb094033c0d4f67b864f07036ebfcce36035098ebd27afdf6fe4b0cf99e850f8c48d567b9a70f932c5f901474800f45fbec51befe57fdd7241441307393e8c32c10d6b60f1e7c2c96abec25ae5d8ea7c838263ed6865ad022f3c662091a23f8026513adb72ceef83f787d98285c0997192aefcf0758417c87402ee9297a35eb0eee8dd302fee6fa414d67c7e237f3a713c939e7b1040635e1be732773fe61997d8106baeabeca3dc4d2ac56ea6ed24b63b5c6e4def2c9811ce8ca3e873457c15784cc01cff187a73300ac61130ce7840a7704705b08c498328f50f51ad84a173edd8a4bbe730dc144048fbe9cd59eabc39ca78f54de1e04e9d728e6c21fccfafab8410cacdf97d61b24fbcf3a94f8cb6ee957df4ba72827b6f0150198b41d97e109ac2d67f5ad2417aa742bf651f211a38c06ae0f191297fe3cffafe0a3bc3c8059cba876827249ea8847499e25d267eb40c4788d9defee07bf57a74bc5d244202106ba6289dede4fcfd21ebfa35a87258b46d0847347089783a06a4c8defe70b49adfe55278ed5f78244e8abfe35e982801395dd0bc1332b6423c5f2108b7def1626e84f46065691ddddcae2b25aecc2959847d0d1c34f38c0fbb7317bc070e01f7102b2bb16875b032e30ceed5e9f2e2c9bf3f038815c70fa0adec0f406aad013de0016f8d778966b3f397772f9b66fef0aabc917d806dde4c6221fbac873aea6e2f6460ee4dc020f6227badfa77586b7fc5f4606d37a398452aed42432cbfc148e7fe20c059518be793e4f973fd6abe7a2fb928d8387e41ecdb5c29ef4d2bf17e3f56856385e78a78683f17cbc1fb986ad0eef499f9c81c5e8e5648c51a0287f53f085dcf59843082f8e933884184770b9f29ced77c5cc8accdbbd34a2d6d00af2f0778406636827a824ea4bd3dbc36d08ac56430eb2fa48b2b88c94b1620a693612b4492867df1799d22370b853a605450d6e9a16294a584fd6e516ba5d51d6435f74bfca02c7a65914034b12d9abcfee885af437add779ec47aaf4d85d8dabffaef2d722d299d8b1ed06c49b1a641a0b8f041d2eb9271982a337d90c673766a9f56a8355ace97a3ba090e2062c39759bb1e91f8001c4cc4df95c12a0ff0a52c9cc40cdae068ad5f565bbbbb83d32f084e978b694481479b3940689ae7eb43633517ea05ed79c63dd6a8b613ac87f569738d3866b2235a18e48a3ce67a6c80a9359de772faac17d95238a5d57c099805e9fa7adf4bc985809b842a0d06521f3ae11e83a119f7030b6b33daf564662d6a8f2199a2c04a057d788d8a67854359f057f2ec88ce93b318250ee5f0caca2ced1c3b09427201726bed597f5c4d874bccfb7874d7865f92c76ff7a3faddfd898b6c7d2cbc85196780095a1f3222e2349ce33bfe9da2f201c529845d0ee5add9141dcaab40a5e46cd9ea40d92327a309af24ad51a73b09704d4656582b5cefccfbe8ac73dc28e6dd5317d1c5162e64bba784e6cffa6db14e30d1cd6aaa1cf2b9656b9f4d22a1f0085a4b659b26688510100abd2402f2aa343a32b06f0301e6dbee1fc7946b72cbc5295ed1543e4e97f524cdd47b8626d2197c949284b33fe6eb459d950b1f1593f142c7957bd1943d527f0309bad331d7b0196494f72777c5cc4ff30af7bb1f5ae3df689523272055e46dc115841e894ac26ebc90584b631eae29df4c8ce651ebf2416f6dd300f252bf6cf5790b63c6a3836b5521e2c1e0c592eaf5ca4ff1334f0b5f824242d167ddadb993e4be92f20893e9cfad175cef58b3bf62486be9cc477d2d4df2d0732f8c413b40615c32be965d0afb224b5e5e88f859860d4fb43ce18d6ebb98c1fd017a5302f334a91309a24b6e944b83f3b1eb63a32d342a49d7e55013aa811af083f7b2b45499117b4c3f7b272ab7af4dcda925c9004b8f109563425f6eaf41357678507a44c7fcee390a6e7f326df2b701e5f0b1435fcc7ca27396f81155bc94a3e4128809aa70ec87c2f2489d8351fea5c445a0168e73fe557872ea59cd2fdf13bb280266dd10e435e698ba871ea8cfae15be58faf97c3641e463a7f8f877d3b8e3c7e3c7c6bf879269c44479154350098a57a9667059562c4c241fef7f2ee81300ff7409796b69e8375a77925c38a63794483cda2c877eddf7850b7759159da048480bb24fd13a7d7f60a23b33e39a3e5b795e774aa4cf3330024a637b7e99e5aa55f4d1fae5d613cea8fd655e929ffb8a05bf7f1ff02e2d702355c9b37da5d5e68846df2cd1cd3cd9aa79970890009e5d0ccf7e00dab65fb819656703dbd6f1d659497752f3cb1a06b189b5c6db9d2543743927b7a425d4165d8651f784211cbd8c759813593a2df1a367c67cffd9875d497e2757cc12dc8f1d3dae39a9ba84b5d4505e3b9166a98ab3a49bc9d030c5eea948c9fb4983b0fa0ff68bdc5cf766a43a8c2c767fa2095b60f7397dacb6baa4286578d3e6d41a83ab8bd9f5e7d78d5c0a5ab321448a2ddd6588b4e7a7a6aee04ff37f01358bc3cc16c30cb58358fc1c0109525f4a11c9a066419bd0a578bb4e7228573e3522256fc1cf100f33d5ecfec86fd782ad6b73b69b576c453d5f5f78954abe21eb18251e2e2a40a82ff97da84398a43db2e236c05af203e1106cfd89a5eb8f4a159e14b907f86c677cbf8cdf984d31db32984dbcc21488b3613a5fe930df57c6062faca7746d2277c4dc187846676dd0cbadc82085f1d1d4ea350d7f61baaac25d311f7d044ee9e16c83d139129e1839d2185157b747f45d877764a97fd49bee4c27caecea2154dcff47a91669ed10c6e9828d1f7a41647e945edc57557debf9f22215a053724df6124f9bcc2c320fe9bf6d970ccc490e2af38c9cd3fd20e9262099039fc7bf55e3c6ba61d7e3b5d18fe66a725c869ee1b585326eba74fc03ce968bf52d475e3912a35e5b833139ee17c5c78ceab33be5535f3d6044a82edf30d8dab797d68ad79a2e515f5eec9fc32a8ad4507f95c187784e678ec5e51ec42bbc8fdabcccd14c187eb0b54694573a6085931d745c432b4f02bb1b063e1097d5aa65c950072690074c47e4b4de02d93c9c19fe54a5dacbb416bf671d38c5875efff81eeb764fa54e79bf1b95c640e67c8f990bcaf79b5779e20be0de09909ff2f031d16abd1f4bd034794dbdf3f6278fb9662d7b759fe82f7a248a1d4f91a5b4ecbe99eba5cc38e89fb01b69cded9044332013b9081aee4dd099ade44a5489dbfb9cfdb44a7b83b8e4774270235b5b7b8dc924b644638926148ba90a1fadb11a1296658152127b3eacebd7a846a17283719fe6552481dce5c95d0284e8aa0cd5ece04b37768c30cc2bed996a9e5b4f23bb06b71d1f8a717e40dd31ae526ca0f8b64ea16742a2770ad04a8390cf387d0f3c853040fd68a1f2913afe276eec967083ab02df446c535f25efb9e375159244401d1c64a7736ccd66acbf7aff9d24c555c2382c7fe582fbae9368aab6dc03394036b979de7930b5bb7648c180558bfc1aa35313c36303d3386feb792b3a6cd18b3eee947f46d2ad0a94627e9c4bbd2dbf650ea1e89717ac0c929dd084bc617162b4df1fdd76a1221eac307c2377b0ee75539d1708f1fb5bd0a1d2bf83638e5bf44df3b4fc3ed80b2f4821c144bf49a7a257b50ed8983f886dbda112f830739b9ca0b6e0c3b6910f9c88432d26319a65a6873f3ac87277ee35642a2fb6f893cc4283ec188184b72459c7c0968a888270bdbea57fdc756e3838a1b4146423fb876328aa27052457fc3d3e05f88cd306139b31b2779f377b4550ecbe2f605d035c370f95b61b29c0b39c8533621155466b1ef7b5f3ef7e0e9b1ec60bab19c3c7af99a541cded065dd1633c594dc97b07c0c91af2854b2b92af6570bddd18bbb5108f3818af56eeb3068f53752989c20f1637548ef5bb0f4d1ff4ee49418075885a46bdbab37cb44c2d6c73b0d5960b1b606a819f566e82c51ae23942f6bc0af43f87801e94b35f6add66b07fdb5022557e8dc5b8b1d3480f0d847d0514b86c4e030dd0d32baec1c7baadf8dbf0a39ee45f5a368b5bacfc9f30c0b7f1101bb776ce85b9404754b6bf4887e34975833fd38f683f383693053d9b9c9b37e3f2e6040f39e175eae2659c82c3e1acd4c2163e0e1ec8aafd3a816203e815e74c9afe5777b38287d7f97b1d44a35370a7da6d32ef3c83470b434bf5eca036f0d2bd61780171d615d57d61fd4f7850755d17babc7efd3b0d847064112d1be7cc2985468a4445f95befeeed1d23ea63982bc9af2b38bb92185c1caa4ed8f54836eb3e1c074f3454b9366927ddb4cbb36848dea43bde1c7fe93a98feb0fac1d51d67b29a455b9623fa7ecf9f3781912bfac34b47070fe3da93e1f8b733a34c5129ab15bcf4e1bc7b5938f7a6f519a1e7fba16075990e681c72bcc3c56ed34d4bc95fad050f4614395568d24d1fbdddf0331588cba5eb2222d1483850118fe95aa3ccd8119bc8dd5cf335756c106de4bd5d7ca23c8ea767eff04d8222ee0a4064f4a40435b1dbaed4a86db4cb90fe8c2b420e7d3463fdfef3bc4f49706953a9cd82279f6e397473299bc890fa704fb461cd7b5b40d135bf1756f14beb9936f02d65da81134120a6a86312a8c7604f6c21e059fd8c5a2676f871fa2769326e10a893f988cd0b624751493385dd5eea5e29aa484085872647e948a9b578c3fc", 0xd85, 0xfffffffffffffffc) r10 = syz_genetlink_get_family_id$team(&(0x7f0000001380)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000001840)={{{@in=@multicast1, @in=@loopback}}, {{@in=@remote}, 0x0, @in6=@remote}}, &(0x7f0000001940)=0xe8) recvmmsg(r3, &(0x7f0000004540)=[{{&(0x7f0000001980)=@xdp, 0x80, &(0x7f0000002a80)=[{&(0x7f0000001a00)=""/65, 0x41}, {&(0x7f0000001a80)=""/4096, 0x1000}], 0x2, &(0x7f0000002ac0)=""/245, 0xf5, 0x7fffffff}, 0x63f1}, {{&(0x7f0000002bc0)=@rc, 0x80, &(0x7f0000002f40)=[{&(0x7f0000002c40)=""/82, 0x52}, {&(0x7f0000002cc0)=""/139, 0x8b}, {&(0x7f0000002d80)=""/127, 0x7f}, {&(0x7f0000002e00)=""/30, 0x1e}, {&(0x7f0000002e40)=""/231, 0xe7}], 0x5, &(0x7f0000002fc0)=""/27, 0x1b, 0x8001}, 0x5}, {{&(0x7f0000003000)=@xdp, 0x80, &(0x7f0000004400)=[{&(0x7f0000003080)=""/61, 0x3d}, {&(0x7f00000030c0)=""/81, 0x51}, {&(0x7f0000003140)=""/157, 0x9d}, {&(0x7f0000003200)=""/104, 0x68}, {&(0x7f0000003280)=""/4096, 0x1000}, {&(0x7f0000004280)=""/107, 0x6b}, {&(0x7f0000004300)=""/17, 0x11}, {&(0x7f0000004340)=""/185, 0xb9}], 0x8, &(0x7f0000004480)=""/174, 0xae, 0x5}, 0x2}], 0x3, 0x40010001, &(0x7f0000004600)={0x0, 0x1c9c380}) getsockopt$inet_mreqn(r2, 0x0, 0x0, &(0x7f0000005940)={@remote, @empty, 0x0}, &(0x7f0000005980)=0xc) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000046c0)={'\x00', r11}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000006a00)={'team0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000008680)={{{@in6, @in=@broadcast}}, {{@in6}, 0x0, @in6=@local}}, &(0x7f0000008780)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f00000087c0)={@rand_addr, @broadcast}, &(0x7f0000008800)=0xc) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000008a00)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000089c0)={&(0x7f0000008840)={0x98, r10, 0x10, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8, 0x1, r12}, {0x7c, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x80000000}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x40004}, 0x20000801) sendto$inet(r4, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r4, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) flock(r9, 0x0) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, 0x0) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x3a, 0x1300, &(0x7f0000000000), 0x4) openat$ion(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ion\x00', 0x4000, 0x0) 13:55:11 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:11 executing program 3: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x40, 0x0) r0 = memfd_create(&(0x7f0000000080)="00000600000000000000", 0x0) write$binfmt_elf32(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c4600000000000000000000baf68d48dee28631f6c000ed0000030009000000000000000000380000000000000000000000000020000200000000000bcafce45bc27b30c2ea7f0d36ba46000000000000000000000000008000000000000080a9000000000000000000000000f3ffffff3030b665fe583994f282f2aa0ef889d903000000c27c522a72eb93fb6f83bd26cac455e56aa4afb6737be7de2b5d865291e7e5e3218723a880b32b629c4a61e60f57a0cd45b0798277e7b31846aae8396601a8da"], 0x78) execveat(r0, &(0x7f0000000000)='\x00', &(0x7f0000000280), &(0x7f0000000500), 0x1000) 13:55:11 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0x8200) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000100)=0x17, 0x4) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f00000000c0)=0xe8) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000140)=r3) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000240)=@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@loopback]}, 0x18) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) 13:55:11 executing program 2: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x80011, r0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x310bbba1b463366a, 0x0) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f0000000180)="edc0457d7a33bd030f9a046af5e035d4481d81a18e33d7479d4f3e934e57dac669426a4cdcf054f29b3e77") futex(&(0x7f0000002ec0), 0x5, 0x0, &(0x7f00000000c0), &(0x7f00000001c0), 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x340, 0x0) setsockopt$inet_udp_int(r2, 0x11, 0x0, &(0x7f0000000080)=0x5, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) 13:55:11 executing program 1: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x10000, 0x0) write$P9_ROPEN(r0, &(0x7f0000000180)={0x18, 0x71, 0x1, {{0x2, 0x0, 0x1}, 0x1f}}, 0x18) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgid(0xffffffffffffffff) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000300)={[], 0x2, 0x101, 0x3f, 0x3, 0x7ff, r1}) r2 = socket$inet6(0xa, 0x2, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000400)=ANY=[@ANYBLOB="6212cdec112321202e2f696d65ff006e0021c8fee6f610bf44031bf9d853b842ba775764d89516fcff40364c62cb17461a801f13186428546eca2973faf2c10b8f877b387600909c77bbecca99fe5dff17b887aa71b7205f3330467ca37f702ba36c9d1ad0f5785031b3b6d62e9432bd57b190f2ceb312239b402dea9e0dd763e8db6802131b3a546856ae4d705cbc91758706cdab7d40384d3be003e42e61126dc06629bfbdca2eb0a122548419d458ea7eea7b3750e637186728441e813853aa925fe30ecac2d29ad74496696590427b71cbd6d0741c487f0a46407c06df60b4418db9f1e7c069f1cf48e27789f2f6cacdcbe9b22218dbc70e78a137bbd33af1f089dec95298266d30367863e04075b369609a29517bfebf0abd8cf9d7b56ff7cae76515ef9c78f09b1d71e18d9c3ecb57aaa5f418c72b1e1f57a9f9e4179bbdb8c00265a85b40d70a0e4dbe86d35a7c844046578478db2432e5639ff8f8c155c19b32f38cfc4cb4c64d5f1d2832a4c8910ed82a685e3106c535b88889d73a6ff83bee"], 0x11) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e20, 0x3, @remote, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r2, &(0x7f00000002c0), 0x4cc, 0x0) 13:55:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x400, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000280)=0xc) sendmsg$nl_route(r2, &(0x7f00000003c0)={&(0x7f0000000180), 0xc, &(0x7f00000002c0)={&(0x7f0000000480)=@ipv4_newroute={0x98, 0x18, 0x30, 0x70bd28, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x8, 0x900}, [@RTA_PRIORITY={0x8}, @RTA_ENCAP={0x74, 0x16, @nested={0x70, 0x87, [@typed={0x8, 0x8a, @u32=0x7}, @typed={0x8, 0x3d, @uid=r3}, @generic="e739e4bcf3623f255f8ff8c5e12f32d9e5d69fd0b46fdc409fbff16229b14c388be4f19ce6b0f2b49232ebab3a8864d75f7b4fa10f35bc7b3d0d993f564b68d291cb7eb2028ff63f31da2c5915c71e7a0f0bc9d46d2cd4f9836cbd"]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:11 executing program 7: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x80000000000006) r0 = gettid() r1 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x8, 0x0, 0x7, 0xfdb, 0x0, 0x0, 0xc010, 0xd, 0x0, 0x7, 0x0, 0x1, 0x50, 0x0, 0x0, 0x0, 0x8f, 0x3, 0x0, 0x54, 0x3ba00000000000, 0x0, 0xff38, 0xff85, 0x0, 0x100000001, 0x0, 0x0, 0x800, 0xffffffffffffff00, 0x7fffffff, 0x1, 0x8, 0x9, 0xffff, 0x5, 0x0, 0x3, 0x0, @perf_config_ext={0xffffffffffffff9e, 0xe38a}, 0x0, 0x10001, 0x7, 0x0, 0x5, 0x0, 0x100000001}, r0, 0x1, 0xffffffffffffffff, 0x8) sched_setaffinity(0x0, 0x4, &(0x7f00000000c0)=0x80000001) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) 13:55:11 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r2, 0x0, 0xd, &(0x7f0000000000)=';', 0x1) getpeername$unix(r0, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x6e) getsockopt$IPT_SO_GET_ENTRIES(r2, 0x0, 0x41, &(0x7f00000001c0)={'nat\x00', 0x1000, "c940276345b28c2df16504eb42aef99e07223e1d008e1e20f1e2249d2dc2344de60aac415814f743b501d52b04fcff20dc02f15ad96720d604f0a235266f370573fb02d92bdfa8afb8bb05157a34d8e89798c8cfd62f4d60fd6f7e97753ed145b9adbbd207c8f54604c43b98ff93299c42740c5e3bfc5fe9ebbb863c852039990c7edf1418b5304c004b2f10dd2a7547f8d8d66d89d37987049e975bed2e0684df5573efa9ef10283750c1e21adabee30e101cc64371ab4d5f49ed632b2a17ce0cc374e5053fc00e18adb2c132317636ba1072f49cc920988ef9200d9c20def4d17b1b06411bcd9035a7952e7e16b02e7162c0abcc675009f62014b575ee1ead74842f0fbf505ac1180374b5cd3a4a005509307db5dc356222c292eb713018576103749e0ae5cf1e933e783ad0abcf9635185b8938de1adbefede213c738826d67243d3ee519cea9dd8b43338b056335338d84805c87cb29991ceaca1bd637789319986509537e20c348d41a4cb4159e77023732672f6470f24d14f8c3d10a89d0457da7c7c8af5850d2af9d4876c0b213073f4861ee0772d37487f93c53f236d757dbd9dd0c834bb8a683b3790f2d43b6d180ff8d392040de9c4e1a1bafcd41d5b91f0e3f2ffde7cb1a407aac0a0c9eff218475d397518184239ba67a562380c09383d48b4fd151467835f74d3a722bb6d87f9902943b8982309674394812948933ddf16eb7e65d3fb0675b46b3bce12ac7afa1fa524cc945d6293e79221fb5a504c0a4f99dba60c0a91524d3561439de84acf45236476b68f424889171791447ae9ad370ebf76086d827481570132ab07eda2cb836aa2bcdd8b64bdd38bb2c755bf1c933e8b5bc8f9d072d7814743e9ad13799f427747003e7e601dc8102fca823438f475e731972c77818f4c3f1e78cc1a0560fe89eb449f307d60c7f7b33ad16e06b280a9ebf2ed889022e143b89ce9f26b2082a6d81bb363ef8f14a55e6f172a488c8838024051a354ead454b10b5e2175a0b9f19e9a35156c69ae5a3191cdf369d2a04e451cdb43378d0f09e1b5897010da704d7d5f0ded3222554be52802ac8288912bd72da4413b04ff82c21a5a5fa21631a0546a72c1493865e81c9a49fadb4e0ba616477f7975b70f059d9c617f95d6e1935495ae0b6b144b24be5b5f98aed101fc77d13fe23a29e419fea76085a673ac1f5ed809b8e9c37331e88afdf8d997c12f7c22e418e838528391036a6d9a7a6684bd77f2289785d906bd5410f6f427fc34508af7c21b6adac18371404ad7b6e613a630754db40507730590bca008570dd917b3f8d2692dc6fb4afc132973cf3f43337db18a3a4d8658ccfa367042f06874b31c98f518aad07e9cce828a40bb82df473721913f91fb7ce1c55328adf22baf769bc52ef9e3c5b97b7205c28978b3276b7c554ad70cbc32675733470de1a2a508f7c73914c3253987523012a5662a9529c0f295e2f5f1c3a02dac4b43a506101d060e7a7c09d92fc81ea2814804c323ce587129e12b294701a6d4aeb85ad3f6b7cc290d704ebb6dd01be34928d824ba949ada9735cebb1d6281e54fac81f211e349ee7f7d450f314484f5f8188ecc9dc3c99577f07a6a5dede15f64bd24461c90b8094465cce71ca4a5aed04c178c72fadfcd304b32826c05fe5afd81d6766c1c13b2e9df0b063a2e0d7e5f6b8bb1a085e54f5d904cb979c2a0bb2fbcb25a9b0c3d4e3451bb94da327a0db01f9577af84e18af912d0baf0492f02cb8eb6a2b46663aeb3108bc119f5addf68999c7c16e415cc329fb1eb88e45ce00c850a229f2a48f4f57db84074df51499e6790987ab0cc5ba6c8397873989e7c88af2d9e3ce57b745780b74ab2cefe4f21ebfd9694aa422b6ad42a541ac186020c53f8430830999bb8a6e0350b0c9b16e57938a84155b5b95b3fd58aa095e2c875d1c9f3fbe848ec159c25517d27bce18755de32467c561b27a7d32d2bcb9e7fc1462434d2d533431b3f0f8007fa4f50e53b9ec7aab24ec37458b0e19577f43e5db14e1404442ab2076a3f5c7113768401712df5c54425cc9cbd424ceeb51c0657f73cbb3dd379fe2795f2d04a7d2d0e459a234708030e55e5ba3ac2423e536101d80bc9d83a7ca3a663ed923e619969da7274da48e4ebb152b817fec6aaa25de7bf977593cadce8356056bd2685077653dbb44d561cebd33f3304111d6f15c18c9ec0154b8759c1644198a805422b28cd4421fcd564070ca3e97c343c782226ed24179d1d306f71155ea9d3cf9cc7488b85172fbe7495e472b553229c523fd224d71bdda1391cfede2e551f11f2c6056ddc0c6f2dccdadecf0b9de8f1aad408253c5bee4f5c8ad097318102e53a7e1fc7d60948032b565d2436584691beceee19300f957f76db4c43b3142eb1b15b4d6725d5f8b89f2eb1e7d6254cbf02f8c62093634fd91f22a539e1bc838173bb141ee6b3ca8f0778e1fea20040be3bcc81bb79e03fd7c01c42cba2a14776e7dd33ad29647eb4a807bcfed8e659a83ccc86ebb0f8d0e65ca7c5906dce521cd42901b97371480b791a3a888219c07fd730373306264f59936b1034eac7de43877cc5e122067faa3d1252d4450c88e12454e6a783e6e6634912ba2d2fba9629ea578ac089902e81230ca200d74a22c82c7cd3cd95a7b649f7798b623b05c7f1fd9bce49c56f969e7d94b3b70796c8b7a07f5ea49b6a39449931325f865640b7fffa05e412c2f0988177f5a4b185abc47b4c8a73b01911889cc71f04147b63532cc5b46741d840eb3520268c294dc4b4a489c11f2129d1d0f17b345e1d27a2747be4801c0ec5a9cc3f2a5a4d0d0ed85f2ff37c5a331b86afb24a84210e22084b0d9cb1cd5a318ae2269390ab7c8446bf6b263ae4fb4d68c2df6a0f272e35676d2ec0cdf819a6ce150c293472e2aabd0738da80f8f62eaf2b757741d07b52644dacd585d1564d3e5257e940da6fbd1a0ca6f87eadecebdeaa16e0b8c6c1e74afa7a9e2f692c5e3fdb4f0a7572351e7130dc383f4a57ff33f96e1b4202678470b7df92d0af81e30dc325daa8ce664c133707cf285d09dabb1de83f09055fbf9c1ad2d94c92d6984f9d5ba5d51bdbca82b8da26e72a0bbfd02107f29d544e9555388bc3d81f8adfc7961e8149d4673707b5830efa8b832f8989f823fe54d1385fb78aa9e7ad2b80479ebbc04a4fec06294d587419bc77ed04f6470fb18bde1ff412dd3fbb42638b1eb2061f7eca8954b3b709fba5e1ccffb101bd72d743cf9b46081ab88d50cae3f607e19151d55c7ae46a55e4f1515b698fdd47a163263f763c30c24ce967bcb0adb6946775e3d0cc10901a2e910fb196250e7eaab4e37ba723f1e9daa5a8026ba086a1d3df91ad2b8f77b70189e051fd448c73149ad340973b5559edf1a2bbaffaad03a893c42c280447f806d5d6d5d14ca12e460f9386448faaa3dda04a638984e8303b134e01d8a0c06fc980c079cd0b98b015c304c661f46d1064e760ca2a31033daa03649e716d71b56f917dc73129cf1fa9e374da3f3905515148bffb19be071eabdb05eba9e00036d95e731754d4e0dfee2fc0a63cbe19375e682c7f6875867e3cb4731179d47f5f57b37b6b7503bb8915238335eca7e08cbe62f7ca1ddae621e3fef081844fea81ebd7be8aacc4e78325ef7f0cfeff505ee5f0f0170525bef791fe702507c55c243ea72c8343606ff118887415e9072e2ccbfbfb314c785b920f462177c2669f2814cf90e57b2e7ff0a10b0dc71488ae388509a397101240b5b7878d7e0dae642feae6e7d16acb602455791f268075a12d8dd82c241433948a7f106f50a04136a3227b9d364223abc8e8f1e5354cd32b6e9f22ad2ea9985a932598081347a2c0a54faf4f5ffe23af2e7fbc6af90f393d04861f1350d5045f99c86859b0fd6640c489ae529aa627a64617a12ab587b4c2d9736c250b66f22096a509fb8b38f598402e8863ec5f997d890b81031866b2603337774e4b330b224cc2f98aca4da22aef8749e6175397d30a2038c028e14bca946998f34ec24b80b7cd75cb75264c47d4689278dd1c0b6cceb92ddc80292aa29bdf810ab7a205668f6fe301c8d9a01119d2bdb8eae24e35ce795305bccdca8157a5759a84eb73100152765788bb8eee9329d6650d16fd59f218ddc6f3aa3e60b1194293a88f115fc79a4959eb37108fdfbe8d99c25922a24f3f529c1674a23b0158ca8df8d6d8d57f988aaf00b4c49a2ce87f84aa63361b6f3df8d89f5e9d0cae96e26aef5aab2747c233d892fd572133da5cf4f49d762295a95bfe9e40a80a1e74d411dc2f8e67d15965b3035648248c5a43d5e206ffa23669a9d06d8f96060d278f429e2d52c7278c601f7475d867cfc4a53e8f75022acc3047c3b9f342f38c384734ffc55ab68ed526147a18e17293f2dca04813b31b7ed79e1c08234f83a63c9511d152a27999733c3f5654987a0a4f4afc8fcb5d8e8ba2f318fe70ca3cdf7cca77d6c5c87019bd69d499fcb84c7d2f53f03759c30635f0c17346781bddc48429fd6a22d5e4fbe08902cec90652af5845d5d708ff1278500e5f42e2654d4bcbb9cee63aa4c4b18560da5e7d13ca4fd0e9bff92756c9768aa641c39962fd1f369c06a4bcb3ebc2f6bb76d64dc2cce7957ec3d5bacacf8cb0d15a5908ae74af1c068109283200a1b608ac9eef774b2c8a020a540fcb4740d34e9affe671a6b3bef7628f8a5182c7de71cd2800404b45bc76ef40b1cc8136d3e7692eada2dceddee7f60383c49be32489f8c12034178d3a9ae1eb277b90ce300fdbac3eebcae60017e8074a4449b078d32944fdcb8fa23e9071717ad02b751a76449608c4dba1719d962f9aedaa51753dbd56909bb9b41952d1db7e98d290528d92c5d5c74cb60622a2c272da8ad3abcc36a992cfe03666fd0709659fa4ae29bd093be96b92223062fd77ec7f7e825b61d738e2f37f10098494b12470633e049b1d98190e6b6fb56b7e9b7c37582bfcd22efd4277f626e59b992d9216a604a0bdaf2104ae73d63a291742f70a9259c61abc9179987e233cb5c8da3bca713004421f21311a8893f707fad13cd54aefcb825f5fb470ae9f2333a1d5c595b0b0c0a7112bc51cfed238176649ebe904436aac7a5675dee6b74ac3dc8379b65a454f132849692a428c514c7701698f4cfa33e31331f453781529e609eef6ec8ab36a5930a8eb03c8b721712eaed431f7b7e539faba6e6084a046a01d0b21b5a9da9948e7a0a98427e20b5e52a7262517a7c676f7bba7485b3f92a66ab6758e495261b7c469e916761ccb88de59bbdf2917da59036dd46365e17d2ce2b8d56afb2175645047f31fc2fbda815b5a79948a2097e9251a50657b8ac3a592c86e726d58fd7028a709104c8a50d2f5cbf38702868db38c6827674ddc2c000020321972e268255daef6b6d449dcfb9c038ef07c06a0de909c34fb5a598da7011238065bc5961d45e8b2b18fd52b39e85e89a168b76c378d5eee81f484410bfd1104ab65c514c5058304ea8df2cddbdcf4c57a58104debb207b0b456dc9e5ba076ccb0d02038cee2f9a39b07271c9c65944089a45925378140f92659752e10c1e06b5568db9f4e58a85d4b5e53884cb390cfcd98de64920a17e4c111528ced497a12b6f347b7a2133697623e6b577abdb50acf4ec2359b0cc23578b8a4bd4d0a4939e754439e2eff1c22a014d77f035c7da67fcc605f32cae0e3acd3ec5ebc5cc9e34c34ecbe3aaf0ae19d1b71ad66781592e95619153429bb66e946a38"}, &(0x7f0000000040)=0x1024) getsockopt$inet_opts(r2, 0x0, 0x400000000000009, &(0x7f0000937fed)=""/16, &(0x7f000021affc)=0xd7) [ 388.557316] binder_alloc: 26771: binder_alloc_buf, no vma [ 388.562467] binder: BINDER_SET_CONTEXT_MGR already set [ 388.562476] binder: 26777:26785 ioctl 40046207 0 returned -16 [ 388.590098] binder_alloc: 26771: binder_alloc_buf, no vma 13:55:11 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) fchdir(0xffffffffffffffff) r1 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x800) accept4$packet(0xffffffffffffff9c, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000240)=0x14, 0x80000) getresuid(&(0x7f0000000280)=0x0, &(0x7f00000002c0), &(0x7f0000000300)) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000340)={{{@in6=@loopback, @in6, 0x4e24, 0x0, 0x4e21, 0x0, 0xa, 0x80, 0x20, 0x2f, r2, r3}, {0xffffffff, 0x31, 0x0, 0x3, 0x7f, 0x1, 0x7fff, 0x6}, {0x3, 0xffffffffffffffff, 0x8, 0x2}, 0x6, 0x6e6bb2, 0x1, 0x0, 0x2, 0x3}, {{@in6=@mcast2, 0x4d6, 0xff}, 0x2, @in6=@dev={0xfe, 0x80, [], 0x19}, 0x3504, 0x2, 0x0, 0x3, 0x426, 0x6, 0x45}}, 0xe8) sendmmsg(r0, &(0x7f0000008600)=[{{0x0, 0x0, &(0x7f0000003140)}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) ioctl$RTC_IRQP_READ(r1, 0x8008700b, &(0x7f0000000180)) bind$unix(r0, &(0x7f0000000040)=@abs={0x0, 0x0, 0x4e21}, 0x6e) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000000c0)='ip6gre0\x00') getdents(r1, &(0x7f0000000140)=""/52, 0x34) 13:55:11 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0a26c8079a613c6e715070") r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/load\x00', 0x2, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x0, 0x0) ioctl$TIOCSCTTY(r2, 0x540e, 0x6) finit_module(r2, &(0x7f0000000080)='%&wlan1{em0\x00', 0x1) write$selinux_load(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="8cff7cf900005345"], 0x8) [ 388.595258] binder: 26771:26780 transaction failed 29189/-3, size 24-8 line 3136 [ 388.596719] binder: 26771:26780 ERROR: BC_REGISTER_LOOPER called without request [ 388.612920] binder: 26777:26795 ERROR: BC_REGISTER_LOOPER called without request [ 388.613497] binder: 26777:26795 got transaction to invalid handle 13:55:11 executing program 2: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000280)=0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKIOOPT(0xffffffffffffffff, 0x1279, &(0x7f0000000180)) getitimer(0x1, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000200)={0x1, 0x70, 0x0, 0x7, 0x1000, 0x6, 0x0, 0x100000001, 0x200, 0x2, 0x9, 0x8, 0x2, 0x469e, 0x1, 0x1fc5, 0x6, 0xffffffffffff8a60, 0x7, 0x608c, 0x4, 0x100, 0xff, 0x0, 0x4, 0x2, 0x8000, 0x2, 0x100000001, 0x6, 0x7, 0x6, 0x4, 0x1, 0x1, 0xf8, 0xfffffffffffffffa, 0x2, 0x0, 0x7, 0x0, @perf_bp={&(0x7f00000001c0), 0x8}, 0x1, 0x100, 0x9, 0x0, 0x2, 0x7, 0x1}) r1 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0x0, 0x101}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x0, 0x4011, r1, 0x0) write$selinux_user(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="73797374656d5f753a6f626a6563745f723a6e65747574696c735f657865635f743a73302073746166665f750015061d4564b397e1aa4beaf61d53c80024c20ac21e5290b3c250f8289c02c8ec5efc3450d01a027f4b84bd1e948858820f3cede64e401fcc15e936f7b09ca706bd553bb0b7e533cc1a2edd6412f925afd864fa9042cfefe862296d1117b3f2e709a1fec1377c7183afef0f84e125fa07cf3b33e887edeec17dd07243eebe17547a6395c4d6c6a61cb02d2aaf078d6e1ed3d289933005f1220f45c7626a42aa0e9fe329d1da33fc0b070540f58d12ffeafff0c90e385bbc8f78e636b3db61da65542707ec42018f5187e4b2b22e34aff933a1686056"], 0x2d) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000380)='threaded\x00', 0xfffffd96) [ 388.613506] binder: 26777:26795 transaction failed 29201/-22, size 0-0 line 3013 [ 388.655089] binder: 26771:26796 got transaction to invalid handle [ 388.655100] binder: 26771:26796 transaction failed 29201/-22, size 0-0 line 3013 [ 388.696028] binder: 26777:26785 transaction failed 29189/-3, size 24-8 line 3136 [ 388.719081] binder: BINDER_SET_CONTEXT_MGR already set [ 388.724530] binder: 26777:26795 ioctl 40046207 0 returned -16 13:55:11 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) accept$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast2}, &(0x7f0000000100)=0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') write$UHID_INPUT2(r1, &(0x7f0000000080), 0x6) [ 388.731054] binder_alloc: 26771: binder_alloc_buf, no vma [ 388.731073] binder: 26777:26799 transaction failed 29189/-3, size 24-8 line 3136 [ 388.731157] binder: 26777:26785 ERROR: BC_REGISTER_LOOPER called without request [ 388.731199] binder: 26777:26799 got transaction to invalid handle [ 388.731207] binder: 26777:26799 transaction failed 29201/-22, size 0-0 line 3013 [ 388.731857] binder: undelivered TRANSACTION_ERROR: 29189 [ 388.731884] binder: undelivered TRANSACTION_ERROR: 29201 [ 388.731922] binder: undelivered TRANSACTION_ERROR: 29189 13:55:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="0000008002000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000580)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) r4 = getgid() ioctl$TUNSETGROUP(r3, 0x400454ce, r4) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000280)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x30, 0x18, &(0x7f00000000c0)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x1}, @flat={0x0, 0x10a, r1, 0x2}], &(0x7f0000000180)=[0x0, 0x78, 0x30]}, 0x800}}], 0xf9, 0x0, &(0x7f0000000480)="5d9f1f7ca240f08a9935259a3dde7ead7253770b5939636cf57149f78b7aa4f5f53ff7996c989a1334767bd98b8af2a1be37ef8c081be34dd13b072be378a1a152d2e06c612d31aac537ed74934316d2e7be34af220766e2008d50bd52e1ebb5a2611565f584b88228459429f40b4640a485ce04a38d929e523a9dc3c772ad2a21c5ac6163918e558ff3d7a7bfb877189640dd6e037fb397a31ac66eb5f73b537f63eee5bd4e479dff9ae540acb9b462b2451c0e124d7c5d8db40b102ece453daf574a5c1cd285a252402ac2490cdf48b1236d91168a47b2384e3e3b8e2ce6a7198b765624e5058f29a3ff55abce86b17ee0390548bd6a9344"}) [ 388.833367] binder: undelivered TRANSACTION_ERROR: 29201 13:55:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x400, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000280)=0xc) sendmsg$nl_route(r2, &(0x7f00000003c0)={&(0x7f0000000180), 0xc, &(0x7f00000002c0)={&(0x7f0000000480)=@ipv4_newroute={0x98, 0x18, 0x30, 0x70bd28, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x8, 0x900}, [@RTA_PRIORITY={0x8}, @RTA_ENCAP={0x74, 0x16, @nested={0x70, 0x87, [@typed={0x8, 0x8a, @u32=0x7}, @typed={0x8, 0x3d, @uid=r3}, @generic="e739e4bcf3623f255f8ff8c5e12f32d9e5d69fd0b46fdc409fbff16229b14c388be4f19ce6b0f2b49232ebab3a8864d75f7b4fa10f35bc7b3d0d993f564b68d291cb7eb2028ff63f31da2c5915c71e7a0f0bc9d46d2cd4f9836cbd"]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:11 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0x8200) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000100)=0x17, 0x4) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f00000000c0)=0xe8) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000140)=r3) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000240)=@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@loopback]}, 0x18) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) 13:55:11 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0x8200) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000100)=0x17, 0x4) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f00000000c0)=0xe8) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000140)=r3) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000240)=@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@loopback]}, 0x18) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) [ 388.983701] binder: BINDER_SET_CONTEXT_MGR already set [ 388.989274] binder: 26818:26822 ioctl 40046207 0 returned -16 [ 389.005046] binder_alloc: 26771: binder_alloc_buf, no vma [ 389.011058] binder: 26818:26822 transaction failed 29189/-3, size 24-8 line 3136 [ 389.019531] binder: 26818:26822 ERROR: BC_REGISTER_LOOPER called without request [ 389.064997] binder: 26818:26828 got transaction to invalid handle [ 389.071591] binder: 26818:26828 transaction failed 29201/-22, size 0-0 line 3013 13:55:12 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:12 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x2}, 0x7) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) wait4(0x0, &(0x7f00000003c0), 0x80000000, 0x0) 13:55:12 executing program 7: r0 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pktcdvd/control\x00', 0x2400fe, 0x0) openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r0, 0x111, 0x5, 0x0, 0x4) syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0x8000e800, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb28906d6b66732e666174000204010a7900000000f801", 0x17}], 0x0, &(0x7f00000014c0)=ANY=[@ANYBLOB="6e6f646f74732c0037b4af717ffc876e23351e9307cdc265eda9115a000049d4c2ec5e55364c7fee72ce5f5b0bcd3697c5836b0c1355b1a12679b774d822051c300d774d0fa4d9a9c555eeb73e1964a9663dbc561aa5728075ee2d7e84a9c89dad"]) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000001540)="233315b23cb868707b88139108949eae82f1c39fe3e368ea8b60d6088481052afdabfb983e9c216383e4c299e538697ea5e3f9713d473ca6746109beb7a0ea60e5a140b27e888d7725cab0ddb00270ecb2c9e4a21b092b0de0248fd919a10d129daa0a966481321829446752c15876005bf837231e4121bbd73c537e079c07629ef7992c0c732ced805ddc129eb8648f1c462fcb834ec32d5fb0b3697c7e7080306b016ca1411142aa7e16550e3448318334790891d6ee268f01ee39c40c4dbfb77e032bc977125b6aab8662a36f21a8c967dcdbed0a4eb937f9001e9d75ea51ab76e37718f0453c2cc15b6da67ba80e25046cf71643093e19dab27657db37ec") pwritev(r0, &(0x7f0000001440)=[{&(0x7f0000000180)="c54c3d35bf65737b2159100835e9bd46b8c81bfe8a96843daf0bffb9dc4ef0af429312b21a8d3daea034a468a7580950f7c94e9f3adf4e6836aebb6ede401ad346c757ed42147f0bc72306cafd75ed13113ef3a5be0094bfc6f8566e603f84516ec15b", 0x63}, {&(0x7f0000000400)="c154a333542a3e56f80f645d2425f5b7ef2fb06fbf752f18d421bcc129f1a9e9cd59355b3dfe90de95496440a0ff5142dec6b683fa375e2b93ff8940d04cb330e6901dc27f686e689619937d5f0afd72a98e2238880268a4ed0a80fd74954c709448f4c54db40e45dbbf071c4dc20155d1b4842ba85078570b0255108476842f6a06f868c7ee1bab5d501b1df5838b127ac2dc8815aa21caebda2907c809a0cf4b08ed391cf0e2452dc1a10612738541aeba3a51c12af790459565346df739ad08041909b6b10141c2822270f1412236370c28ad3524a1506ca9bbf5b463dc55af1f3d38d298656fb81f15e17e10ed62b2762446ddd746d67d04381c4fff1e900dcf5de230fcca62e91d444b5bd13483d9e7959eb49a7589414c3c3df3e25d162f5211efc9fb1f423a9e5db94676506881d9e50296c8972643414e8c88c4f41637844efd9f42e3e0ecef59f6fcd13d0ad48d33a627406705a1de95662ab399d212475bc9385667409c21d502cb82be9ad8d491c28d93755845dfc44b8e18d2efc3044e5c6ea8a5ec014c7e881124883d6d2f1ab29a45cf13892a2e809d709a4c1c3d14d372f70a6f1fd2eea225361cebf0d0d27ff1894e5161eefc65e3eac77b5c276a7f0828a548cd006305ddc1cb23471891a158052996def9bff68c86152c21592cbcf52fa2b2893a5ab74484e7f302fc4b0b2558b5ae1a1be5611eb3d053d52e987e57e50c2f93c4bd00384e8ab4154b7e68e1ead91953985fd85d0decc1c18888c9421c42ce939144068c931d3c659789bfab38d95f5c0ee5241133b965e78da0090860c50c1357538c802e82f5aaf74a46540ea223653e5e1a514f3fff5f77c187d166966014063cba8c206b8901c2b61b3e676f3b6259e3fff4756c8bf40e30cec11e710aa1a920654bdf5bb1b579884893cdd339ec8b8d4ed5c4556ece8bf1991a09ad652c1da78d8a9ae343db3e759dd5da9bf87aa0cf623771a6b133e4962033ffce2910690b4927e440982fe05212d08180b04a2210e87b62f0352a4080588f74b087e7f916b47a179890effde1416717f98d8db24123c1e45432fcef3568fc089de270bc21f7d5a4f57f0d107f5aa94f7652c5f9f92bf871fb93b82f55341ae32b9b9b7609501a804423cde936bdeee46dae774e86f86a69e8cc5ba2d05c5810a7917f72ef6335fe966bdc0cd47de04e3743114c73a38c9ebf90c408d97b431e718b40a989b9ec86d319e7f416752247f0d7ad5143309ce9369adc13b180165daaa9dabf12297545dded65d910c6965944b54cf036a92940f592350477288b77adc02845818a1f13cf29fc013119da820e4f44c284d140246df68a3607aef43d1b381950a39be5f60c7f85c4a724b3a8571409d5b49a62fad4039d7d3dc0bb766d81fdc8ab210d04a05e6544f21b9e5e883ab11579b4251564b5ce04d154387287195f7b556659ddcf4403ce6e27f24a59ffd16c2205e29d1f51a6789088824f97435228fed7ecc39443ab4ad0ad39437a09955a6d95d730ad657dfaa62bec9097f6e9d206cb7d515ceac9a7aef6b40dbfc2ad64d30e1605526c99758b2b63ed7eca08cf4dabf11752d4db4270bb651d37c4249f82e6c7d84795a26fbd599265158369f158cfc3b9259b3266d35db8f0bd06b8bfe4245d2eaac57b05e218265c66580d9f7cb6d7ac35a089804bcb362e9a12fe8660d3d95f132ea1bd89028070e32355817c10f1abad6fb84151451663787d91fd4f98115181008db593684225b3f9be2a3aff79bdab8a7d25c6d18d8faf590c8b1680e662736ee957de0d244cc4b55759a2044f09583ff344a1a72ed46a01ba2fde8cd8ff8f032899efa226c1746a68dcb649ea22354e32f88b610903ffe16663107a39ddf9bf842ba25f21eaca6103ab0fe8ac6fc09c635f3b0e43e61d24a92af5c7afd18458dafe10aafe52ef2f7ece5ca9b20b845f7d18cf347bd93f43c401fb451decaa0b0331778a9e91b8d33a2df09d670bfc157ed82cac3eff148dd1f0eac238ac86813d02c22b6d5f823c78a8221922f49a87d14f83c3675da078a580430954963cf9a863fb8eeaa7badabc87404c59ad79fa23b733ac4a7048907599b219f9284589826ac168a3c00d523ca427c5ddee3fe6da9e7b2ac187dbffe9f4d364406f50e18ff44e52483b4fd89f8e153694b68c6f701b71b890329b0877dc2be228bcffe375fbf295e4490c84515ecbc382e47f14c8d0bea24b7dd57e3f1d761844bf26d3cc6fb946d77685fda911841e7fda3c5e03774641bda9247c767d6034fd10248ea034b37481ca007da0fe914fa57f168727492602f55852c19ca0d43f46d15c2ad80ea15284121d926cc3d8e809b2305555d3deb0ce189b4d2da8c2c7cd1471790f2504193cd5f5fd5fd7bb681394974f28ecf977382d212fa14cb6381e746133fc5c7be7b0e528a847f22c3420a76b183c191e61ab216cde7a3f6e0725a1421b69e111c5125ff3b182cd6975d31fc378f055c77a5960c7c51121c884f388b3baecbdb6a28728e0e89f66abab117510d961dac08480e34d4d5e0061ef95a7e42e2dfa1ef1297356f18af3ec1d8ed62cb825c74009f95cc79d81a1f6dc1504e50dca5b3900c8fe7793a87a1df0d6ef49a3f9934046d586d09188c0926b80f24925b6e1846a8d815e7cd61881af3e565018d242dce148ebcbbaad7f8a694f34823f2116eb4cc36ac3ba9d52eabe617c208e22636faa5583f383f57d3d12c50371b481f832009a99799ef93d906f378db0d5d84b3447005afa9f28559f6b3997ec714e3897f7ca285ca0fefdf66844a3d4df4ccb91f6c0ef29ecaa43374921cab36e49b3a4bdf264f4a70c6bdcd51321b6c1f3958d4fc426ecc5a26d8fa12259a0017ab38135dadb9c406d343aeb798e0f850970801e0027a08569e26fff424e6eb93d5c69aa2c3abe0ad49f4dba9d0ea108e660a768627103cb8b3c0ce645d460ae23e730e3c906af0442a866d4ca54ebbfab4685fb88a4fd60887cdf5d6026d0d89847e58981245e70209ef626210c62ba41279a149d298ad55801fbaa6c3e39c513c5d8c02b54701d1878420d4ece494b0fdfb836ca99e803d7146b2e7d8850edfedbaa4721da819d957a9bbded0262742bc73af0a9bf15f01b59728d805c1c510a8bbfb51100d89a9db9a444eb501f14ba743b8d501ceaf941d23d3d3aa0cdaceded1e1508de8295af822b41fb51200842286373d68db2224fcf33a9e9859ac6e7f8afc925ba234c9d5ed5a336b9a8c9ed742aba63fc0b3e8d236d5960dbc10ce18557310329d0e777961690a7ad66aad25cbd15cc9919384943a7725bdf2a0ae9f726b9c755238698f4b2df05084c5004eb61894491cbc1250a2d5a5c7e0fd77c62e90c23688c9dc73328f0d2710032b359cc666ccf72bd70818e8bcd063b90b45f19c387f41b15c9451f8a8098f65f8d54ced11df2f2f2bf0f55581233db13a648e08134412c917df405421ec72c49803e227fcdf16c0a5d27e51baf37281856b032c771083bec099d09b0e3d075ef94e66d07a1ddbb85192823f4796e8f402aa6c1fff713d7884c2c919eba5a2ff0105c987399fc617713ed95f1446d06a1017428fe0c502cac5fe03e6a379a5b73111b3fb0231f594ca13cca0f3a232af701846bf5e2c09c093c838cb1fc34ba0ed7737b18212d167a2bafe0375a5a1cb05e7719b07ac14025a42618bb9312a11ea07646ebdfb41bc5f32896d439a609c70385203b64e0d139f55ff5a7e86c031948fd80e934c3edf67f37336a3e412a3d8e1c03f8a02ada475dbd3c2b9a6e0e21f15cc77b348bbfa651d62c645ee0471a46bd3798d7ccf6349a25e320adfdf287592c43682532a2b50e5c526669efa0c49066c8a4a42c628ca9534e072812f1693ff0c5d0f1fcde94ed044775ee1d9688b46da6995c11fbd4fe5c3671c2c2b99e20e3dc8b98e016af9cb75a0e260a472dccbaa3b94e1b99f6f1aeaa83f3a6e132693b65d2bd22404806d16ebfc753ec65ffd1d050b1fcb9f7054681b55f5a37e56b3d11bc12ccb9dedc79c0c752cae1a7fbf58984f6a3c2c5fd56f1dc897b635ed8c2eaf03e2ce390f5d7cf02402ed888164f406ba60301b823c8cbcc8ee16ff73b2e3f8437701f5e5d62b85682aa78e59e9f2e841305ab658c96c7da18a5ecfd994c32cf92ba63238a042f970bc578f81817158fd15811589a04b6316dab304b05a8467c29a38d1b3fc880409ebcd56fe9423966d1b2cf6ae8364c24d76921531d5ccc347416ead20e37df1c0e63a2a6c859b44cc40c11a7d90c8fc70de57d23dc833ec48b4e04bae454b548a49ed55fe7016411cdc57294a4a2f979d65254c86cef3971abbb25f61ed7ca5aba1bbe38e29c03d7daf90e4ae50f82518f3c43804b6dd9722e6c81d31f283afa23ee9b628b2c3c09d0e954050a6d187b2182bbf10494692280581ad5b3934735498f1c65d300c0f7406bd843703342069c9ba2eaa35500648b004fa2f5edd806f0b9d8717ba7232244d4795be1e914b58a3cb850581ab84fb12980d6156dce213534554a74b3fdac90d2e00749a3bfc3aaace3196f5e02f443ec1d048130d9efd8777233d126e4ab5cfadc837b356f69aca2d51d6c692c6e29bfa84fa11ba18b6502a7b07021556d5f4e5e488f4a637a8a1c8493028fd4e9d884b2637e0571eea755ffc4e0141c169082839ee0c774624597252f8c2a6a8a44707a80f0f60863687617e42e3494de9e0d47ce496ddef36cab84fe29a76cf4d3b88dfc4e2c85716f25c5f7edf206358429418030559afdbddc8dbc4568b8d5eae698f1bd657c3e8569af88aca84db83d194f0b845e163bdc2bc286a038d37e1981b3de15def30a5a8801a1bb74a6b16045f755e977a33760289e44ae8d6336effdb256d4a2b0677f6ce3b446e19eaef373ef7e2c0749579d99922e0c5fa43cd87463d5df19a500f18234f969afcaa9f844a541cd4cfd67d1476eae6211aa1c1b7c5939e6348bf213258774bd9bee3f73d42535e668f5b93052ff41fca2f1e727c272e84cbee26e3f03159dab171fa541e9dd4c673437de99d8a1056c279045ba1e9ec2676007131e1b060f72c5913b3c14da62b73d1ae0cc89ca3541fb6908f489df56062989ec570f524d57ddf43100e4606709def49256ec48a17b2cb6928488e325d4e59d3e9b923c74bda979859b5c7b3c94b6de5291d9321c77e61af87363106ee24eb9d0569a63a422a40fad7828cb98ee983082469d094c0e94e6d41ee218167e2371c626fc8a2a70eb97331f4402bcc4ec1dd2e93b5ee848b0041f070d49a311743c93e7b9fe652fcd56e5a7b1b8d4092220419c936dd84f691455a947e79b2fa653ed20aab8e9558634eef195d73a23faea152ecc76e08e75eb9f69f3aa3ba2b48a2bee859c74f5fa4e81ba08cabc8b0c818c1a221d84fcae0c63925fee5e7d41240f550c0b722b51d3ed4097a11af8d7c9b4b5f43873789f33bbfae5647b7e59c980e2743a3a579768c85653d16fa069a31409dca254dd2bc6ccb6b348de6c7acc9be856b029b6974247140827c3ed4847e3d6c1c2c89f2734bef515dd6c339c1947c9a9be61510cc4b806bb3159dbc141267cdb998c4c8f98e26505251ac57309a0a70b95f63f15ca6bfe5f62486c18212fa3b4b8cf9229c0811ab835bf22402ba33c99c30a90966841385619cd0128af19bea9409f9d024c70665a90ceb3fc2c7bca9d35294df51a759aa09dd112d2ddb316bfee6777b9bc24eca3ecabddd46169821281bd", 0x1000}, {&(0x7f0000000100)="24de135871d742ec0b27c580b3a8d3993627f61eddaad5310d730f4f1c8634c65705a738a0bcab7aa8f557c4ba", 0x2d}, {&(0x7f0000000200)="d66def699ad0884e83c9ddd93d68f50f66dfa790201a4ae47413f9d2e1b536dc487f908bc93b1d2d82d7e2181e794e6cfcd108b69400b013a4596573895b1d5047ddfc65b3ca8e24f45c66ffdcd0348e316370d2d07895a94d7de6d193df005cba14b942e611378264ae9835ce28f06a40c099c7c66c2ef9b906608df0ad1123f6a74ef3", 0x84}, {&(0x7f00000002c0)="372e0a57bcc1e02975790cae5bde95f5ca760093bd7d6eb53bf0aa8fdba449c4fc1cbaf806b3224d6244adafc49832f37e66e37f7319d3ea44be34ca3857b3b71bf4839804afa0e95f520feddb68ef60b098fba64aa5e0faca6dc64c2bec5cfb834b7f80f3e1c3e6e276297eddd8aff2e7ccf672a9077c276bef491c004d8fd3cf62fe68c9", 0x85}, {&(0x7f0000000380)="ae10f4b9c45e8440d4f4823899f7a9", 0xf}, {&(0x7f0000001400)="f76afa06489b3b5bbdfe6e9f017f6f55ab312bca39985685c72aaf0ff2", 0x1d}], 0x7, 0x0) 13:55:12 executing program 2: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080)='configfs\x00', 0x0, &(0x7f0000000040)) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) write$binfmt_misc(r0, &(0x7f00000001c0)={'syz0', "404ef7a6ebd7369ab43c755fe9da5b76a0a0344bb6df950272a1ae204c13601234c00e73b5284ca41b7ac9b8e87677d9f57eb930e431c7b4ec8714265a4a9c4de0f51a4f589dd1bd2ef387e56b611885f9ed47128a28c43c9eb228652b95"}, 0x62) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getdents64(r1, &(0x7f00000000c0)=""/227, 0x18) lseek(r1, 0x0, 0x0) 13:55:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x400, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000280)=0xc) sendmsg$nl_route(r2, &(0x7f00000003c0)={&(0x7f0000000180), 0xc, &(0x7f00000002c0)={&(0x7f0000000480)=@ipv4_newroute={0x98, 0x18, 0x30, 0x70bd28, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x8, 0x900}, [@RTA_PRIORITY={0x8}, @RTA_ENCAP={0x74, 0x16, @nested={0x70, 0x87, [@typed={0x8, 0x8a, @u32=0x7}, @typed={0x8, 0x3d, @uid=r3}, @generic="e739e4bcf3623f255f8ff8c5e12f32d9e5d69fd0b46fdc409fbff16229b14c388be4f19ce6b0f2b49232ebab3a8864d75f7b4fa10f35bc7b3d0d993f564b68d291cb7eb2028ff63f31da2c5915c71e7a0f0bc9d46d2cd4f9836cbd"]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:12 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x9) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0xa00, 0x0) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=@ipv4_newrule={0x20, 0x20, 0x401}, 0x20}}, 0x0) 13:55:12 executing program 7: open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0xa2000, 0x0) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f00000003c0)) r1 = perf_event_open(&(0x7f0000000340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x1) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000140)=0x526, 0x17) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000240)={0x400, 0x7ff, 0xfffffffffffffffa, 0x170000, 0x81, 0x6}) ftruncate(r3, 0x80003) sendfile(r2, r3, &(0x7f0000000080), 0x8000fffffffe) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @dev={0xfe, 0x80, [], 0xe}, 0x8}, 0x1c) ioctl$TIOCMBIS(0xffffffffffffffff, 0x5416, &(0x7f0000000280)=0x2) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x1ff) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f00000002c0)) creat(&(0x7f0000000300)='./file0\x00', 0x20) ioctl(r3, 0x2, &(0x7f0000000180)="0130dd468dc156e2f179459be3a6b5f61c6512e6e0776946f9386bd49119c6bf9481e4d875a638e200fa26d2abc26164bc71d6cddc131bfca1f6646f8871cdb148b5a66c8c51e49944ae7e72b9b2ab280ba9d7a2a5eb7803b0744dbfb9d6352976556768e13a6eb704dcd36ba7c86f569e58c09846c981e219e9634f936991ede4a125e4dd5fe7dfcefd167151786b46") syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010400)="1020f5f20100070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000016000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, &(0x7f0000000240)=ANY=[]) fcntl$setlease(0xffffffffffffffff, 0x400, 0x3) [ 389.352492] binder: undelivered TRANSACTION_ERROR: 29189 [ 389.361211] binder: undelivered TRANSACTION_ERROR: 29201 13:55:12 executing program 2: r0 = socket$inet6(0xa, 0x807, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000480)={{{@in=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@broadcast}}, &(0x7f0000000400)=0xe8) connect$packet(r1, &(0x7f0000000580)={0x11, 0xc, r2, 0x1, 0x1ff, 0x6, @local}, 0x14) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r3, 0x2, 0x1) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) write$P9_RREAD(r4, &(0x7f00000001c0)={0xa8, 0x75, 0x1, {0x9d, "6ed8ae040907971e4b7770cd5db75dacb9b5d130caede36e279bf86950ecffdc01f8744d0c98cbb2a4b6cb0f21bfe071dd11f2ea2fd6ab1db17ef18fd0fe170dd857650de81c714f13dc1ef5a591ad6aab13caf17a25297401359909ef9d42810a77c64a972df7fc1a3e599b024a12c407bfb0b5cdec342b6b57c924dce55135c9c22cef7ec594790723eb4fd82f7219bef93df5bad7d649c743ac3288"}}, 0xa8) sendto$inet6(r5, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$PERF_EVENT_IOC_DISABLE(r6, 0x2401, 0x2) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x2007fff) sendfile(r6, r7, &(0x7f0000d83ff8), 0x8000fffffffe) 13:55:12 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x2}, 0x7) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) wait4(0x0, &(0x7f00000003c0), 0x80000000, 0x0) [ 389.414314] netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. [ 389.448706] netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. [ 389.451043] binder_alloc: 26841: binder_alloc_buf, no vma 13:55:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x400, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000280)=0xc) sendmsg$nl_route(r2, &(0x7f00000003c0)={&(0x7f0000000180), 0xc, &(0x7f00000002c0)={&(0x7f0000000480)=@ipv4_newroute={0x98, 0x18, 0x30, 0x70bd28, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x8, 0x900}, [@RTA_PRIORITY={0x8}, @RTA_ENCAP={0x74, 0x16, @nested={0x70, 0x87, [@typed={0x8, 0x8a, @u32=0x7}, @typed={0x8, 0x3d, @uid=r3}, @generic="e739e4bcf3623f255f8ff8c5e12f32d9e5d69fd0b46fdc409fbff16229b14c388be4f19ce6b0f2b49232ebab3a8864d75f7b4fa10f35bc7b3d0d993f564b68d291cb7eb2028ff63f31da2c5915c71e7a0f0bc9d46d2cd4f9836cbd"]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:12 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x9) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0xa00, 0x0) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=@ipv4_newrule={0x20, 0x20, 0x401}, 0x20}}, 0x0) [ 389.451061] binder: 26841:26847 transaction failed 29189/-3, size 24-8 line 3136 [ 389.451138] binder: 26841:26847 ERROR: BC_REGISTER_LOOPER called without request [ 389.496942] binder: 26841:26848 got transaction to invalid handle [ 389.503444] binder: 26841:26848 transaction failed 29201/-22, size 0-0 line 3013 13:55:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000d08ff7)='/dev/sg#\x00', 0x0, 0x81) fcntl$getownex(r1, 0x10, &(0x7f0000000000)) ioprio_get$pid(0x2, 0x0) gettid() pause() close(r0) [ 389.621752] netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. [ 389.776685] binder: BINDER_SET_CONTEXT_MGR already set [ 389.782298] binder: 26818:26828 ioctl 40046207 0 returned -16 [ 389.788999] binder_alloc: 26841: binder_alloc_buf, no vma [ 389.794939] binder: 26818:26868 ERROR: BC_REGISTER_LOOPER called without request [ 389.795148] binder: 26818:26868 got transaction to invalid handle [ 389.795157] binder: 26818:26868 transaction failed 29201/-22, size 0-0 line 3013 [ 389.818352] binder_alloc: 26841: binder_alloc_buf, no vma 13:55:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup3(r1, r0, 0x80000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="da780000"], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x8f, 0x0, &(0x7f0000000480)="8b41a4c017512cded7dcd0f90037ccf3f7bd0897c955017eab03b32369f549843c244f546d399476ee155b546b22f1ffd3445bfd42f9a9fdf1814517b011ccdd172ad61a9fb0fd533340ae29de438f69fbf5a18edc12f24f175dc2feee078f61c4968de44599534f2bcc00c7dfae4839ee9375052dc08c50668018980f923b9296762a1c9eaac76426fd8757bb21de"}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x20000, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f0000000540)={0x323ed993, 0x0, 'client0\x00', 0x3, "1aa2370c92193dfd", "1c07848ecdf68222af75c3b2b972979ab4ad182cd5f71e1ac47177317176ac80", 0x9, 0x5}) 13:55:12 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x2}, 0x7) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) wait4(0x0, &(0x7f00000003c0), 0x80000000, 0x0) 13:55:12 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip_vs\x00') process_vm_writev(0x0, &(0x7f0000000080), 0x52d, &(0x7f0000002f00)=[{&(0x7f0000002e40)=""/147, 0x5e}], 0x0, 0x0) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000000c0)={0xa, &(0x7f0000000000)=[{0x10000, 0x80000000, 0x40, 0x30ab8a8f}, {0x21a, 0x9, 0x6, 0x5}, {0x1, 0x9, 0x800}, {0x6a7, 0x8001, 0xf3, 0x100000000}, {0x2, 0x0, 0xff, 0x4}, {0x10001, 0xff, 0x8, 0x200}, {0x9a4, 0x81, 0x20, 0x8}, {0x7, 0xbed, 0xfeb, 0x80}, {0x8, 0x4, 0x3ff, 0xd4}, {0x4, 0x8000, 0x4, 0x9}]}, 0x10) setsockopt$inet_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000001100), 0x4) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) setsockopt$packet_buf(r0, 0x107, 0x16, &(0x7f0000000100)="ed972c4ac8c078e6a798b6478ee0e094ea14c4ce1dd5d438eb90ac22811128d2e5e54131d5cf5df11037dcedf1c4c33aaec4b082731e412cdfbd4cf2ad1b85b3a92e0590421098477e072d7a0d9667da73dc74c0915dae741443663944ab3769064637ce0a5c80d8b9a7af9cf12f2eb13b22a2fdda6e0268a11b1ad1c23768256fdaf25132dd163a255bc5b5f1a2b151f1159750bf0a9441b8dffcd4c12edfd6aa057d0e6d1089d5075771dfdf94911ebaa320f372e20f080e947f702b23cadda5bd1dbf155b8afb39c424e8cd0b058062567a59574a10010b401cf9f4a348a433d59120610ca5a38930f2e869801c2218e14b6fa6c654bde5f3ddeb6495f45e811733535035e6cd3e6544e58eb33dfe8ead66c7334ce50d83b843c580a33e4e1e1f46f1a0f8d72bbb68eb6cebf728054f42bf154b843ef052aa90918299144c00672306cfa8aa07f62725f46ff43da6610e4019ecb511cf77fadaec5e19e1490f1aba6051724b68bc839b134b70c9c4ca17737bb28f378739986575d0132d00901036743879bdc21034857b784b2e6e29bed710a4becb881206bbd7f0dab60290082ab89afa3662cb5339b14f50676c0c23679556293421ecf5e82e6b3cd791648532cc44da3fcfdee477ee73635a732617ce1f07e145d6842850bdbc0bd39ba340357e25f9f1dd7c8b4b01dcbce188b8795e667b2bd17c9e0f985557c1102437719ea8b0a635c1926073dc628f2fe2d67338639a82d127cc5c3420ba86e32b4bd1e71ce0b18377f98fc8ca0b90a9ad2fd993755a0f692b40c44eb4883f29ce46a6986524040bac31e326f3bb1f9f36c454c20d29d63208d55ce6416e535e2b3d8d5909da649cb8672e4169cc3eaecc5dd4e8d83526aa36f868a51c257343aeaa0b49484a0f8148bf15855739944edcc54093aa9279a69c805c273396fefed79d2e4e19203c06498f4081c96e57b429df04c8bb15496e4ba5328c7e5c86ba6db344f271f2d702edc99b91d95e99ed12b306820d3b4743e0eaf8b63925dc89ca4d186901fc1d1c6a314ade41606d5dc5b03a90f589ba3ba9bc78600d30bb928c8d3587cc770400d9d410ee77eae9e0cbc75864108bbfaf445512d19eff2d6dd59ff3334ebf247e0becf044022cc0064681c62a3e67f0b38eb71589bd6e5335dc83c0f9f58200b2f35b32acb835a56241b091163f2c79c1f0a00fcf8b88b07d204df7a713420fa4706d1a4175f4ac52ecd8a3548d55bf711f71aaf3c20c0b8ccceba4c588d10d51669fe3d590134e7893f0692194cd8900d3f24fa707f14ee04e44e84762523c809dc3a5509728d4a460e6de473acf320b7d446a2cdfe24fa1c44399641a2d61b12ace4146d7ef254b848526bfa4002a5f3b852e1162ec8c9a7e23ea7abb86f80953156f732f85544bb28824280ebfc8a52e71ed22cf1b166fedcddbf32befc01c07fdf629af5e98289faff4cbdef5ab26edcebc3e59b3c17b4451fa24a9ebcb8f8d28cd00450159a093ed6e123a3004fa03343cae010dff5ba986b744503858ce2f1a0217667950dced56e1277521537c5102f488047946ca9ab24f3ac6e5623a545113eb321ab8935494855b4195143670cca23afbfbd8d79ebebfc0353ed8366baf3a75fe52b5b8bca67e191f973a38922aed985ed03d1cbe3a89ce4699d83632b7194263279085a5a207f67039854456f9aae7bfeb86ffe1ee40e8229f6beb73ab86d3f91e901cff982c729a40d898aa93745e6b4b32d4f590cf6e0ab482721e510b864bf73b685fbeb6950c352c9589af3da30a2d842be9e0d73e494ac612356ef2b69027d03f4ff1959608755e0bc2398a7485361806dbe3a266beb6f898ef8960969df3a1d42e4bd3075ff02eac7986df0726218b23edab566f0f574c6e2c4d127e0e6e6bc50ce417accd0b74018ba87a1048220bdc6923deae9e79222c5161f16b72ed5a1192f3175fc58694a6906622b2ea5f888e3347c7d31a661320236111a466bc021e5964e9fe2726f267ed8139f7e35287913c7da0749b204a2d94c4d7a5ce03337ecd5050c8fbbf5bc9d74286a4cb13a5b1d29d4a1a397fddf5b2703a1fdc6b3d73d78543cd3ee1108b5d1d9e48e004aa5d07a35db543a8923f378d680571b9c3c6c55fb1643b94b555656ef8137799d789ac480618e849b5c9592f00d5cbded1e412c728110d7b564356a09bd199e0c89483e856b0c46a2689da04806164ab819c8c01a34667e815331e1e9ac283298d1ff719c58f8e58f981c2e9fa0e8c7a6d3dac12d4642fd7fd7adf196fe29924de5892e8d7439c8d277bff81d12a6ee04aab8c5eefbca3499f10fb0ea04b1f33689f628c17c04b911522cf5e6767b444ff1b7ba15a01031e601754601012b26617aba510a93a377ff52281f0999f70342e75e81ea41595ef9c9b30884cdb1f14cdce301c8a16ae5dfaaf1beb2db9bf84a7f94558f88bb04eb64ec254aa361bb443db319745780c17177c3a97929d9b95bd670486bc7d4d7ee024692526c6d5afd682004e2ef7fd14cbe80d7eb15b3a081e7d2bb43f76516d8e0cc20316c0c152ddb3d252b04ab17967c9efdd7494f029fcc82caf5af1f09d03d01c4f62ebad967f772d5b70aefbe95b348529a4e6b9be91eddeaeafd2c4baed8331ff8c043b10a6561e83511daff5e933e9d2d000096a642d4a287ee0b8fa99eab589f6566086e6268e2ec4ad729be28f995ba43d3ec00797ea369477b0793d8ea8ae658e893f68edc7d2116959508d8c6467de1f811d2b2490bcbd7645ab8180cafb00e1c17c109899c6cc438fb71beefd22f4bfc97a265fc1477c509d43048b163d9d18184712da410d2c12f1c46edaafd3f911f21dd29c401b966d9eff7e05fd738e76ef2327f9e4a4fa589d97ac75e841caf4ca092da3d2511729b758dea22a93237d6fe0b9f11a75ce78f62f63417cfd23f22cfec6b5391620ee2cc104c4e68e2554989b86046b8a649e9982dc3a5e8554d4a5705d44d7dec0ac42b13ec0a27e3d1c7f91473e36e4c6971c7a8446b232d558e20df5b91e46955e9906393fd384a469e1d2fee716a1d8434adf8474ee35eb5a02e223722832752b9588cf01ad341e2766cbdfffb1afc622d0aafbff78a3bdf109f67d14009b37404056ca6da6d44977435f76bd0c670059046d2781029b256fc20c279cf68883708c2ec717fc9e6d13f2321988ecd907c7e2b266d4e97ea5515d18628e7c9b0f2f3152dbc23ac0e6ac770ac977ade955cded9321fff59713ffaa1d980f1788ba90473a33dcfd351cea0998d75dc05d68c687b108f98d584de20116d9ff4913017fc6ad7d259627333ea76fdaf84c7f8e2d05433e3e5b792bc1ea56028a8a2807b11c7aa6465f854c2a837bf35e9305d6bdc00d994c3f54d977259e0e73f2755b1804ab86474ac8f296abc0c0c80cce9146d701cf281d47199492dd9a2b967092c9e14eafa1c3512198f1815951ce98e07014f1bc552b521ad7e6f8b9bdad60828adcbd2d2dff05a8f802b04c9b9851b9e7362989b43f76d453e2a88dc1e68b48b9539e57dd0af9f286f6a932b6cbba35f50b6fbd6172a0dcabd4fac903bf8051b8411f400f834e0d2f91c5052a618d04687fbede3f2a18df67caa22e59346a609a796f14ecfaf679d57bbab532d6e3cb4948632831fff1f4e5642ff899a53cae050a8c3d1f372a71662914f11a0d7526f34335872cf98f38255b790c1b13e2ec2d2c83493cb2eaef1ae4124fe62f8581a549c8ef8f872a7a1733b01fc6afab2f8d169fb0c4df62d14957df8f29e9c1ee514767ec03446dbb1e957175fade2cbcbd08dcc5b6b6429cb22f19e206b5fb0f2c4bbd880e261725c6094fc6302f8e45232253b15fd3686f9a692d37efa274f79e046104df5fd45d8a05f8696be22daf53ed6f695d38e4dfb625e08fa363bfcf9398d7124612f554f5681a1b5be840e5cb7ddb706b9690c84377b4fa7bb385a221623d1fb9b2404016250eda06c599ce45bf4a2b8514739023c741603bc135c36407a0f0168820653be1a257acba595358780f7a24d06c05e7177db8e572ad0390b77060269edc7cce7e8ca26eb61ca557461ef8c1ede03caf2f24f1ba0468b0dac14e823ed3c5e999387c21676ee916c8df7ca5ecc4a31583b00b0edf231872b73f1f983d1d2d44d36031ded93deb40b4fec48c822b77ab628e6f69c1796d5ac101461b212fe203860831a46d2ebcac2ba6f203e8937341a841fcad5a36064c0631bb9ff1b3addf943978a12a64fd8dfc4a8ba84ea7526b094bc6c1753974748754bc9886a552787294c00b2514f688b0e14778d597348e4576c16beaf4c9b1fabc3a309cbdb168ae3c3071a7db35107fdf8f6a1ebe5a3943c672a972577f80046f48fe6bfbe9c772cb540246c609ee17035f7dfb107aa65be414592366f04e5fc83671edc5ad18d9e2e1807765c46645b0f87fe474ab0b0d9484b604fcbb842516255e22d9cc4706525e7e262565032949d53a7d344c9a6554eeaff84a3a335e2c08aea4deb98979b2a8a4b41bd21e7c437c3ecf688e936ee7524cec4e63df84ea85f18612649d06dc9b8b7da4669a87454b83cd0c1ffde8985718d3f2af62f6f395828b130d8a755961c35d06669462a5e1807f5385f63773c9a28beb524ed463368fedbb6271007bc0c09fa1f6327c641a734fc94104a88c76c6c0212322d46d6a569fedbdfa97953df29b7939ecd34e6e9904042c4bd2dc7320141cd3d415e1e36ecaf31ce53e3b2fdd8ca007d36d74d8a6374fdb9fed525af76606969c86ef15a690f1646f0e76006f41634cbccc3b39a1077d8ef0908ddc5d33fd08e5c882cfb13224b5c2311b6e8a7c9dca00447042aa739569ef0f47b2993f5ce9c90bc93aecc29e9a887c07ac9a69519e92ac6ea72d7f10e3a0a1f76a8e17611f62d6eda3a3ddace55d11fa8ac00208f4ba25a3e246de664e14cc2bcd558fe654405cd5c7895693f6b93565babe87bd087841739981472f28903a806740e775781dd3823d1f9dac9858576952a2df762c074d99f0b9ba6566c5ff70e582390cfcb833c37f3ca331cdc80cda30e3f57dce4ec8c77153e9122e653c94429829a1c53f1d8fed5f4db1e4c1854a7e9e8511a9cf1ea08a31161c5e253005fca51700148e282a0d5f4b89c84e33ad5e800b5c8f467ece68ea3ec57faae6d0e1ea640a154779076cd55fb9e63d2dc1ff8439690e88c458edee708d5df889a3c5e1e1fc1ecf6f8d6eada65c5ddbbb634af960494a00cc6b4736fc3d45f66c9161d0015aa0fe5ae2df94f22c29bc838378e2f3dbc86413cf6c881888b7f2f296b08ebcbd8d19d04a020420abae54662baaf47bf5e97d8a311045bea32e5b0d2414b309c1f167a54a213d6000b8a242e3251b5bb993f46050c00c882c3f063fa9b53ef14255b0f1d38b76cb1e026da19afb6227a0a783fd7f474d49c22eb56163f204d6a5e0c4425d49fc66f79da4be9d579f9e8f3528e5ff106db3d2a81c354eec0989d7607d33553077ec798d5fa0f1c59c470d3291f3429d5c298d8d71daaa741fa12e7e63b3e82407d7fbbf173f24c37c639df7e995e7a070d98b05b819a1e113a00c3e2369a7c7b8e28c729c33b8815281e9cf8b444833a6fd81fb4a2e155bb0fff6e6d1f0e211d82761ad536c6c01a2344e166d399384e711801db94a5fe0ace0fcc190e7e2809faccd4be90e61202d2c87bed18a12f4759a899abd9c18c4e95064bef547c51ed3e3582bab63babf7d04a8539dd54c77a04e43a15a9aad713c7d7b", 0x1000) [ 389.824292] binder: 26818:26870 transaction failed 29189/-3, size 48-24 line 3136 [ 389.832735] binder: 26818:26828 transaction failed 29189/-3, size 24-8 line 3136 [ 389.841036] binder: undelivered TRANSACTION_ERROR: 29189 [ 389.846593] binder: undelivered TRANSACTION_ERROR: 29189 [ 389.866299] binder: undelivered TRANSACTION_ERROR: 29201 [ 389.949251] binder: BINDER_SET_CONTEXT_MGR already set [ 389.954687] binder: 26877:26879 ioctl 40046207 0 returned -16 [ 389.962072] binder_alloc: 26841: binder_alloc_buf, no vma [ 389.967685] binder: 26877:26879 transaction failed 29189/-3, size 24-8 line 3136 [ 389.976167] binder: 26877:26879 got transaction to invalid handle [ 389.982456] binder: 26877:26879 transaction failed 29201/-22, size 0-0 line 3013 [ 389.992588] binder: BINDER_SET_CONTEXT_MGR already set [ 389.998084] binder: 26877:26879 ioctl 40046207 0 returned -16 [ 389.998537] binder_alloc: 26841: binder_alloc_buf, no vma [ 389.998555] binder: 26877:26880 transaction failed 29189/-3, size 24-8 line 3136 [ 390.002783] binder: 26877:26881 got transaction to invalid handle [ 390.002792] binder: 26877:26881 transaction failed 29201/-22, size 0-0 line 3013 [ 390.249747] binder: undelivered TRANSACTION_ERROR: 29189 [ 390.258311] binder: undelivered TRANSACTION_ERROR: 29201 [ 391.621408] IPVS: Creating netns size=2536 id=51 [ 391.794162] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 391.807647] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 391.864664] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 391.878670] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 391.936691] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 391.951404] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 391.966177] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 391.982380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 392.630845] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 392.665660] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 392.671847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 392.679289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 13:55:16 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x2}, 0x7) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) wait4(0x0, &(0x7f00000003c0), 0x80000000, 0x0) 13:55:16 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x800, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000200)={{0x8001}}) 13:55:16 executing program 5: r0 = socket$inet6(0xa, 0x801, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffc000/0x4000)=nil, 0x1000}, &(0x7f00000001c0)=0xffffffffffffffdf) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000080)={{0xa, 0x4e20, 0x8000, @remote}, {0xa, 0x0, 0x3}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}, 0x5c) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) pipe2(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000300)={0x5d, 0xeb5, 0x100000001, 'queue0\x00', 0x14e0}) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000100)={{0xa, 0x4e23, 0x2, @remote, 0xffff}, {0xa, 0x4e24, 0x3f, @mcast1, 0x4}, 0x0, [0x8, 0x1000, 0x6, 0x3f, 0x0, 0x8, 0x0, 0x10001]}, 0x5c) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x800, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f0000000200)={'filter\x00', 0x9b, "648b608ffb1b11294e983dc48ac1d8a5a6ae7fb5e069cd770024de128f651845df2f394e8c0c2670607ce7b1582676d4ffcdc556d83a158b6e99fa43646b8032f96b35690bc741109a89892ecf2b3bb446c36c59193f91e432cbbb4a4239f8a90b0c5a6b2fa7d959516aa83bc7e20ed566d181a29ada09dfc0e028cae89b9f50c6c3e59bc0c803bdacb8fd3e10630f7d33c0a47421a205b7ab2099"}, &(0x7f0000000180)=0xbf) 13:55:16 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x6) sendto$inet6(r0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c) socket$inet6(0xa, 0x3, 0xdc9) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x0) signalfd(r1, &(0x7f0000000080), 0x8) write$binfmt_elf64(r0, &(0x7f00000001c0)={{0x7f, 0x45, 0x4c, 0x46, 0x1, 0x400, 0xfb5, 0x1000, 0x8, 0x3, 0x6, 0xbd6, 0x173, 0x40, 0x16b, 0x2, 0x6, 0x38, 0x1, 0x3ff, 0x4, 0x7ff}, [{0x6474e557, 0xc7, 0x3, 0x1000000, 0x8, 0x2, 0x1, 0x2}, {0x7, 0x6, 0x7fffffff, 0xc18e, 0x8, 0x1, 0x72, 0x8}], "9853bee890dcf896b673b61aa867f570657cf50991b4bb67ab0da42016a4214e307fae88555c615ea059e7", [[], [], [], [], [], [], [], [], [], []]}, 0xadb) 13:55:16 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000180015000000000008000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000180)=0xc) ptrace$peek(0x2, r2, &(0x7f00000001c0)) 13:55:16 executing program 1: r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) getdents64(r0, &(0x7f00000000c0)=""/127, 0xffffffffffffff44) r1 = socket$inet6(0xa, 0x1000000000002, 0x4000) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") mknodat(r0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000340)=""/54, 0x36) 13:55:16 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0xfffffffffffffffe) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0x40a85321, &(0x7f0000000400)={0x0, 0x0, 0x0, "71756575653100000000000000000000001f00"}) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x202100}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x120, r2, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffffffffff81}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x10001}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7fffffff}, @IPVS_DEST_ATTR_WEIGHT={0x8}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1f}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x401}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syzkaller0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x19}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x0, 0x0) ioctl$TCSBRK(r3, 0x5409, 0x401) 13:55:16 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000000)={0x0, 0x0, 0xffffffffffffff97}) mkdir(&(0x7f0000000100)='./file0\x00', 0x48) syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000140)='./file1\x00', 0x1000, 0x2, &(0x7f0000001240)=[{&(0x7f00000001c0)="0684ed93de18f8e6d3891dbeaa7e074a8aabb04e81060a6744e575d7ce60f8c1d6f8be57b8f86b16d4f43ad4f08de48ae99fc218e194ddee304712d0436aaa2b1c41006f5b33803aa28c06c5729c59693278d3f04c81c07dca90352c83d7eefcbb2146e64fdf0d0fac9a67d427c4d7749dcd78040cf09f3cb190a5d7a81e63bda9b0754f02aaf3e820085def7c83b5c569cd5705b72c1badc314a58aa192a6462ca4c9a5ec697908313ae8f289ba3ae68a25c2e5b70b07cc26bc42639e7c770c6578cff2103725bd37246444ef1d5a53e62d72fc1f5dc309050171234ff7b548cab1ed6f416333146dab96b9ed582c37f53e495cdbfe761aaf57e906516d2c4993d4b377f2e549ab8d2b0b35d8469c65b5bb95508dfb20738aef6d0c46979135fea44d41c0c927ca665d266b3979971fc389d6cb24572b562ae699b011a10d6528876c28cc7d2437f9b683141676fabc712d8b69b71a41253d32ee7cce17783480089e54ace2d1efe9409a931fd35d4225b329944239ead70614626b2187608f0d2b0292301585c191039aff59060bfea35b36d1dbbb2ed7d7837def7fa935c5468fb748d6986806f2e0ff7cedc64806527973d30f9cce27806ea8dac902bd8a367ed728826cb1e69f5c816dfa3d78c2d9c51ceae36f72c1ee35f47d950866a29fd00ec82b1dd56501bd913729ccc5fcd3b579279766f5b6be66fc39488819d763fd600ea66756f31b352791300289da5bf94233ddfbbeb4b88b89259e13dc6459bb17a3d87a59568109adb022fda1647d5cf9003e23735ecbe02f63651276b0e64821a6ebd995c5755ef6346b3e45f283b000afc9e575f75951dd8b9d65e300405ec16982af0015ae5bf198fbd56102df30571f5bb74915d45e1769f41895343be30be18cae50becc41e952f806124a2ecf43e3260d03b509a4d4dd690331273fa3cb91055bf5d064de49ef8bd812683e1a8004c997153296270d8354dbc203279960c3b21cac7bc2e843d09ea0775b57af83e41821a963774434298c5efa22734e141e95d65792ca4b2571004bcecf6ff6d6c5f547ca987aa64833c9d013f2a19d5a6691116e27f1a75986f4826fa4fc25e2171aae337daf5d99c50da80eef522beb526b02b9f5d91cd07943f867c291cbb836009b845f58f32dfca8d7466b156bcb3a647238e009629a1dbc92496bee30a4fda562f3441c5f6547a29887d9c63727f395139103236487b5d239cb98bbd6af4f64a3238b041c6738308c0b60a72d7218e88381af72fbca50e28b3759be12ae2f39b8057aa566f2faf4066b3ad19af810614b45fc6c8cb9eb5464bfa255ca0d82ac46813303525b1707030c9370dc6f2ce69a86ff7331bb2c57b21ee8b7502da3fc9df4b28f24536557ff3084865941b3f99ee33b6711438d2f975c9e7daa20f0dac4ae2f15473aa51a3510145f273ead5e5e4dbc78792336f912d6666c147169025f38ef9699822288b10da622d34e6584cb95d2da30cb9403866ae7b46f16cfc1ddc4a72bce996581a99b06939f94e353d501851cea2a56c96ed41a208f9363a15a28f747059be3a5d569ad694e3e4b64fc550e7a43f0964a2c72e2d2096b04ee53c8498ead8a26c9af9e2454d27987cabefaa594b1cc8935d1f089bda02db13c5ce14d90a25e2f63593b1da2dfb99a08ce7d7ad99c9a5d383af8efead14ac2f5d6429e4e491856503764ff0116348f32ad5c308ff4eb56ed6806ecc4c8fccae42fb05a5e8a9aaf44ede65acbc332ba524c5cc1f478774c6b6a495f53ca3d68c1fd53ecdf3befad9061be9c41493b254cd095120d5e36c57d2d9e4f2edf2b08447391e3e486fd7712bb16feffccd72485aedafad7d96a21c3ff0d6455a5b866872d2e0c170e5957f2fea9dd36c88eaba619708ef2513f9ab14f790bfc69658a2a1d6e7b2c651df326dc6076b77bf524740f811a9fa08c8f66147a65d34c6658fa987a056c1309fe3e581bc50ebe5cd607a749a1655e26cd1f30712ff00c087a234e1d5298c1ae75617c3d05f488db9223743ceaaf2abf1ac2adc52a4e47dc5efcfc1399da3fe43df5bf13bf2712c4dfd587d96603d6feeb901bd01fd5b16699335638604cf62d1ce2f8c9ad1937e1e44d65df235528db7d3b7b46a46c7af26b7357c70127e6726b52d7a41afa4bda9eb307fabf79992644114f0414664ecbe86ccd04986568763dc98ac00f2c9d0c12a3ca7304159fb2542930a3cd4e2d70d3c17a606a1f2a3fc220f38493be9659b1046a69951e5b9c89ee4f9c278756b96870544885d52df659d0c264d8333b17c3e877d9e7f54f9b1605fd42cc8a29e5f783adfe17b321c2154173ba9c3921b1eb248f6b543537a70d85a840cf34248e1eb4cb4e746fffc4a776bb3605cf84ef5b5024d33a3dc21877e336975e9488ec7dec4c6b83f04a0e65f02b5a2e798c92415a510b8eddcad52e6968a2e6c89217b3339ed068138dfdc89a2e4025f14f3930572dfbcd12188062eed281864e47e81d402fb370c6b4583ed67799e9842514fb3af0d2a09ec243aba54ac78fec440ed074f6a6490992ef777b764e062a9bdefe95c8fd938d50be63a6cf7685d72868f0425325d18faf4ff741108b6f9081e7c2201d3b55e29677ab2c6a52d75efbfe1aaf585748d10e082cebadecde70c37c0538056755e40cf374866e1192b75f445b37795bbd6df2c7add21bfb4299624d6ba55ea8d6f11e4285144ed81041f1883919529c82638f8f9a0c2e867698c2d03437245941c6ae9a76f7efc6336f350e1979bea0ffa05ab63f5343ac4fd98aac608c6e660b247cda747a6a912e7be0e58cd9d45677a1e7c91387842db0a425681e5a7c3f36c7395b1cf80c5e3031fac95d7e7580938fc08ee2df2bd8760f2ad90b917d19629b85cf1aeb9ba1e730618410f74e8aace082ff396ab80aeea1b124e4574e5ca91f087d80934c9524b891341154cd29498aba6da15b6f7d8fbcb80db65622777bf96a2c8a7388b5f7e983ec5a1ae71f623b5501c982d0844c233999b221a918d1e2f8521a7cefc1522d3cabe9d23c9eccbe5a4abcfe477d3e30c471e726aa7e705d2046f1de76e94a6f0a350ee506c8c70131e0637998e296a69ba38da382e8badd00197eeaa9560dcd512b40887faa2f6fbc086a385bc7fa6f86f8f79152a5954f3b71bc3c96103778bf81300d8b861a2ce6911ce73506ca502ccb091c45298caf49f44fbcc75362d532431de9a9f1af358ce0d1d72f112eb52156198252b0bd56a7387119768a6dfefba7c658fd0109ada9ebbf4546ca1b74c2a3de6202dc6777b5b168a10d9ed380b964578228b670371dd017aed3718773f1c18c3f509a3b620b1d5b73ddf6ccd6a4d64ee509923d2f51a903020d71391dfe7e274bec88bd247f00a6144960719131090ea8c7f32163d16fcd90cbf6ecee0c3a40b2d0d02c1d7dbdf08b75cc556699b4b43a4b7b0d20ac17880169e67acb57cd562c205cab5d78dc0ccdcc704191a5b552e6fbcabac8e62c042bd687c6d14a566346efd58f3b62308fd949ee7f59b3e13071ec10128717e944d837d8aa99c52a278fb56178386f6ca66bbf4548bbd965e45cb8c78d1c3ee4007d423eeb25a5677b4243ebb75ecf02d8c09e638063c43bcfd7225250180de68cb5c5c564f7aa5b3435be082585871d6529d77545fb5a4f7cb3b97a7e4f40c938eccfbe43f8e9d7bfd4c15e7ea99239c9230d04a3823c4e4001bfe429fcf0edfd864c5305f7b0b068cbff6b2dc3ff6c959ea4f5a19ba10f7576d599684023b86b5f1e380122b515615c05711329e052021a26efae7d221e8f0edb1a5ae78a1e19600804880e73500bd6b2c775784d378b11b761d0feb8b2e73d4b8397005e415fdd5219947a2b57d7fcfeccacb21b01a8f4ed29b5027d3329a0e5bc93e9851e2fd656871e43cb9a07daef5d6e32ce08c8bac28148b5cfd40f2e577c63a918d2e53f4d55ece35f6609664573a58d36bdceaad4500b3d50e6f0fbec725a73663a3a338899d2075cbccc227db8a18c8ac92222c6fd3d2378db69c0bbd8350c17a4049a30a1c572c6646bc1dd4629c8448f86ff403193763c06c169c571940a8a6411f8353bbac5d856d093b17c3ad13462067410b951009f770865cd0818d6afbeb2dc69bf69643e7f7178523d101ef18b5a78fdf1b8ba860d98891376a930faf700d58bad63a03fae5de0a9177c6505e592f656d5db2de4c1361468f0f7c72250399882f17ece7cdffed4c509a716010555a93dc3aac58439009ff01f2f7e21e89173ebd917c13dbee5f97111d911a776a9a4a3aceeb8f87fd55356fd7d1a4a570a31a03c4ca0822500308a02dadb85259fb1af8fe79199b24c0531ff3b8cb93ae8a5319a225693b42cdfd07baebca4f513842108f286e88c2db9329040b876cea25afb7196034da06a1e223411a478bd0fc4e0795d9ed8aac123896a6268ac450dc83d2c5738ddb74805547dcf640d6225b05cb59e7e00a72ef3e5019547b7c118cc3974b0fc5cd3acc66ef28ea0f314e88951aebac4b3bb332bf2d18d50e82978293741eaa29246e15ae8911f3c6ac31b0eda2f2f9fef80af1cc4d3136d53026cde495ccc8cdd4c8d358096b3f633b8efdd8d248c1fddf256d46d2d49cbcf6c6474e13fe560dbe696061103490fd02303b7639a573ae0cdccc114cbf8632fc1d7b2a92bba61080355881acc76ca51d568c193713b04526a634cb42103391ce402f1ca430912e970ae4bd1deb1568d622fd5cfe79d9f89bc54119c646534dad4cc6a0c404bbd20f0671d17a0c30ec03e8964db442665d75dcec29b85dd29775dfc5d1acc5dbd05e11106962ff798257befe1194969a71fcdb33578aff1359e4796ad492ebdfa3acdcaabab868e1f11dae4deca779829d8c594689fa3fea544f8af192b172080281e7d10711c99d1e06e28b95bcab726a853afa7cb7c9caaa07bbc504994f408f6bf136199fea448d05a767d989b5c6b03e5b25a3d996c62b4e694589cf788cb9f4f6aa9127d4c3a5729e5626599fa6c6d736faa7cba334407d1f98f65c63a97e83dad76d89031fe49c1b72e8785599f233f18be781294981b8b6eebb2113fb7e4513e28555b38043e728d3fb575098e4ce9109f6b015dd33f1ed61aafe6a9db5d6fb6c52375760dab84786f16faf8433df644bd1a95bb0d66cb702aa128e4a88bd88e59c57660634e160facec015df66f52e64206d2bbb1d30e20217c3b9ffd5b4bad84b1266b952bb2ccb7b53cb4a5876887fd3beb3f04eeb335e04f607be5ca42e4b69cb048776354bc909288b6f82bea42067ad4844516ed3666e5b20395def15903249ae0a90cc52c1806e813f5b024b3f8632f465c0ae827b0f24998b83fafac214dcc3960779d6fe60657bc3c86d27a5c7a9fce3463cf531ca3503b8cb34fce573b9cf79d0723e0d3be9566291798597249ebfe8400b5a0018a541136ecb07498552b08c7510a68fb0f3f301da93a25ab569e270871a3e66f7f9bd5e574e2f021a2b4102ef643d639b5062089a92a30ca911cd9a5ce8237229ad15c0147937e5f8a915f0de3ce8c039bdc2d3712ee24427bc8af7d485108d9f0f51347671e9db821b829481303e4ef0819db29bab05d49e9165a466af71cd8f701f9d596ee859e9efffa00427717102475c652439905803c79dabfd45fb1d65cef45bcda3df1d935716caac105cf50b04f5a22639127d1b315d07ff0a3737547c3e34ec37ad05e7ff14e5837eec7f1288a73707dd3184cc54c717e5927b69afe27d8", 0x1000, 0x5}, {&(0x7f00000011c0)="1370aea28c89afe65b76e4e062f699d4d8469719c4732968b39d5ce92bf9f370ee34cfdf7732389ce6bf151c9f0bb232c18ebdade56205f3970acf6c13e33729a2d97e3156054c0879084359e48d6ddcd5f918fff0d23c00ef9e09c657a0085bc21a236785b0bfa7f3707f415f52f6711e2a7a9851b93f14", 0x78, 0xfffffffffffffffd}], 0x800000, &(0x7f0000001280)={[{@dots='dots'}]}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000040)={0xc0, 0x66, 0xb5c, {0x0, 0x989680}, 0x4abd, 0xffffffffffff30fa}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) 13:55:16 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$evdev(&(0x7f0000000340)='/dev/input/event#\x00', 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snapshot\x00', 0x80, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x0, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000280), &(0x7f00000002c0)) ioctl$EVIOCGKEY(r1, 0x80404518, &(0x7f0000000040)=""/141) [ 393.067654] binder_alloc: 27266: binder_alloc_buf size 2251799813685272 failed, no address space [ 393.070668] binder: BINDER_SET_CONTEXT_MGR already set [ 393.070676] binder: 27263:27273 ioctl 40046207 0 returned -16 [ 393.089306] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 393.099629] binder: 27263:27273 ERROR: BC_REGISTER_LOOPER called without request 13:55:16 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x2}, 0x7) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) 13:55:16 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) fadvise64(r0, 0x2, 0x4, 0x3) 13:55:16 executing program 1: r0 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffa) mq_unlink(&(0x7f0000000180)='logon\x00') add_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040), &(0x7f0000000080)='7', 0x1, r0) r1 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000140)) [ 393.112083] binder: 27266:27271 transaction failed 29201/-28, size 2251799813685269-0 line 3136 [ 393.122846] binder_alloc: 27263: binder_alloc_buf, no vma [ 393.122867] binder: 27266:27281 transaction failed 29189/-3, size 0-0 line 3136 [ 393.142175] binder: BINDER_SET_CONTEXT_MGR already set [ 393.147600] binder: 27266:27282 ioctl 40046207 0 returned -16 [ 393.153618] binder: 27263:27283 got transaction to invalid handle [ 393.153630] binder: 27263:27283 transaction failed 29201/-22, size 0-0 line 3013 [ 393.168899] binder_alloc: 27266: binder_alloc_buf, no vma [ 393.168978] binder: 27266:27281 got transaction to invalid handle [ 393.168987] binder: 27266:27281 transaction failed 29201/-22, size 0-0 line 3013 [ 393.172496] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.172534] binder: send failed reply for transaction 679 to 27263:27273 [ 393.172549] binder: undelivered TRANSACTION_ERROR: 29201 [ 393.206918] binder: 27266:27271 transaction failed 29189/-3, size 2251799813685269-0 line 3136 13:55:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x240000, 0x100) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r2, 0x80045301, &(0x7f0000000180)) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) getsockopt$inet6_tcp_int(r2, 0x6, 0x1d, &(0x7f0000000280), &(0x7f00000002c0)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 393.216224] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.225651] binder: undelivered TRANSACTION_ERROR: 29201 13:55:16 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8911, &(0x7f0000000140)="0a5cc80700f75f8571d0f09d046a3acbf7ed6df501856c433e43dc50125972111915c6edfe4e53601e76b6d8f2db100e7cf448ee436aaba79ebfbbac02d12fd45b34af2066b1a17db789d0f755c54c8d3639b9797bbb1e65b9fb655560125ba8bf72437166442d500211c5f03bddfb43d01c659442004a6eee57422b6de54e09102f4a53747b88daaf470ec754b4745d380f52d4e2a3e7878c4aece07292f7228835828d4b650ad7dcbdf45a111d612cec70d0df782e19e0d40a79043fbe053b31932240cb36258473e5958bfd1be4c17b8d9b2d7c9d88c33006") r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000640)={'veth0_to_bond\x00', 0x0}) getsockname(r0, &(0x7f00000009c0)=@can={0x1d, 0x0}, &(0x7f0000000a40)=0x80) recvmsg(r0, &(0x7f0000005580)={&(0x7f0000005440)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000005540)=[{&(0x7f00000054c0)=""/71, 0x47}], 0x1, 0x0, 0x0, 0x3f}, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000008280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000082c0)=0x14) sendmmsg(r1, &(0x7f0000008980)=[{{&(0x7f0000000680)=@hci={0x1f, r2, 0x3}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000700)="d22cb2487fc869c3fa413d66951173b293450243a1f186884768b548954c", 0x1e}, {&(0x7f0000000740)="df30acf2e0f32dcda0c31be6884161bef02041bd6c91fc3fcf72d829f67ddb45e253d69d0c0b45ba5ddbb16bea677f3765a11d241b1a231f181df9d698ac4a41a6393cee3fddb68ee174d26a66dc6cb3c9b9da66c1a4b7b04278a2de1c5e06bfabbe4ad32a2d8c9ad9a57f0b224d9bfc7399d8dd7b77b131ca053459e899c25d81153a90dfbd32a4b0c76132024cf596202493e57e98dc33b95d2427949d42d80af9aa995013c657dd925ae05d794d0e56a159ace4b3560e4706e77402608265611fd8c6865982de024aaef064a7c24a6379cc6548a6b8e53b5b1e1dca320de7ebe331f4d20bd726d08d3e6ab850", 0xee}, {&(0x7f0000000840)}], 0x3, 0x0, 0x0, 0x40}, 0xffffffffffff3a44}, {{&(0x7f0000000a80)=@ll={0x11, 0xd, r3, 0x1, 0xe22, 0x6, @local}, 0x80, &(0x7f0000000ec0)=[{&(0x7f0000000b00)="660f48649b974dd10c3df79598ce0f38b910e92ea94802b970f9c514840bd1e08232fae9c8f49fa4201916051829b7ae2588e1e14bd6cf24f696f06097df4b9a651621912b2749fa49ba160cc0703435fa7298fe5e4fbb99ac80200867596b87b411bf8985f1ab21ccc306a46350d916c303d3bf28427b8560cb59f1987785841f101c39333b35dfd583c5cc76b6fef7d9976ddef89ef7f0b225b677be9f969e1d516205ade87e8a4cf47a737f7847df87ad58c48e2d64ce3c46dbc264b0b402dc61b6e3c9c3201eef176a28d7a390", 0xcf}, {&(0x7f0000001040)="bc74f68a135af985741196876dfad69157f779cc202998c15675a883b2e0098d261875ce352fff1f1d5ae959269c7fef214d81a5d2296143cde3ee34236a0a6a55baf1836dc3ff1a8b05615992104d9e4e215de03d8d04fd12eb4b9dcc738729187eb7d8a7254b97000c44d3b9edd295adc9429f3bf711e16328ec9f675223c35c93fcd70d7b1f9755c65bc71e4ce5a1e4da1836c4f0d8bec89a44287f76655d4dbd0aca2b2be70f0ca1bc3245c4ab802ae03f73f1fc55ec226f11a2daf027633b6f23f9def97fb3ffb151674f5b7e03fbe409da6b37cfcd2e9d67a889a4caf806eb24632ffeb91a2bb1ac17303fa9128afa4e5bae52f8b3badfb7f61d0dd82970fff9bbd4bccab83f2b317fb435eb556b35c104e1b5b4a5692867a4cf73e24a94b77ade2d40015e48aff78686fd8ff9f2cedabf32affc6468c312cf9581bb9db9535b6991b55b5515d8ba1504b0a97422a59186110fce2a9023af9f270755cac3ea6e0126f312d277d962450ba9673a8d928cef53228374276ac3a2a770d434b89d3ac85811c3f58684b3735037b9330bc12e9324df875d8fea5e2ad65606f68a128360397d61d183dc1f4ff960f898583685ff69cf4b012612bae6e9f4ea33620c2b154315f2ecdd8207f1ed74553e84cd9a4b42d9433ac90c71c29b8456f19cfa42589605e44fed3604c0141059dbb88f70160e50cb7d21cf15fdf04703ade5492290d734b3c30dac772f7ca12ce946aa3234f0b4924e7d0ca1e77eac0e82c3492e5ffcd167da5be1e7073b6d9134ad9965635db88cf5d9bb2f70ce65843c52b75c082400eb433f2b27c283975e1c539c1d1f89b0a572c03daf5da57abe65e8192fa5e10a95433c26ab1c9afd99adc13db78f2bbeb569471f5c142614378d520360c21f5242a1ce11c4e93f2660f5823a430df2ba5490d875b8d6de5aa10eedfd449b5724f91262f144f13a23f55518e7f3c1ee3d7b73bdcf79ebc3808a10170f0e2d25b5664c0d6ae573d4bb8998fca4ac670d54f75614ca226f431038b2d181a4a8c66270980125d38f0f81263bccb43106496fc4acea325e8437796da699c25a9b41f65fd71ede025ac19bc72d8d24bd148d2c20d5331e4e521fa40468586aa4112e6f6791ffcf73f143fcaf0a67cc249997cb9e9577c38970ab0565971fd2fd946117d2b8a686d35faf78770e36a0130a5b1cb3a622f72145d05cc1cf1b4d58f1db5468e49df1bd649391cf2a9aaa1e115a95b0ff6ba4cb7b907c482d653b1ce5cf2c1dfd183fa6e212b50e2a5c2dc392721bb7aa64e1e0596bfac31a48dea3d4c34d0f6a69928abd8787cec4b47f8456ab254f8a3611916bf98fedb93f86e91ab50110f24c1f1584942aba17a3a3ff6250a9298eb6d10d8ce4a8f04235366d0478d0497ddac73e72a6fc434374ff14c9884ebf00835f4faae61577b04e50156a84aa404788098258e53012c6dc1fc2c46b8cf786ead8c4ec4eabce293ab93a002a8018fe583b0f3bc675e28936f3b5e7ea71aa309e71920e7699ee4b04aa24bb9f7b1b8ccb7c839d8005e11d278fe80be52c94f488bc83c3a6b3255d585931ea3e0ee0c05299269ee7fd4507794e8148a56da3e5f13fd93b10a2139273c8091ae2c1700ce053ab07e821b0f6c7ca9e7a9d5c21f7b847af754896f260e1b836e7925e5ef7d58ca464f1c91717b665fd2d8468c0d0a818f0303745edb7dde424656140688bb1e22e2b69923daff6f61614d86a6a5812a9343c99ccb80d1b03661eb5924af8a07abb4db3449d737d78445fbecd6121f3929e1dcc480b3141b89b6bed826122f1c75189cddb6a8f98421103a8001dfe1702f545d86f4129d5eb4de779d2d905f1cf4c98a8d843cbcee621485521d62dc87aaa534cff27b30ada9b7c495b0aab567100a18f9cd5baff35b06e2a632706be2a01ba17eeab7be0822b2a024504b3d28a16455f6ee1b382156dbe175fe413dfa1eb4642eb659d711d60afb80dffa3b564311c38bfac7b5e9862a1e68057e7cf69c3570c4eb9d0c8c45f00917014c87d8ba65fedc0a52901f5c39103460481eef7d274c0b29833640f57d982ec4d5dc1657d84c1066f8761fcf57ffb113fd4307d5dbea8b2bfa2ea12dbe540f6678297b98b46f2a7f6143ade96d83a6d3dafda80d42748765ee651204d07adce37cab37e4f25a49b0cbfb0c50f47913c0c973483334a19bb94a916815cc604b8f26a1d2d878a6f9387e4cdd54e9d91a3608fd7fe5b3041981b79023ceb9a189e9fb0f507ed515090439bb31fa424ca095c8d0ba51ce7b6074d230a15a035186babb0104082e6ea29b4889aa34796b7f9cbee8c977665f02e981b6cbd16983e2f5e3d4feeddb2bc24759c9127044b20623d9d144772a8b6260bb1258353021c020d23635207445ced6be160b1d0442c26649d84014f4d13131dfe8232df02a0e307571a1596b97106b91282e557fd4625d23e9d9aa18d26d599e3506b16d7416b1d1f27dc8446e058a8876d898d784162ed20c9472fd3dde408d7cd70c528369964133c7ee5c5f05f8e154c4e4ed26f6d9ee0e2a4ae876b9152eaa4d52a7087fac8bd7a62ae9ddd566b8b9f2c9634306e1005135169205627a0a2e733f30430db9c000a924c0f74de0c98f2469baa6779c093439324b9995bc284544f8b91a62b2c4e555d2fe9c22096e5651c1848353669c3b305855b562c538a74e88bc16890ffbcbed8301e3e34f967018e056bba155d27b8f94129b1e3d87f772da44ea62a0e940f15e802458be10be7d6f27d654408cb4d640d1f3308694c648bdbd28931da37279b46afbcf4c6a014f0f1f66285f6e6f9065cd8a5d7a32b30e295100a46c888a2cfb7d94dd350f87cb30cfc589852ec89ea3490949928704ccc891ee9562b6bac70a71d93820d09cd9101c86f3b1a530a0ef2a6778993f324a327d0bfbccb60456028708ddb19b3e699542581c7cef93bd821574f9cf9569e7a12d72b98f0a8bf9e975cc84c3cdb807d0c2e716d8b7681deb99486d3c55db9404d49799f43741193b8c954a61b724963971cceb3c361d189a749a557caad67c1e21d0128a086f03a8ff5efdd10205fc2861c65c920d6bb1a0971b759adfba3ed281e0959c5522ea54b92baf47f8c9e1b516f5803b819392bfc9f0a92afec20870b0ae810f5190cd04bf849e89004f0ab2292cc542066ce9e0037dd540f335d2a893026c0c246d4d6b818fd1a733553342db57348e4ddcf15776d005885767ccfb629ff66bbb63f912f917e007b88211c11b6454df3b06dfcbeba30b181903cac93a2ab76933569a1c764ac319b15d97ca16ef692fb69fbe6ed4e4627bf6a1ffd7195919fe7f5d5bf1e01aff82466df2bf3543a19b9baefee727440d023094b45a643c8d680c7f567a3aaf414e811ac0712bdb7177f2618c01a245aa691c04874d31e1696713ec48027849f10e36ad9fef6138b112eb3d75a5be51d9080f75453c7b6f801ca2a6907297e50c3f1a0413f978f97caec09e5525fe4ee7c79d4db29acf89a84510e766915bfbfa078150839d0414151d4a81e922ca2249c7204ec7b6c8b22cb11de3ffebd3e6bd6bb11c16395434583e87a3f16006afcd699ea62f783d4e081dcf4f2b717bdf9e1636c4c6e4c1b6e0732091b4db06299e74cdf14fdef9be81f841b4bb3ab7aaff75195812ea3f627a25c8c3bc5796c3c505ccbf76e8cacb5bf1a9d38b3c03a2297203b1e2bfaca2de38c71e00a4fb29bd86870326949dcaa6585652b970b06f74edaf19a4d0e157ee3298bd5e80d1b3387080db5d4d8d27a8278c5864030a8ff745a77599c9a55e6e58fac16e5d77721996681e4ebd522ac7cbaed526eb62331596b00756182392383784c09239caf511521aae08f88102edb3efe9c9e1cb38b0aefc23872467aab5ee522971eb2bb178a4de0d7ea56d16ae1d7c4e3ae881b7f34bdd2c77298d15542a2ccf9496f759819d25efeea819f9c0bd616208ba8bb5e7c623806b366dbd7999b161fef562250a8cd83f45879352c63203ed96646f94a2aeb3c8b368fbcf0088652ba4ceb88cfbf2bafbf0a5ecab7eae83062f4de7786b085af002524fff4999ce9b3b020c092a70d9d0ad454f930e99acc020f9bceb216618a8d441f8e2a9e15f261e9523bb878df169d2eefb98b1118932c9c4cb94ccf9ce1895643ce6475eb74ac748f77d0bedf7975cb322bf5ceda656b35e6876f45ff46acd83f0f3b6537aadbc4e3f7f45563b7461ba44a0fa44a6db3acce90c43a26cdb2f24c3f28ae0257beb7c2765a1cca37370b915d111c9caaa2bfa352ccfaf427dfcefee2e39895af1e3e94a5ab002c12268e2890d31f6d0bd422c7bf3989b9149e957919698915bb697f709738d7503e61b2ab016028a7118035af16c2c9bed5bcc499ba86000c3fd105096b95bd2ed8b8f7c2b28801e7c651788b565f8bd0ed12544da44e9f642847625eda4d1f9be7a783f90581d18e8fa1cb6d1aa1f5145a0b57f0c30162f2b51ab27235b6fff676887ddf07aeafba60a60d6401330a0d60444124175ce79d5458a6088909a99b944f1603f88d7e1324276caeb20ff0f9fda56f96600f813fbb6fbbe78260d8b632aff6b5ea75c0cb6241e6cbda45cf46fe045431222d392f1f56c0c80117cc48dca28ac4c6c2a1738998ef5fc2ebb59424d4d2617842a0c9b38f7a36c4eb327cd913b4f0aa5f9d85e71ed562c6ff1700a273a8c74c144b6b762f70d219d45a3399a326a6a8f4a888b25a8533fba1279a89b1a82d5760464b3f3032f0c6a110a995c01296039c5ec5efee592189a0538ff64a50c917f52bcee00fc0ed236f32eacfd794f4eab024b685b3f01ebd57b057a19a0e5fd19e1ce8ad7ef8edbdc36f7808b2858d1c2622a1cc1c60abbc5fa23c82ad173acf10340274ac919533c05eb9cd6ba30cdc0145180048371d8f398e599bba7416f8922968c6d4482c40591c8d04d2fa68c649aa4d42cb0a8a9a99c2634376cf85e0898ab32c4c9421835325e5e42cf40ebc3446cc5bbca37914d1b4add133e558293bae151ffd27662f81ca2f09ef06fe56471c0534e87601a50aea7928b152c42c0f964760ac01cc571b62ce47bd18f2d7f05eb91e23fd009654fb28e58bef66ce57f6ff46691dfc8d176b5fd29543053e74fdf0edfed385bdc195388963bef5799b310ee42e82fecd89cd65b58473e19c376236a203d68026ac2946886551ad5d74c5e01f0424875694a8eeb953460fc0f9462e68e32e0fb086814535cd4c40131d336172d225cc41798e7af57a6fc9c2d0f8fa53ec38e8f5bf914bcc22b9485b7b666e6063a6126baed475001fb37997c920b90a914162ce366e77995cc2bd6a293c5f68f43d3f409a9038ebc055d7338f43eb593ab095558e61862a26510b6ba4d29a2402c42c83be6c49fde836dee6a84fd23d8babda75207bc8d47985660ed886d874f0d0f8617dc01d281f673d39eddaf9894778dc12266260d39bef3b20101f7e10dfebff18629cd8ca7050b5286fca7f9835c9dfe843ac8f33a4f6bc47df3db08068359871ef3d6e4b3e5468541621182cb99048fde4896fd95e4cbff5e8a2d96513d5f05481e0c2e9af0bfaa106fc773aa5371f287d2f31a061819d6f0745855e9bd4f4b0c030170548634fdc72e2234fcbf3ae6c940984c5454387beed9fd80914da5b5827a960226116a3f87f31eb22508164691b0675100e7f8518b4b1ce38037eff263eaf77291ee9dfe48cca087cc8a0f99fe2d712e602fa25e76892b898ebd0e456b3482ef1", 0x1000}, {&(0x7f0000000c00)="2d0cb0bdd3e25c1f54651117080371fe2e70101015a685b8ec3492ad7f9acfe24cb0b825c8a37f7a6a9123e00493f7a547c6c4", 0x33}, {&(0x7f0000000c40)="451d69fb2f380c", 0x7}, {&(0x7f0000000c80)="c8aaac6f66dc7b3ab35800d0cc106e0bafc879f1d685ea7dbf9cf960b272b67f3aa34d0364e47298f669daa25c6966209e028077ea5e81c52d86e86460b3d12df15023b053a2c1fc62136b4450a9c64ed815d951980643e157a2c53794dd02c6e367bf116cf73284312191b646f9b97ac33ddceb0d80c751d2cac03739fabf093826e0be212441dbe094000881", 0x8d}, {&(0x7f0000000d40)="c6740e7418be6051f046d8d7f81109c0c9561e3f7e5ee21ab266122e85a783e444755efdfd17ee3cdba194e2732d5ccc8c", 0x31}, {&(0x7f0000000d80)="bdf6e062e5a5d0d3c5a3e8fe1450aa168ea9731e1d36896e8a0239871827b6eb95f791c91ba7e7e88623a20947dc5c8d4c75ec188dbde0bfba05215cccc4e9ced9d70aaffa41f5b2be8a90be376edfd415504200017dffdfdcbe3d150d56418dae2240a8c276289a1219dc7a472f05a0b1258a3c596268efcb586379918688db3c6d52e4e7c83d09980ec6c1876d1c2c7033d0d2b2a1e8622bcee02873369f8e3e491c189e79aa378a08e32410a7bca0ae9e4e1d779ab9ca9281f3b444f7cf2c91f30d26ad80e21ac7a5c1a8", 0xcc}, {&(0x7f0000000e80)="55f81bc961fa8a54b1d1e982e84457e1d16eb07a15369bf72865005528", 0x1d}], 0x8, 0x0, 0x0, 0x40000}, 0xfffffffffffffffa}, {{&(0x7f0000000f40)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x2, 0x3, 0x0, 0x0, {0xa, 0x4e24, 0x8, @ipv4={[], [], @multicast1}, 0x40}}}, 0x80, &(0x7f0000002180)=[{&(0x7f0000000fc0)="a73b034aa960011e26e60fc5d2193365c53b71d840f594565eda5e9cdc3442cfbf0eb64169c248", 0x27}, {&(0x7f0000002040)="d90971d2beb005a10de1c60e15e35d9d53", 0x11}, {&(0x7f0000002080)="d645187f546ffebf32564f482e15cea5c75c14161152516a4a53dfd9dcd381ef39670d892bcfa2010e592904313939d01a0e4f5017c89cd70f4b0c66f9e832f8de4e3323ff198015ce06955e16a3983c7b99a44b4a09a31283c1b66e04946deeea59d5e3fa4fa47c518fecda06ca7e285992d5c46d79a86f6c23f7ed681c15392bae9230f6abbf48805817f29aed9d95322a088e890a06fb3ef66872d6181109e96f394c6a85b148f0a78c10d28f873b713bba5a38b09caccfd7944d8d8033ad5b7e0f9584db66ce6e2d4e874590e6e8afca78ef45e7ba612cc3126830546cb648b75ea8c4c23889c77dd036eb", 0xed}], 0x3, &(0x7f00000021c0)=[{0x60, 0x10c, 0xd5, "6718bad77cf170e70f5b1c2fb654e52b4c6dcb27567f75ee6dcf6bea6790884efd3731b53870ae0e3871a45dc83d82d810c09897d9a34b052cf65705a7acb1089b1fb6efc3c98e527d2e242d19de"}, {0xc8, 0x11c, 0x101, "ae3bc1be907dbef828bc74b7c2c8a9ecfb2e2d4fdd231e5dcfecd0687bdf5dbe37bdf660395829e49fd845eae0fff2f1dead78411fc4df4f94eaf6629fe532bf35f4db611ed2c12a24f680ba43d2c42e37a85518b691213d699905be2e670879fb79be6f9d276e2a9a3449e4445810525479fda7592c451f76021cf1b35fe00334557b04092477ec46e50f2a59ecc3e3d32e7e456d7999c3f4442275d1e4076eff3219c405859f86edb6ca3d1bba907627"}, {0x50, 0x118, 0x10000, "915d76aa2b3d92b32699045ba2cd602e0d16140b6e3411f08a6c231e407a0a8ae274fdad15360833172f6e9bf733b5d78ed5eb050e47106ef9ee"}, {0x1010, 0x6, 0x3, "3c06f427f4bb6e665f8bc37db5276bf9e5b06d6e170dd8acd3c6cd84d0ccd9dafc3d6579802fb6fff2debf263875050b2d6138cb508a3d89631d6ff353393017ba8db6bdc44e85bec7818dc94596c3e44b3f4ac3e2f67ce864c261721a5e8e1cced14a2c16ce2496b6aa58845f941161581d77cb4d5b782e39a8c28ddcba09c68afbc4e5219e47946234b02ecb84e3568cc37dd5d41bfcbf6589dc183a33e775cde9cf6c75aee050b1d5fd2e92ae1e4e8c1f4823c05115582e0e282806f875f34012d4f771e45fd667789320474927e15110f9abbf01addf95428b7d2aa7fc5bfbc6d060d502f29d788af6c3c2e98a39bfe69ffd86044d1baee9832d5e972770680aa5eb5fd612a88476b1d17c979a734ef35ad9534029398eb60a396c22f7d6e34d40f5bc15440a620b377c92093d7d37c47be85291ef4f96cb810b2c646b5d10d40de9d3eba9f47926e7fe45d0685544d36c8ece8d5acb946ef19bb5ea0c7492860008545fb4741021371934e3087b18fdfe990939ed8266a37bc0003ff2d0981513d804a5855dcd12eead6edbacfba537730505e57e96294d2b13cdb0b6a38b819edef4a6dc26e35c0a965b0cf716ad763fe72307cf1db94adbbc5cf9b7974906deb8c0e8c040f263580c6c5f09c748ba107b519d2a7e4d6a9585d4a72a2b16a68cfdb5e4799a267a52b6d7166ae02f294516ce4f9bb691bdad6c94a6f0f939f2ff64030ba3d40865b3c04819279e9890a4f4fda8bd568e493feb63d90d449f8b850dffec4585dc5c16394682370245175f307f2839624add16c15e0706ea936eccaeff82ff8a46ca8158990150706b57e57ce3c298a3b4dbbc703e9defa45b38fb604a3cf4ba5658eca6c321e3f124fff518162d0b883bdea507e50ebd04b87e767fc8c039df6125c9b335054a1f31d1e06462412fe87b3d0642e69ff266885bf538548aa44618b61670aa909502e2d54481d5718e41e845ce24f5ea29c6e7f7a255b5489d86c811ce3a506d5b0fb4c1d12b143916f9e9b5f134c6762693c30c9f311a98328db3fe98600ab8fdb6ee937c6119b1a3de2302938ce9bf8c37c9fe96bac4af9f4d8c8feb401bb2f47d198115bfb51864d2e3308dbab8be0d67b06c8715d95d7e25cf226a87358abb5f559837450fadccdac768d941e043dd32c91678343372c6b2ed41a0d8abe940c6d0336b52b24d9dae73c9f8e0f0c172b97b10434453f56a1c1966ac3907d8103d98b6124ea073768370619158c9baf8c73e65f5b12d5b376e93725a3811228cf5c83366c910b810d0abe230f518a1625bf43fbbb4500c35a90f633c4c124ff5373af4eac3c6ae5638b50952cc5ab6052889e3de98e08ae59f63205e0308fd6641c3e691ac8fa3ca032943d1ce79423df425c899d5d19997e40bd7625f0f7371cccb3612a517982e5cdade116611c05b88388d727108f5d7873a2e99ee99e1d539ad09e6bac294cd5898674b483ad2493e83f73ad6a7755956353b3dfa1ac2865522c1e7d8b303dccc8f64a83e2f5fb6d105e296ec298847f2551a1eb0574a230d5c0e2c4783cf29576f9bad357f9ce279b8cf976e5e5621a514278a40f9175f0a491f0541ec104cf96659520f13151dafc91dc3123be5f953df879ad8da00bc3ddf9d9575da66bd814baa34b93f170d206395e2664b1043579a2d3bcaf66912cdb3d9bc9e76e8afea84ccd37ae902f4507036543400ba68ad91a1b015ed3da729287efbf4c5ec12217d08274311c5021ebf3a655a6dc8832b29f2f707d4c4626fc5052cfc1600821222111949ff02dafa27c06f662fbbde4612f14ebcf7a7c33e5e7c0e47e29637c0cc08528ed9c2a7bc31505e9c025f1a956967a19cb595e2feff54224e0fbe6e420b266f047140554961c2f20271e6908fca28c4b2f72c16a5658244af9ecd676af5e8a6076fe382ed0cf3c9f0f6221db5e65bdbc8e7741afbfbce8f4d87c22804d6a1e243ff077f1076d135de9e6b361b1cd0e1879acf7573480163d3bf07c0c0bbb8c87a1bb833865458d2c9e7a018abc2eb82dfa27fdedd53cee895b3e8beb721930d2b8b69228ddef61e0f93e105c9503106db53fa408c068285f5a8763dd90e22f979cfe504e68e1d2f294ffd5aa693d84139669ebbca52260376137d982e0e59e80fa9361f57ae81b97c084caa92755e5d2c98f43a14ef1184351485f4935065bda972fccf4c213c15efd2c8369ae02a0b5b8c40046ba2c3fced3fcd6343d93b361bdff38a07c6992af4e7a7a37a1a6e867f77e30c218073670a9b9f426b6edc8ed67352b54e32d7f34ca57654a1988fd740e9451d2ff6f2ad8b85c47bb51d32a3169b31b29df235a436c2e0195d3f139cfc05855ca1d15eaae8e27a37c57fc40e10e751a07a56dfee8d5b06fa15dbda6920c53ec58f94809f569911f888467020027b85f996adeb3d46ebd48ed2dfabd40743eb736bace4370a20dfda6b23a24119f070aa09aaca94c0dba1c91d60a9fbd37a8c23e38424930a900d7ea650c791805073be1e60358c4f8656d5335c4924df79bb04d2316a1f3065b8362e5e48d8472f8c45aa4b444684ef7c328535007baae61a25f7ca1d30dbdce4e9b4a3086e1d218e5ec4a5081d6ab6c2f98d36d0430adf4162500df39540f46ab9c58b34b7868151dd34e2efd996c579e6555cbd98857d369113cb411fd5e3dc3720aaeb1eb00390014e7f548eafeb9f59e51cbfce59ab7d2fb2f21583b4f531232584af180d3c5bcebd63c4601bce730902ed4477053cfdf605fd9a8e8c5ac371f0fd81e2d904472bd1825d719679b6c6dee4223808769680f4643c38c40913d96474c1eed30ec3fbe93de2c3d67556fbf63b042adce865e4f20a0d9d54c89b6285d52824168cad13773b57ee7baaa9b84192d3a633002f5012ed48ca3f37450df6c66a75af489b49e3c94f7ab3116b82866065232b416f194c2dd039eefb2d5641a82e7a4b90eb01b415fa4680d8378b7c8ce441d4bbdc59b1eaa97f30e74ef107e61ee0ec40fe9911d1c66f9e8d9ffc2f23e960507bbb66cc466724ed1cb90d36ba19660b814d82b24fe130f19e1977184bb547abf007fba4117c42cd7d4fe3322152daad4c3684f64c1d0a6b5b98ab3e930b2e90f0497c4e31cacefbbb11de78de7b1aea58f14c29ddf0e73303ae640a80d4c2cb1e217721c430e9f65af46ce3118738d33a293473290973fba52271197810bdf4586b65cd48e7caa550ad1b7abb4a14112d89e03bd1f99af95ac3b03d5f3f49e955513ca7f8dbad888ca331ffb1b2d522b9f9c5fefe2a8fb614c518eda29a71b99bbb07f6c7015a9a93ebd6a529a17e149ceb79c316c190148fc54ab6eaa302f4d8b3cf85d9a904d68e57dddc431d6592477afabae677f80587bd824d510afe59a745d1cb7cf0f6d556c3ce5b78fb308fdcc066b2108ceb146a4f3e423635c44c25a7454dd080bc0cd587cd1a21b9d368394fcba1ad2fe6f89076dc1903645db9efaf8691e9e15dfed5145d37724b92afe1ce7d5f3e0a619475a1663a3577019821e905176afcc6cb103acf0ff69e85c55b1f70f67652e0d496b4da88a2dfe1e4516adb2789adbd692dc948f6c8901efa4f2728c991a80399195aaf09bf3250510f248fddd66085f4bccbb4aebf41184d308123bf056971263f53811521eabb4cb93aee2a3b36ef99caee2a8dae906d807c96a544d88ad7d0f08ee212a9537e677a81de84d1b41659b0f24a20df0fb98ea1eb2b0bddc824af8046996fafea5166c1988ce702b1b7304b95b348b7c7ba46f4f0289a1af6a40840d94a2ec09b2771fff50d93824a7be741c191e671b1815438265c5b471701954461045aff628e8f449301b64a2c60ce47817dc338e4509db888c057585980eb9ed2448020d39b0d6b489bc4c662f87e4d83d721549b8282e5a49c54f99bed64e487521ac43d4976cd57c48273b8205d2379e7fbdb7d8d2d1ad660284493181801d908db02f6200f43cc7659945fa4beabf7d28e85d91da9435b4d6ccebd9488a321d63482810d366ea8a3e7f0ef60cc1bab36929d59bef575edad1834af3295bc3c07a29e6c85c6ebe264ed2ba330287e0c099e5dbd64abf05bbcb07d6bae701c602faa5f28f80fe0de9323e68a50b052b1464b22850d0b6087968b129267cbf6648255e329805602fce6f09c759037f3177e73d03fb0c35d78b92455135e0bac8c777b8a73a6590807ac36044cee8fed213d487865f5d5093f4de82d4332e78bc9cecfce373df8e389543c484f2fd7ae6c2dbc7c516377ced1faab50b27663cd8cc50e5718e8a82a2bf16cd5b5a8c3ecb2a273d498a583c698f871b15ab1b0d30093ea5f38367cdda1684a09a292ee2d5e107a2695a602ddc12cb464f5f31a5f1131080586723e924873b7689588a4c37330ccd307476856df9e193ad0c3f680f534d9727e3e0f5f511437c5f118605f0433cf32bc67d4ed14abf5962f3d49832d15c8d0ad0f74d08039921002606a3cd00eeeec77752990039e988d58b19003d4c76735ddd2c6454eb2d2c1022b32b920f131e651aafdeca840bf7b734680c6d62a27c74ea62b443bfc8ad96b6c0efdf7ad578b44014844331289fe28fb6ed68691ed33cacbb76e96275099e4737e7c3f128696887d32e90b246e33ed576fb0f99aed58a3c2626ddc647cf6cb9ab8245e7336c0d86d20ce86863983d64bec24f00da2d66227ea17c74e439e1128f83251c3cbceb0d6ef059df8c0a38a8d31c072df314dc1a2114b7885f2165c74419d373285a3880958e32f9c6c5255f96d2c158df5091c7e14c01a6112d25b2de77067f00f56ffac58e5c07958cbde0a193967df35c553cbaba1636e3f553bede84155bb9aa2ed5652d01dec0750a48b048c12059170f9aee4d133eb8e88ee25cc3b3a6765c1f4d347b4f366e681f497e76ec1c2909d6b1895df51956c62ac9cc48dd07487e52bfa978600eb79f587dc896f2ca20c7f8353e226d757f9134fd94e1f1cd1b37241d52b3f052139e201b06ae2fe94f6b016de802ed0fcc1e4c3244b872e6c6a2c08661fdb2700ba8f55d746459bdafdaa663175277bbc8a857165390d61398507cc38312964af7c86d0f9b4c1012091020ca8b97959da4110d2613c9ded2e5b82b13971e34524d6a58dc041ce6345899e8b313383d49b7222fa18e620ce88628dafa044adb98c136c840c01e8035250488d7c89f94d0a83fa5ecc38784ae106cb6b55a96dcd18d23549554cf9735ec121152ce99a43d5549cd9494e77bddfd899b86204c3704d265f4be5a6c26f14dae4ff033398c82a2cd89954f6eca190f54c054006aa8a462b9b9ff61ff2a2984534f4a0ca17c093fc7c56f2185a7e1b8e84f5ade4e5c570e552c5dfdd23e784079144071a79f1d7e33b0e336a8ad4307b475a13cb286f8f77342b44eb22b15633b9d334ab5bd7b1d925fc64d43ef2f36542acae75a93a04bbb381df3bbf9f4e6c50d383a6c750b54960fa4f75f3d487b61a803f91c59dc80d2e6842113537db86ff4513a74d48c21aa23f45e4a0429a06620babffb90a0d1f486ee73dd72e715fc5b599b70bfcfd2b25957c3e52abcf21001e7c8127f20eae0d888f8daa587b2fc76e7da021f2c02e2ea98af2842cf9014a2a6d0f1837b028aa9647756305b2e8f517cc221f258220818c33550db27f6bd99058e9f31121f60be3b38e5ecbd7554918b0e16a18ca9b6688873775ae3d3b338b4670e704c7e3a0075a7e2b5f108c8832da7f17d154f8d377911a178a4c45fc658cbc0de0d858"}], 0x1188, 0x40000}, 0x1}, {{0x0, 0x0, &(0x7f0000003680)=[{&(0x7f0000003380)="f21cbedcf123d1efd1bb97383c5fb36bbbac4651a7610185d301e0ff72e9958ed54d0134180a8cd0ff579153c1ad25fec2abe98a974b1064317488ca37cdf9016e61c15eadd153b3c940a2a2088f6664eece4e02526f79868a807b3f446c9381d37a76949391aea7f59e10b4782bfde6c21cbb7884fc1e493e3f723dd12da8d8f5da02341e816ec42c7ad8b4fee001df60e645c965bcefeb5956cab6978d7b5df1e4b4a9d223c37d6844ec674097955b7adcac38efa48e8d1b586002c7f9551a5236fd941b55d81b2bd83fd2a2c19ec11daf82eaffe4bcd581aad36f5f506074e1b3bc5964bdea56d13b0a38a944ea", 0xef}, {&(0x7f0000003480)="ef65f7b344b81d538a2c643045ff982484380db1f22ccae243bb43b1d327669a7d63ea779119f0e17454dc6d30ff7d827b3f42cdfd531ae0521c6f84689779739abde686dde969f3e6db99e506b54078b483ccc6a67f7aef05a4031291e1c52addf13993d8163fd67a96d55bdbc311c0c67f28274ed34dc57d73e081f01a092a0e7f31471571e96694ed7c044caea4ae13d105d87e4b943d12c72957526d", 0x9e}, {&(0x7f0000003540)="93a3106287c380f964555fb343f4a82da8a85f6ba501d38c9bf0d018a3387b17fbf2d3f2410a005496b54c2df5314d6777d9d75d8421cce0c7278203e575d7424545aba1a3e465c683546f99103e3fe2106fb119a96faf5aaea3d4ba89bd6f8d1864e403fb045fbad6eef32dc0110d56c372867940770e2b0609973ec19ee98b36a52f1994a5bb28ae1a118cc98308d0b247fe51001951658fb29010f8", 0x9d}, {&(0x7f0000003600)="64874223e3d558d2463f62a8f7b642169144efb5b9fd6f04817e3321954a92714d598cdba4999c21a63d6a72ea7281d4e2e8b9e35d64c8e7fb6db2d3350e467ebd0617268929d4a74ea57ce6ca177eef562c42973bd4e57041f8e7ae29294a7150979d6950e9e37d08c5ddfef65153", 0x6f}], 0x4, &(0x7f00000036c0)=[{0xb0, 0x1, 0x3, "075eee19a8e2767caafbcfe42c8c5407db343cac240cf68d8f8564a0e8ff9e644a2e772bdcf46a22ef5dd47cce600c5204f9b0acbd6bb24579642c106811df9e37524f9af09e2528d9d56d0895c80524653b6135e7af5441c23707c6786ca4a73e2e8bc31b8be903fc622a07ce93668c09d09094dcf02089cac184f1b0d0936880bdd32a8ba1b7529c47e30dd69afb39ff11e0706d592321e0a7e0"}, {0xf8, 0x116, 0x0, "eee006f73ca2f9721bc28eade3646795e3b7f686673eced1647f6461801b4511d81b5145d331747755aa5c4f4a2003358cc9f9fc49e424dc43b4fa6b15004e6191f28a1412c875253dd8571d92cdb5de6ac325d3646410cf64d382adc9ef90d7177db98d998628f8f5110757716339b22a68a9f6a4d14aa332f10ac7e75d2557b54f1a75bed79bd5894f938ce04e7b26cf8a083c27c8dc1f100b72d37c5c4b1de65bff5556dbebf091617635feeb9544431d47ce88447b6fdc2163f5f47dde9ab0feaa4615b47812c6cd025af36b24bc108203c3db5ae64cd4ae5b8e0e0cb5066b1f"}, {0x80, 0x117, 0xffffffff, "6eb12703b5f153bc30499f0eb99b9ee0fb728706e3a3e42de500fc44a5ccfeef45a4787db5e3718046c997452126057e6fed9bb580d2738c8c2d7f730ce4c91aa8ce994424328dc8bb390fe05b187ba5f1513c202cba7dae89f45d140db79177233779c9ccc6e429bf57"}, {0x20, 0x10f, 0x800000000, "10ed20b46212acf96672"}], 0x248, 0x800}, 0x4}, {{0x0, 0x0, &(0x7f0000004c80)=[{&(0x7f0000003940)="8031e86fc01d2dfb1f4b819787aeb274a4460c7b5c0dfaac8046cb477b3a0a78c5972021a5a678b2c09c19d150d273ae9ff883bbf1a53892267d51fd7d94ed043e27b99af1ca5829a7fb30283e2a302902a7a68c39cc7a54601165314d896b9700b17aa5f321afd6b4ace1016088beb973721d64aec9617dcd7a36158c3927b5beb08f968afc70be861bc254aeda6fef834d343c34bf0eaa1b51d18d3f2bcf68e889d948a0daa7bdb105e7d2d268d5b602f59ef8b85d3a71834420f5ae3d4637706ad1fb6ae028310827c4f43921c0cc86d4c81231e400fae5a7bcda6c6901efa6717d1a741cc33fe1a7b76c3aefa5bdfb00463e83f07dda622c556c910865c53a2efd3e39a4e56d409a3c40cada2edcfe4a2be5b8a5420a3fd345ecac88fc130696d1208e25821fe9599ee8da49f0e9e288bcf3850ab64816941fc79b40634bc51cb1115477ce30873885a96ee0cda02fa6d0b03ec314fb5b9806f7109b4f88df51c21c4b116750deafa5f1129b0491668ab9b6cdbbfecee7c01fb47dbdd4db9fce7173ba8ab5520e2ff16c1377cf6bf8dcf75e1fcf77df9aa87fb7492cb90a9f82f77b51e9372071e8542b80ab4f8c786a8d9c23fac1f491606176e1df1edc21222b042d25c3a3c8f99807ccc80b58a1de1bf9fe20d17bee39716302f3bc5fac814650191587e527cba7b91f1135ffdeeb15f69729ff35bf28704fb15c15ab3b6aeee2f403c3f067ef5ad5df9ded2fdfe3fc96835dd67236fbd44b2025f3aa81ef9b6805e55fbfb9c8c8a301b93f8d8b29ce4aea5aeb6648a8b02927016138399ba56ea38e08633921a40ce74fa276f7be8324814b62bf1078b840d415534ed1171590cd6cbe3347dd2f8da6c210f3ceebcd1f2946bde796a9f7212c1c14ca2886ac5f5c466ebf6b00916f87f06c73d4238a6318f31cdccf602c6e00017c0d92b276e82877f81edbcad0bee17a55bbb2460e3147cc3d9832d71aa1b5eb42503df31080bed2d076a07262c1fe9f98914e3f87d9cd8fa2901eff0e2441f47ec9083175a6f56fdf5897b08e1f3e72e240ade1be7b0f27c0a337f859e7e4ee791d89b734b6d13fe6b13ba6fa43b7871218a0da62a73f2e75463488e4081326d55d99b1de6777ab8fde9afaf00e6ce1f17a7e4902cd4c06df456676a3340c02a9e6ff08434267ad99cd0d0015eb19cdbe5c3980d9285e20696a8f8f8d36144d14dca5f4fdbcc866b9a3594db8821b03f15199fdfcce350f76fd078dcadb15a2d6168aa00c5b44ac65a7413492d16a1c06f752e57a3169128e84538ac82cafeb3b31908634dedae723a41455099a4fcea1abb36362b4ac3d7254b7e1c2e15a3002350d74635a43af1c1c48d7c82c3db97ca9dbf6a9dd3cbca1b736bf27df7fd37a3860c0b2416483e1b1c00f6b229c105f76a5009094756d4f79001768d74bf77d82c2a55c10644748318c8b24d992347bf288165458b0923378129c1ddc23d563343bcbde90cc02d13d3fcd90b0d11e7e773bb5aadd8848277e180b5ef20129419efcc59a1ce2d4eb06110e2fc245420287d115ffdb6c67e359f57e50c7472f78fac62762ce2c2211d15ae9656dd4017cf4bfa18b811a9fd9ef9e2e98d9a70fad7241346502b495cf30c6d030cb955530613f58ebf6b63013ae50f25eb9d3cb554092f8531dc07176c8a5f897af7c516233f013abb62a3da6341dcc95deafa31c72c3c9f330216a71ba31e66f68a36b24d121db938da00097b2c640f9f5495183a53087550623aa7b0cb8c72eafd0eb464f5cea23cb35815fb111ec7e6c23181ef2281be9b90b6e8c2b43d1d64a52a1b32fc8d1d7a4dca2df7a09a62cd9c5d584b8e59896122b8108d3ea745e1c7bbb67b273c2a5ac1f6f93ef3c4ef2d1a54fe787a9b15ba04d67a1bf2fa62b9c65e36aee7fbb41aa43a27722ff6af513b1bf608b3f05cbd01a53181e00f0c2084e594719d429cea2fca16846593ef17893a95f15a69e09022da97e73ea8f3d05bb98892cbc4401b10893da35a66a043cce3e3b3069839b52a44ffd21af65dd778692278ec06c21b23e29dc0557332eacfc902e0727eecf741de3e00081d64fb0e1a1f4b56fc098294098687947fbc1840b7982ae712d36d73906a8d8e7581263125049d68aaab9bf19b22fcf9780f4de9a0c1cd6d590c9feb2592574061b87ce3ac4c4d2568bd095f67ec2430d06b2307b54d6c1a32c2c1a53f8be2752d2d36a93427e60af8f76d2cecc393f931154ddeff6f4c8722604092f012053ffa8718ee205c58c883945d10e9ce0a1d6987d7694e2662c93dccba5f18cd403ae244488482cb1e8a1935e7c634ecb2abb1dcce5deb18d83e5b3b99aa5cedfa814e9efc39612219bca507b914b5528967f48813e2ffc3786f15660e485f39aec43d52c4a7fd0c60d45695e08b987a9f29fff2c24a6ff8deeb6223a4dd550fa37efbca002ad7985eea8b26fea13f6d37f2f1aaff6bf8e1336ead5c24cbe0fc82f4977c657da3bdac1075c23ec084cb5f8ca4611e52f6890dbcedec87a318f7ad5c72e307030fc3f0dea8046f33b598d43419bf936715737879c49bcf1006738f3297c6f559c9f25f89c36b9cc1aeaab84674bc71dbb16e7afe805969a7c4ad9f206c2c125c9354550b395f1398b8eb332407d1494a701f7eea871f2513f9bc82472ade2cf1748112ffe6a80a848d107ddaadbfd095ecde5968138a689fd6c22b59e1a3947a1456401458a5fd90a38be1cf606bb94127d9aca4c26f1c9f8ec14573caae5e7229aeab6413200a487fd169a5739e9de09df5c05131139795bd2a6a9e261077b7eee18621784c437ef3d965475e13433ac0d8e2b8cb2b49d93916abd0e6c206a8f49bacf7aec86cae099456e994eb49595156b4445a3afc83c056d645ea8bd987856f75048ef9107a30d95d108f6da2d015e0367fbbaf464d61c590f19904cdbd7650da7473473fd8969e17fefeb017acf1e4d9725d20ef3d3c2c393dc79afda6d05ed725aa2c4af4cac197073fba05b32e60c1be17c93a492b103ba4dc74b4e596bd34d7a7807e9d001ded52b25dd5e24ee09b55b2a85d4a107f859af7e45904bdc2d9426f70b755537abb5c7f3f8283d950ed62749948edb2b8cbdc467959e99d70a220492f7ff66d98eebefba207ac988c67e930cd8f2305b01c5be9bc2310abbc7fe99718d9dc727fd62c7ae47e52d0c71fd15d11f6905cfe5aa3d65a4cb46cda8597c084300f2bb27e90690aa5067c6cfac26dad00cbe7a868844c69833655c22b1ada4ab6950e5f70d638bcd64970545ad72823d66579e45848ea8f888a6874dac1a6ba4075aa99b892ac9860b69eb9cf87c0981320c52982af7b642dbb6aae055f449bf164088bb8ed9ee5fde42fee1bc51221cf53fc681e19fa36cd15872f3f69b2770cffd20f4445647febca691f36f97366a085109f508519a7a7afd4ae7a6ec14f7a0bf4c8b60a5779b01a7338b1599bc9288bf2f29b2778818c15e83e6c16c18821f1d8f5dcc3ad9fc3c9f91c6b394f7e4369a2efe0198d28a38c2dbb7c5e914b420c33839aba0bba520feef52493640fa8b09e9dd9c7c00f6e82b910eb68874ab29a2c4ebdbb1f9fab649e097f57f6dd13cec06136493eb77cdea527d10df267e570ad514ddc22da4a212c16235c2e71d073bf78fda6f6b064b52af675d3137b92da4eef2ba66c3dca59635b2d95fcf083899c467a9f54a34165424ba16e403d461cb52c03178ab4bd8f122ee25f8a311fc1baeec19369786d835394e29ace32ac003d5988ad77ad06d305cd9efb1908c47eb572f0dd4a222d622b3393aa40a34f3713289e4f453144a984be10c79fa08ca6383e068da5451090695a6e5b75e6cde34d9a09cad18e44aa76b9ec73e00bd15d02049ab94862756a872df402b9ce0b438790329267630af27cc9012ef6ee85627bc91e92ae54cf1fc2c84784141b54fc3b49fa58f7429347e396735001d0287542f81b0434697938e54029c87766d37167bf2021eb3654056b1d0101db819afb30b9ad378845faf5ddabffca65084e52e39595688b6513358c4ad7d2e50a1bffc899830200a8e22723e8e2fe2a3cffbf3c0ae6d3aa09b9bdc23d0e0f0b51092dc51da05f711dfb03513d39cc9a30c62e113bb50a403fb1dde7ae6c1abe949815e485a2633d00377f47d09f35b5598e7f186e059d65bad8cc1beabb644253d40460a5d809a372ecbf478a0d556381148531e11ba573a329407e751f708d453aca5b5ba3f401aea3dbc9b613aefaecfba35c5649ff39242cee79be2777795a431be2d8255c3a1f02df90e727c27e60fa8a2b31d3761c5e6f42488421d35d3c9757fec67172da73688b764fbd44e823c1f16b2fcbc893f823725540797936cad0866157c8ad5a9ec281c0d76ba24d2d8dde7ecb63a8e1da45d9eaf24f63ca1dc8dcf0bd5d6577f9e7dc4677b35f1da7a4483e865492a1ac0d8030a340e9cb4e0bc0207254159b16d85ed5a34b0076f0c1a67f02e9d329cb3f27297499684e7aa485971ed2bbcaa4f4ecc46d718f96516ee6f5103c0ea0f7599aca75669c3638d31ac5830d6a40b7102b07bd490ba18860893063cd52ce6101fede39e987968342df640374852dd1267ce5610fdda329457813d4091ba10871a9a958b12cb7bf5ba1264d239411568658221d68682ab891664481276a8d8eb8879da1beb7730b1722b831cf78bb2cfec89cb6efa7ba1b1fd4e1f89153012f1def3562b39d40b970d405f5e9043b1962aaa059532337321e581693ea300055813f4ac2065290d28009978d6e11fdb0ea18a23276537f2f09f426eb0644b80b31cb62c9c7b52f461cf730598a990c2ae4f2c05a6bb850aecf637f40a44f4bff2c337be6a5168211ec02501c4a721914b10cd3293f0e608ccd982b2c776e10edea8127ac306699a241377088223ca7932e7d83bd6390c925f81f25ac66a7640a64e26815cc545caab625a6e0c34e70b974533c080673c86ca1640b291dc4b4dfbf0e2b517bce724b4f39fdc647362bd887c97a489e6686362e641f2bea994efa229232ed71aabbfeccf21c1c8adadd7a4e0011ab07224887804903d3e7332be47d7d4dbc277cecf4e57b3095fc92f1a50ad7954911be7a3c6cdd2a4ff5122857f7dc68c7c0dc8d8a5df1204bf0244f13351226729484c38b6cbb4b6b037a705d03329cc405d380167708ba985de0c81086b81b100ebfd8f14778170c122e813f9d3a4339d39273212520bb47edfede1e70ed1ad788f2441fe05acdc3c52c4c5efeabff128d091c3959be457881ef5808ba20f8dafb4e1e3dfa8fbdd52ac3e8b5135f20c4973edec4e6188179b1f1ce4c593a85a32643452e51253890b3ed09afd09dd7c57044fe7cf23872edd4d879b9cc837bacd1122fe122344a39c4e82d7573424ed0d4c4af5950e3f72c863b406f253a5f8be913331c87fd65d97f593bdf691c39fb32ada59b66f45c88590514426152de5d99da96227cf94f39a19d9b734eb4304675c96dc5ed832a5de40678aeb019e9c12feb951ef0927257a67db3079ac2c3d52a178feaae14ed0ae3bea76f25aff98c6bcffeaffb58f14beb6f1fe5ffbc1acead4f7959d54d7e00004d37f3ea3d83a66d1ad491794bb4a577fe446f4dcbbf213a29d4c42977e83bd5b2ed366790de75660c28262d80a95bcd39fa89d42ceac0802a842b253ad9486e26eecdb7d3b98c7ce7ed9e38655925c90de0ea7fd5213ac9a8552120a1417302cd01caaca3c706d3d0c1bc051d64fa4bf5b6543ae42fac036", 0x1000}, {&(0x7f0000004940)="118a2bc7c667c7b4bf2f6ffb2719dfa977886805dd3fa35b5418d402bd035bde9422eee2917e012a032a524407efb0a56ff621d6a4d0de4c3508ca45a2c0c25d55c7acf866fd", 0x46}, {&(0x7f00000049c0)="34cb8fcdead0c0f9c3a0cbf04f723009b40e3076b6bebda62110cbf0d2283e7f107ac7ddb0772af1033a1e8d44e0fa314ec635c20f958c4d42b3beeedeedd041acd95053c8d278bd626ff9d631238a53fc042f55472ea952282a997a4d9c70189716", 0x62}, {&(0x7f0000004a40)="3a60da5317f64e2eba6461fe0790454e448f6229f2ee819074c955a7131ef4ce970691bdba34c36fb66ff568c07fb1d8d2ef00912bef3ad4714971c61c79aacba3d0dc8357bfe7506af5f2bf066abc6441fe00a2b7a5a85f6d9a40e707533cf1afa2198bee0c677e7404f319eab13bb96f14052d0aff9f0425f92369effd720766f25640f1e7abf9216118ff34e0a7a94856d680c9f725ff232b6c7a146cc29756c4bed4819a6a4847e9d42e9658b99c1a34c65507031293540378225c5a07ee07eaf08626f76d62e565e63510d4197a088ad0e0604802a31d962520467bac0e5fb9f7b3", 0xe4}, {&(0x7f0000004b40)="a75908b8a4042defdeb8b05eafd6969415d71798ae75559ba042540180985c504f13e228cdeac4c4549685b35e853566c7fc6aa4db535906280c0b437a61df8103404665c7b4a3d5cbdea38f9c2e119214c37389ee340b99b917a97f381826e73a9254568f66a2d76bbe6d401c1e1ad642a5ac99c95939145113c50381637ac13a65330d43de29d6ff44f357e5ccde9ba0ed60e3f1ce96254a0388edeee9b35f92fb940307cb6641111fa1eb44684b06fedc25f17dc3c9705114e7547297d1a046cabf7f90b029566783ce030acf5fad6131b00f9e94", 0xd6}, {&(0x7f0000004c40)="54e0b6f9de3d", 0x6}], 0x6, &(0x7f0000005b40)=ANY=[@ANYBLOB="e00000000000000019010000b200000084a814dafee1e690e95f63182169b83040d7821ea774fce25b2910c14ecf21174d7bc9cf0e56df1ad9cfbcbdc989705873776185644947a262848511570112a8a2a92740213b21a8de658ca2040eb0a462bf53f30cdc64d5291a8ec838a19890bc159e70e12e16a7738ef42993b11b4dff9e0a6845e6fedcea383bee014653d26142bf62872fc56e277de6bca61e489434156904fc0a0d98d1ea7e6295a2272d7351fc51ae2e88b457fc1da5974b8515a000a10a575c564bb14d47fe1cf3897f1ad8ee34044506ca2400000000000000e8000000000000000000000092f3ffff18b1842d86d49212e8f7293c7affb464ff66980365481625e88ef9dcc62bd636a328884599c0c3f5bc27e83d7d752ee9f6614ecaae38c2b748a4ba6b540dfb5ffae5c4c9060c60774039fa37fc8242d3e077f7c7eba818128df698e7e51216f72b0db0318958d7fe4fc65f768af5da68c26affbc8b731941f198ce9a168a26872156b9b27e06aa8fde9005aac2f711a202851ca5c69d28f1994cae93bcf77899d31ad4636cacd9f260f2e393b3e27fde94743186d87e4202c7ec2eb191d244b0fcaf33ecd17d42597dcdc99adc656fa1e500000000000000a00000000000000006000000090000000cf5543d9714f53d582cc8fc4827e7b4263214657ee04a8a574a065fa89c2ca1a5011280885bd56c6cfbb0d07af50b9c897269d803029b71ea987f999a96934b72ea77df33c2a7dd8f6e03aa3b6e0bb46d957db38cb92772bfae909c48b1e3a5db48cf790932f0c2c88fdbcddaaefbb1efc16a3033edddbeaf341b1bf3b5e9d80a9a7ec641c16391a0000000000000009800000000000000ff0100005a010000690fd0dc8ca4d0807ac8d1c78fa6301950667c0a7540e374146b0c180bb61ccba07063c01e6788c96a6c0e855dae2c66156c4a08e6c77762ca4e57b3acea90203535494ad3694419182cc781f7f8b798308054aa699556f2b30e6658da14bf8ed68bf2fee08d1d8ee942d4760f7c80a04b2c066ada9eab65366badbb69cb4c555cad6474e6520000180000000000000088000000ffff0000a5fb6f8de364649a00010000000000003a00000006000000c28940b1f27766e2119a6c5b69fb153cc1c4079d6f3c260dbc76fedaad149bf5c183abb50ea0d410e304d9bf06acac8fd130fd7ec97cd4bf0ffc1407d99c90bc581c98d82318d4024c9f61eb3609ad2ddbad1315849a332a4128fc94059545955faa17391c721f4d664e1e0504774a5fcbf7c4ca2245ae63bf3315595469db07af20c5e195f0707466f2dcd4bd292c17b19cba56640a0b3d4d857c259ad57f27fa41a1cead8979c27a6564de73e9f8338510aa4af43af380ee3280b4842bb27171ec7903abe0183b30bc118d93c639666982048a4f14a08b445993b4431dc93cc552186d5ba2ddcf3ec890cc38f92f00f80000000000000000000000fcfffffff1efbc9b117b0b6ce89d3f7537a84aacfdfde9bbd0fab06d8f52da8e58e607c8728b446ef469ee594bd0fcf1acd33a03f9cf2ba3a95cc2dd75a9ddc9741fb55a6e5c23c6665549bc72d6ff904a042f947c6910b7a91685c8f5a60b42fb1bd69ebd89f96acfa344c1271ffd8d64cdf5d21eb76b98afd1b3a01417acb7d0fed975d80dcd95a1c0fb4270d30c999c4fe15481fba43521438a036010864cc6245e5224a210efd81ce20189a654d52a4ccca1de25c954094c9a445797e718c44c9f583ad11c64ddf8c80f11b57bca6e02c5477dd8b1cdd4912e7ce72d5c78c04c25533b000000000000006800000000000000ff01000001000000ba81ae11a207c01b588a1445ac1990d025f13582eab320ed6d2f7999e1c09c931f40e2b9d8eaa654cb91cfb6d67df43129450ea28711bd78925becaf4d1c6f69789aba7ed7ee0be5b9216f5934ea7b61281781f600000000f0000000000000000f010000810000007824c09c729031ef5ccf0b50b949563a632bfa52f99265bcc80e99d80f08a69982a9de2c710a19f3f47f0b6508c9c48e3ab372896cd0f9657f33a592364bc9264d8ce0e2de4e98147a4231912c40ee9c886e5c5fde6988d541c5dd9ba69b38339e20c870fdb310d81a9d06f88f149e2bef08558df49d722b5f9a9eac445b91b3593712b3ee773fd693ae3cc3c0d3dcd7c179d2c2f85cd72c1aa9dc404f42c8c24de835b2172f103157854be738e0de4e975ff7ce348dc7a1959a7f8455e67ac61a4ae76c9ae7c9270ae5a1b489442cb4d6879f2e153a8d6ed1063d0000000000c8000000000000001f01000009000000f8c46fb4d86c840a04df14118b3229aef6e6c271a2451e3ff7564a8639fd15b04f65178d3eceef925ca18e614ccd01d7da78395789cc710c75a74ff77b218dc3bf066862e335f169b0a69ffc4f88e85e6e65b1d9c5b63a0eee75833cfb9c0edcf58207e028939a6d413b503a725f7acf8ced04023f7fe78d9ef1db477a407f574ba5904da67b2fbaf6672e87ad7aa7bde2c81fae122b8fbcfe27abac090adb304d3fc15c0848835811878cfb44d57753aa0000000000000075f069b9122dabad32de5d7b73b0b079d6dde54f9f9e21b7efe01758de3e2109a859324d5a6b9012cf34b45bac44c2ce5f0cb69a0cf5c70ae5aa7fb31cb894df705ef8a7b9e44680b7bce2742c2732b2cbfbd7aee7bd862e6ed45861bafa92668bd1fe0b469d8afb5510dc8f82eaca50"], 0x730, 0x20000040}}, {{&(0x7f00000055c0)=@can={0x1d, r4}, 0x80, &(0x7f0000005740)=[{&(0x7f0000005640)="e42c98ac59561caae235c4dbeccd928b66ea40a66c032d0403aeb0c63fbff622d94ce7abeeeb5a436335baeae98c51ea206eb7b13fe36ed9ba4d1f4d59412c2605b915811bd1a78ab3c23b92db02726b10747a41fda7266b4529e846d72ad2ee2f75167a7808a19992a7904eb64bbaf5b71b172e61b5f4b3e8", 0x79}, {&(0x7f00000056c0)="5384d24cae8c242f7e8e08344209cdc7999b5527de5290e4e248587d9c659c2b46d0bca0b75b09b3cb8229ce2e862045375a3da3aae1df97834104424e18305aae37e629240de76772487aa2fab323ea91e33d4cdf01466bf8a411883d80c3848a8a8256d4633aefd62410bf17a8", 0x6e}], 0x2, &(0x7f0000005780)=[{0x58, 0x10c, 0x9b0, "d22bf9da7bd994673551e2443be7935b9e106cf6600f0a24bcce7120361e84b6b6498e7a206c9f27ca9d1ad8b7e64297dc41c76e84a217816ff59c4544831b05041f"}, {0xd8, 0x110, 0x72, "703af324a185002ca8d98b1dd3eda248bd67420a3718220da21cbd537d0f610a24b20b0cfab32d728b01598d5d8a5007e7d9a8d69663c028e01f04592de6cc430738a5acad1f232bf15657b26b39410ac032e339f08f393ce17366d5a8da6b1b466e2debcab3b9859fab3314fc9815184f2aa608ff599cc026afaf20892f8ffe6391060d1e98bd916dd793d5b48664c1d163006818d4c35799775acd77c9a7f44120643203cb65b31e1cc3169f8b2949848b8ea495e9d900a317f582c14b800a0c49"}, {0x50, 0x19f, 0xd6b, "1980d88ba5723b99e1bbf61ccd3f2960e604884fd629b5237fdb24a6d4fcbbb9ea86c0fb0264188b91ca1cdf3a458f696338ff44e5c5c9334c81"}, {0xf0, 0x111, 0x200, "21bdb7b67f47f964684978ce1304f0a02d83a793237b653829b5b9bdc0f2ed69aedaa67409793c622a3cde91814d4c7aca407311df26afb2e0f3f2cbfa796457175c10c7ec5413b14ae5a674836b3bae4c84da50e9d81342b2b356d4118ae3578ddaa92b77101db9e8bd4d994e10e77b1b66ca38b79044f2177ab57c711c8fde1b63b80433156df6136cce30b270187e78caeab25912ff71dd85015e499b2154d677cdc96a0d5217b311aee9cc4316a34ef9d51a448d854d5a62ca797fc20e4b78d10a932a5a468b5cee3c6a6a6fe2be1a9b2827efc1dfc867e0a98813da587f"}, {0x78, 0x10c, 0xfffffffffffffffd, "d05d801e33ccfd5c0103acac048862945c127a1d7a2dfe852ec6e292d483608a1b52d1226f5a9df02ed8ed9eccaf1bb2d8f2ef80a4176aca9d804a0abdfc146a7c284163096ed9a376ecb98c9441674ae0638d34f826b4ea14faf9a196eaa5059478"}, {0x90, 0x0, 0xc49, "f3551dbf96900e576c9f01e9b1f4fdc54dbead0a018316e4b11a38347c7ff8f761bf53b15976f0077f7594b104fb977d98c327d5a09d0de535cecff1453dd69fda4c5c5e69ee518ce44d73c51e75596d9fc850b517cf3acd88eb7465df825c7dbebb1107858d6ac5536e8204a943f01753688062361030e6df4d"}, {0x18, 0x10f, 0x6, "112ec1095a19e8"}], 0x390, 0x4}, 0x6}, {{&(0x7f0000008300)=@xdp={0x2c, 0x2, r5}, 0x80, &(0x7f0000008400)=[{&(0x7f0000008380)="5546c577e79b2b782ba57c9500a4bf5626fe1cfda49f49244953fd2c723691bf3b226410980176a7dd010643fb9aecb044629a7ac46b2430c386303cda14322564162c", 0x43}], 0x1, &(0x7f0000008440)=[{0x58, 0x6, 0xffff, "adb8e122344050d4fea5f1ba48f28774d7b4ad78708b8f224e05f525424595bc4658ef218581c1dfcaa59d9d11bf9d5c9d31b70b21f59c6140fb26c7a73116eb76"}, {0x98, 0x100, 0x20, "2c1da63a95ee36079109e5f27fc5ef4c4a9852b9a665e23f165af6ba81463f8124039b6c04ce55e0852ef82d10101bcfec106a9153475c0282f860c5fd4d241044979a62da090513b0ecf9e5a949e8e90f5abe689ad85651fdd94bcc16d90378a4647fd60d85f52f0c3fa74d032298bf4f5211eb0e3a0299d9b7f8ac975e7179f101a76c02"}, {0x110, 0x101, 0xb2, "b1a1fc735110a5c59ab35347c94d5ca3332a72d94f1012b52c9d5e13b0689e9b0677947d2f22134192f730bcd2065dc668364448ce41fa486d14a3dd09f7cca5a45ced80156e9e537d05045b496f43d85b7243fff258d3e276a2405870d8fc0a3d13a94f519bf604cacfff9ee556dfd7e2df66926a6ef49e048ebeaed6087587fbc0cfaa352d6bcfcbb9de85908dab241a198997f67c05bd8b72b960a9d3d324cf97c8b9e15d3cf4a9d5e310fc4adda3ba61754913afc41bbe93ffe6526712777ec79c44a6cb21597b314e2ff6da2fc73796ebb754c581e31705eb798e1f341c60b7564eba108522caf0b49614fc97db607698052f5eaa4b10d2702f"}, {0x100, 0x109, 0x10000, "ec60b302d026efe18e3e451f42a6fd5a4a8b275698fc1b761905173ca8d467c5282ce63035e2f6bbe9c4f599fadcbd6f5b624e9b5d6a278d6b47ea3e9fe7b639ed3007233edc351b29a27a7f3754f3ade15c50b33f72472388628cd3974e9ad304dfa014d71e70380d667dc2710c453dfc8dd21b9f2f7121134b4c9128de5463bc54c7c2bd7a8234a75fe3a5dc5a5adc2d8a85b2ed6aafd5cff0e59d8a3e4d5283054770e4e46cf466ea98695dea4636230b231185d5d14dec464ff4ff2714f317545aed3e9524013133ddd2b3636023cef4e526795f8950911d3704983e0dbf6cc0cea15820fb245a"}, {0x100, 0x1ff, 0x4, "ca07eb4d8c612c4371976d7c5269edcc9472293629ce2a96f8dc9335489d122ae5577c6695971d1cf1ca71248e9ffbfd7cf2839efb4749e77cb5c94ac4a68088f3e1ca24c68e73b1d56a07b9d4c88d5f12949096ce69d0a0997a7bb1b103d5dfd9a96d39483f1aeba73b762fb8f4e66ae520729874420034adad846c7d3c1b4eb2ed673079bf54683c020f02eb9883d574baef554595fe3d82326cb4206d671a68034a15fd3623e25eb5269dcd5d0d60aeafc828c4c8132d7ea6c25c0251aef78dbc4601e19d332ceae41b7aeafbf3643b64b75a3bedf88ee5c2ca1fc9e2e8ff64cf375f9eac9d6c41e5b4"}, {0x108, 0x110, 0x3ff, "900af76d683f94f270f0e9b405b859049ae034d31b0f84d387e561141b9b12a720c04358e9d48fc9e7b468d918f45782495be527d26d6510d4a8169cac41e878ae23076b599159abffb353caac94231d11399c13cac5e2a006f620f91129ce129f45220598606308c29cae3eb74b0f7868c88986da2eb3822ac4c167e8b2588be51746f2c79e8651f002e0fe268ad51c1768fad5da6b9db31e120a9cb25dc9749c12d898655e9e4903ab62df01da94e47cb5766f6273d85e4a9d3591a6c494348b178f401276500dd05583361154fc5b17ae0182856371d96f1e309b23c4c353aa796ae772ee96892b65864eb004ec63cc4df1a2"}], 0x508, 0x20000000}, 0x3ff}], 0x7, 0x800) sendto(r0, &(0x7f00000002c0)="f88a7100f3371f6d1ebb08efb8665a898c8954dadd5f7d4341c8ca53cfdca0f86ae7b1c8643824511baa5efee6dc28c53a7328cdb1b6777a6e6a1c5a3cbc899ef3289a57ed744275cc20894e8a7043e293e4995b54f28cdc10b3be2612a8438cf0a73abdafdd66a1eb2f4d9fb78976c4a61e3466fca2a0bcdc4ce4653b377472ff9b51cbc2ecf5a595f85dd4dbd92c7b62efa719463c8c807e50e99910cb09920b4987571669ed024d6519292d1cb4ec26f669dc", 0xb4, 0x0, &(0x7f00000004c0)=@un=@abs={0x1, 0x0, 0x4e22}, 0x80) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x3, @remote}}}, 0xfd89) r6 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000600)='/dev/pktcdvd/control\x00', 0x181000, 0x0) accept$packet(0xffffffffffffffff, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) setsockopt$packet_add_memb(r6, 0x107, 0x1, &(0x7f00000005c0)={r7, 0x1, 0x6, @broadcast}, 0x10) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000380)={0x9, {{0xa, 0x400000, 0x0, @mcast1, 0x3}}, {{0xa, 0x0, 0xec4, @remote, 0x3}}}, 0x108) connect$inet6(r1, &(0x7f0000000280), 0x1c) getsockopt$inet6_buf(r1, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xfffffffffffffff9) r8 = getpid() perf_event_open(&(0x7f00000008c0)={0x4, 0x70, 0x4, 0x7, 0x1f, 0xffffffff, 0x0, 0x7, 0x28001, 0x1, 0x5, 0x7, 0xa62, 0x83, 0x9, 0x100000000, 0x80, 0xffffffffffffffff, 0x7, 0x77e, 0x1a, 0xfff, 0x200, 0x28000000000, 0x8, 0x6, 0x1, 0x5, 0x100000001, 0x0, 0x2, 0x2, 0x3ff, 0x5, 0x5, 0x6, 0x1, 0x9, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000240), 0x8}, 0x10, 0x3ff, 0x1000, 0x0, 0x6, 0xffffffffffff6c98, 0x100000000}, r8, 0xa, r6, 0x8) 13:55:16 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/snmp\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000000c0), 0x0) syz_extract_tcp_res$synack(&(0x7f0000000140), 0x1, 0x0) ioctl$KDMKTONE(r0, 0x4b30, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000200)=0x5c) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) perf_event_open(&(0x7f0000c86f88)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f0000000300)={0x0, 0x4, 0xffff}) perf_event_open(&(0x7f0000001d40)={0x5, 0x70, 0x3, 0x0, 0x7fffffff, 0x400, 0x0, 0x7, 0x800, 0x0, 0x0, 0x0, 0x7fffffff, 0x100000000, 0x7, 0xec4, 0xde, 0x0, 0x2, 0x3ff, 0x7742, 0x0, 0x6, 0x2, 0x0, 0x6, 0x0, 0x8001, 0x0, 0x101, 0xf1, 0x0, 0xb8, 0xfff, 0x0, 0x962b, 0x5, 0x53d9, 0x0, 0x0, 0x0, @perf_config_ext, 0x1000, 0x7, 0x10001, 0x0, 0x0, 0x0, 0xffffffff}, 0x0, 0x4, 0xffffffffffffffff, 0x2) r1 = syz_open_procfs(0x0, &(0x7f0000001cc0)='fdinfo\x00') ioctl$BLKBSZSET(r1, 0x40081271, &(0x7f0000000100)=0xde90) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r2 = socket$inet6(0xa, 0x400000000001, 0x0) r3 = dup(r2) setsockopt$inet6_tcp_int(r3, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000000)) sendto$inet6(r2, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x5) sendfile(r3, r4, &(0x7f0000d83ff8), 0x8000fffffffe) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}, &(0x7f0000000280)=0x10) 13:55:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000240)=ANY=[]) r0 = syz_open_dev$mice(&(0x7f0000000240)='/dev/input/mice\x00', 0x0, 0x200000) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) openat(r0, &(0x7f0000000380)="2e2f66692e65318c00", 0xa00, 0x30) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) write$evdev(r0, &(0x7f0000000300)=[{{r1, r2/1000+30000}, 0x3, 0x800, 0xffffffff}, {{}, 0x1f, 0x200, 0x28}, {{r3, r4/1000+10000}, 0x3, 0xb31, 0xf485}, {{}, 0x1f, 0x0, 0x7}, {{0x77359400}, 0x3, 0xfffffffffffffffd, 0x3}], 0x78) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) inotify_add_watch(r5, &(0x7f0000000200)='./file0\x00', 0x4000241) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat(r6, &(0x7f0000000180)="2e2f66692e65318c", 0x0, 0x0) r7 = fanotify_init(0x0, 0x0) r8 = socket$inet6(0xa, 0x6, 0x80000001) accept4$inet6(r8, &(0x7f00000000c0), &(0x7f0000000140)=0x1c, 0x0) fanotify_mark(r7, 0x11, 0x8, r6, &(0x7f0000000100)="2e2f66692e65318c00") fanotify_mark(r7, 0x16, 0x1a, r6, &(0x7f0000000040)="2e2f66692e65318c00") r9 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getresuid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f0000000500)=0x0) fstat(r5, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r9, &(0x7f0000000400)='./file0\x00', r10, r11, 0x1800) 13:55:16 executing program 7: setitimer(0x2, &(0x7f000063eff0)={{0x77359400}, {0x77359400}}, &(0x7f0000628000)) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) clock_gettime(0x0, &(0x7f00000000c0)) setitimer(0x3, &(0x7f0000000040)={{}, {r0, r1/1000+10000}}, 0x0) 13:55:16 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) 13:55:16 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=@delneigh={0x1b, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) socket$l2tp(0x18, 0x1, 0x1) [ 393.355145] binder: 27301:27306 ERROR: BC_REGISTER_LOOPER called without request [ 393.368615] binder_alloc: 27301: binder_alloc_buf, no vma [ 393.375360] binder: 27301:27306 transaction failed 29189/-3, size 0-0 line 3136 [ 393.384306] binder: BINDER_SET_CONTEXT_MGR already set [ 393.389798] binder: 27301:27309 ioctl 40046207 0 returned -16 [ 393.396205] binder_alloc: 27301: binder_alloc_buf, no vma [ 393.402051] binder: 27301:27309 transaction failed 29189/-3, size 24-8 line 3136 [ 393.410437] binder: 27301:27309 ERROR: BC_REGISTER_LOOPER called without request [ 393.455845] binder: 27301:27306 got transaction to invalid handle [ 393.456077] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.456104] binder: release 27301:27306 transaction 687 in, still active [ 393.456112] binder: send failed reply for transaction 687 to 27301:27306 [ 393.456121] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.462134] binder: undelivered TRANSACTION_COMPLETE [ 393.462141] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.497967] binder: 27301:27306 transaction failed 29201/-22, size 0-0 line 3013 [ 393.510369] binder: undelivered TRANSACTION_ERROR: 29201 13:55:16 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000000)) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="ffffff395519fd965cbb09a13534ea"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="b2e2c9a2832d5f4b4d7523231a46817ac6211d0666594b3c53302c7fbeca677b39802802c3210f05231a68283e9f67b20e1d6520652bf965da40db8458b549fb22da30375c7adaaa71"], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:16 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) 13:55:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) epoll_create1(0x0) mount$9p_tcp(&(0x7f00000000c0)='127.0.0.1\x00', &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='9p\x00', 0x40, &(0x7f0000000300)=ANY=[@ANYBLOB="7472616e733d7463702c706f72743d3078303030303030303030303030346532332c63616368657461673d282d276367726f7570776c616e30842c6673637d6368652c00"]) close(0xffffffffffffffff) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) userfaultfd(0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x2) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f00000002c0)={0x4, 0x1fd, 0xffffffffffff03ef}) syz_open_dev$sg(&(0x7f0000000180)='/dev/sg#\x00', 0x7, 0x0) munlockall() openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}, &(0x7f0000000380)=0x10) sendmsg$key(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x10}}, 0x0) 13:55:16 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) connect(r0, &(0x7f0000000180)=@l2={0x1f, 0x5030, {0xc4, 0x7, 0x0, 0xba, 0x400, 0x8511}, 0xffffffff, 0x9}, 0x80) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)=0x0) fcntl$setownex(r0, 0xf, &(0x7f00000000c0)={0x3, r1}) sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000040)=@getlink={0x3c, 0x12, 0xa05, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @ipip={{0xc, 0x1, 'ipip\x00'}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, 0x2}]}, 0x3c}}, 0x0) 13:55:16 executing program 7: open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, &(0x7f0000000500)=""/246) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) read(0xffffffffffffffff, &(0x7f0000000140)=""/11, 0xb) alarm(0x0) r0 = socket$packet(0x11, 0x8000000000000004, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xd43f58e118afee75}, 0x4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x18, 0x0, 0x1) connect(r1, &(0x7f0000dcd000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}, 0x2}}, 0x2e) sendmmsg(r1, &(0x7f00000002c0), 0x4000000000000f4, 0x0) 13:55:16 executing program 2: r0 = creat(&(0x7f0000000280)='./bus\x00', 0x10) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000002300)={0x21, 0x23, 0x11, 0x11, 0xa, 0x8000, 0x5, 0xa}) pwrite64(r1, &(0x7f00000000c0)="27ee7974554c3060a38148a4e5c1778a495b41f66d56e0c1b98c1a6998709ec463c01a19a9043ca7c07b531cdb8c7fc1038d91599e5051e08b03d58b34083e003ac13a78b54f2553487882f6865a6de0c7aa6d05818e7fb5ec43", 0x5a, 0x0) clock_gettime(0x0, &(0x7f00000003c0)={0x0, 0x0}) write$input_event(r0, &(0x7f0000000400)={{r2, r3/1000+30000}, 0x0, 0xea9, 0x8}, 0x18) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f00000051c0), &(0x7f0000005200)=0x10) clock_gettime(0x0, &(0x7f0000002500)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f0000002380)=[{{&(0x7f0000000340)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f00000009c0)=[{&(0x7f0000005340)=""/163, 0xa3}, {&(0x7f00000001c0)=""/57, 0x39}, {&(0x7f0000000480)=""/74, 0x4a}, {&(0x7f0000000500)=""/87, 0x57}, {&(0x7f0000005400)=""/170, 0xaa}, {&(0x7f0000000640)=""/157, 0x9d}, {&(0x7f0000000740)=""/177, 0xb1}, {&(0x7f0000000800)=""/174, 0xae}, {&(0x7f0000000240)=""/49, 0x31}, {&(0x7f00000008c0)=""/208, 0xd0}], 0xa, &(0x7f0000000a80)=""/61, 0x3d, 0x8}, 0x1}, {{&(0x7f0000000ac0)=@sco, 0x80, &(0x7f0000000b40), 0x0, &(0x7f0000000b80)=""/125, 0x7d, 0x667}, 0x800}, {{&(0x7f0000000c00)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000000d40)=[{&(0x7f0000000c80)=""/30, 0x1e}, {&(0x7f0000000cc0)=""/105, 0x69}], 0x2, &(0x7f0000000d80)=""/181, 0xb5}, 0x6341}, {{&(0x7f0000000e40)=@generic, 0x80, &(0x7f0000000f80)=[{&(0x7f0000000ec0)=""/103, 0x67}, {&(0x7f0000000f40)=""/28, 0x1c}], 0x2, &(0x7f0000000fc0)=""/78, 0x4e, 0x5}, 0x1}, {{&(0x7f0000001040)=@rc, 0x80, &(0x7f00000021c0)=[{&(0x7f00000010c0)=""/4096, 0x1000}, {&(0x7f00000020c0)=""/203, 0xcb}], 0x2, &(0x7f0000002200)=""/104, 0x68, 0x6}, 0x8}, {{&(0x7f0000002280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/8, 0x8, 0xac}, 0x81}], 0x6, 0x2040, &(0x7f0000002540)={r5, r6+30000000}) ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f0000004f00)=0x7) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000002580)={'team0\x00', r8}) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000440)) fallocate(r1, 0x0, 0x0, 0x1000f4) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f00000026c0)=0x3, 0x4) r9 = open(&(0x7f0000000200)='./bus\x00', 0x4000, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000052c0)={0x0}, &(0x7f0000005300)=0xc) perf_event_open(&(0x7f0000005240)={0x0, 0x70, 0x4, 0x7e, 0x2, 0x180, 0x0, 0x5, 0x6000, 0x1, 0x1, 0x2, 0x400, 0x2, 0x401, 0x10000, 0x3, 0xfffffffffffffff8, 0x32, 0x5f136c9f, 0x2, 0xfffffffffffffff7, 0x37eb, 0xed, 0xdf46, 0x2, 0x2, 0xcb3, 0x7414, 0x2, 0x7fffffff, 0x3, 0x2, 0x3, 0x9, 0x6, 0x60000, 0x3, 0x0, 0xfffffffffffffffa, 0x2, @perf_config_ext={0x4e99, 0x81}, 0x100, 0x5, 0x80, 0x6, 0x800, 0x3, 0x100000001}, r10, 0xd, r9, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r9, 0x0, 0x10, &(0x7f00000025c0)={{{@in=@dev, @in6=@ipv4={[], [], @dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@dev}}, &(0x7f0000000b40)=0xe8) clock_gettime(0x0, &(0x7f0000004e80)={0x0, 0x0}) recvmmsg(r7, &(0x7f0000004e00)=[{{&(0x7f0000002700)=@nfc_llcp, 0x80, &(0x7f0000003bc0)=[{&(0x7f0000002780)=""/212, 0xd4}, {&(0x7f0000002880)=""/4096, 0x1000}, {&(0x7f0000003880)=""/14, 0xe}, {&(0x7f00000038c0)=""/194, 0xc2}, {&(0x7f00000039c0)=""/154, 0x9a}, {&(0x7f0000003a80)=""/227, 0xe3}, {&(0x7f0000003b80)=""/6, 0x6}], 0x7, &(0x7f0000003c40)=""/4096, 0x1000}, 0x5}, {{&(0x7f0000004c40), 0x80, &(0x7f0000004d40)=[{&(0x7f0000004cc0)=""/98, 0x62}], 0x1, &(0x7f0000004d80)=""/76, 0x4c, 0xfffffffffffff18c}, 0xffffffffffffffe0}], 0x2, 0x40, &(0x7f0000004ec0)={r12, r13+30000000}) ioprio_set$uid(0x3, r11, 0x9) mq_timedsend(r9, &(0x7f0000000580)="1c029a695d01f4d09690124404d2e0e5438078712dfe9684d68fd83a50dac4719ce5defbd722f3d5ed", 0x29, 0x0, &(0x7f00000005c0)={0x0, 0x989680}) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000140)=0x10003f) sendfile(r1, r9, &(0x7f0000d83ff8), 0x8000fffefffe) r14 = fcntl$getown(r0, 0x9) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r4, 0x4008240b, &(0x7f00000002c0)={0x0, 0x70, 0x93c, 0x0, 0x401, 0x401, 0x0, 0x5, 0x40, 0x9, 0x3ff, 0x0, 0x3f800000000, 0x0, 0x0, 0x7, 0x400, 0x3, 0x3f, 0x5, 0x3, 0x0, 0x6, 0x1, 0x0, 0x2, 0x6fc3, 0x9, 0xffffffffffffff7f, 0x0, 0x6f0f, 0x3623, 0x0, 0x5, 0x2, 0x0, 0x2, 0xfe, 0x0, 0x20, 0x2, @perf_config_ext={0xa004, 0x5}, 0x4, 0xaa8, 0x1, 0x0, 0x1, 0x9, 0xfff}) clock_gettime(0x0, &(0x7f0000004f80)={0x0, 0x0}) write$sndseq(r9, &(0x7f0000004fc0)=[{0x6, 0x4, 0xff41, 0x0, @time={0x0, 0x989680}, {0x729, 0x5}, {0xfff, 0xc910}, @control={0x4, 0x7fffffff, 0x4}}, {0x7f, 0x7, 0x5, 0x2, @tick=0x7ff, {0xfffffffffffffffc, 0x80000000}, {0x1, 0xeb8}, @result={0x2, 0x1}}, {0x6, 0xff, 0x5, 0x8, @time={0x77359400}, {0x7, 0xff}, {0x1ff, 0x400}, @quote={{0x1, 0x7}, 0x12a, &(0x7f0000004f40)={0xffffffff, 0x557d00, 0x1ff, 0x10001, @tick=0x6, {0x6, 0x7f}, {0x5, 0x7fff}, @queue={0xffffffffffff6d73, {0x5}}}}}, {0x3f, 0xa0b0, 0xfffffffffffffff9, 0x0, @tick=0x200, {0x3, 0x35}, {0x1ff, 0x9}, @time=@time={0x0, 0x989680}}, {0x2, 0x2, 0x0, 0x5, @time={0x0, 0x989680}, {0x8, 0x7}, {0x1, 0x1}, @time}, {0x1, 0x8, 0x0, 0x8, @time={0x77359400}, {0x1, 0x200}, {0x0, 0x7f}, @queue={0x80, {0x1, 0x10000}}}, {0x8, 0x6, 0x8001, 0x5, @tick=0x5374d895, {0x5920, 0xfffffffffffffffa}, {0x6, 0x6}, @control={0x3, 0x4, 0x1}}, {0x6, 0x1, 0x4, 0x4, @tick=0xee, {0x1, 0x3ff}, {0x0, 0x377c}, @connect={{0x1000, 0x80000000}, {0x8000, 0x80000000}}}, {0xfffffffffffff001, 0x1, 0x4, 0x401, @time={0x0, 0x989680}, {0x7, 0x5b}, {0x81, 0x80000000}, @result={0xc5, 0x100000001}}, {0xb04e, 0x0, 0x9, 0x0, @time={r15, r16+30000000}, {0x25ea, 0x3f}, {0x7, 0x7}, @raw8={"785c3f040f897a2bf835e74d"}}], 0x1e0) waitid(0xfffffffffffffffd, r14, &(0x7f0000000180), 0x20000003, 0x0) [ 393.865528] binder: undelivered TRANSACTION_COMPLETE 13:55:16 executing program 3: clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) [ 393.887615] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.893620] binder: undelivered TRANSACTION_ERROR: 29201 13:55:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 393.930244] binder: 27331:27342 unknown command -1563827534 [ 393.938519] binder: 27331:27342 ioctl c0306201 20000040 returned -22 [ 393.947488] binder_alloc: 27331: binder_alloc_buf, no vma [ 393.954359] binder: 27331:27342 transaction failed 29189/-3, size 0-0 line 3136 [ 393.963749] binder_alloc: binder_alloc_mmap_handler: 27331 20001000-20004000 already mapped failed -16 [ 393.973537] binder: BINDER_SET_CONTEXT_MGR already set [ 393.979494] binder: 27331:27342 ioctl 40046207 0 returned -16 [ 393.985625] binder_alloc: 27331: binder_alloc_buf, no vma [ 393.985645] binder: 27331:27346 transaction failed 29189/-3, size 24-8 line 3136 [ 393.985863] binder: 27331:27346 unknown command -1563827534 [ 393.985871] binder: 27331:27346 ioctl c0306201 20000040 returned -22 [ 393.993642] binder: 27331:27347 got transaction to invalid handle [ 393.993652] binder: 27331:27347 transaction failed 29201/-22, size 0-0 line 3013 13:55:17 executing program 1: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='tmpfs\x00', 0x100000, &(0x7f0000000200)="be42aa81467d46469c75a118017f55661f75f998e9c23f8e15a87013cadb3c121e751ae6") ioctl$TCSETS(r0, 0x5402, &(0x7f00000001c0)) r1 = syz_open_pts(r0, 0x0) write(r0, &(0x7f0000c34fff), 0xd9dbd89c) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x3) [ 393.999655] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.999679] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.999707] binder: send failed reply for transaction 694 to 27331:27342 [ 393.999763] binder: undelivered TRANSACTION_COMPLETE [ 393.999769] binder: undelivered TRANSACTION_ERROR: 29189 [ 394.068709] binder: undelivered TRANSACTION_ERROR: 29201 [ 394.113797] binder_alloc: 27349: binder_alloc_buf, no vma [ 394.140622] binder: 27349:27351 transaction failed 29189/-3, size 24-8 line 3136 [ 394.150490] binder: 27349:27351 ERROR: BC_REGISTER_LOOPER called without request 13:55:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x8, 0x40) write$P9_RLERRORu(r2, &(0x7f0000000180)={0x1a, 0x7, 0x2, {{0xd, '/dev/binder#\x00'}, 0xe6a}}, 0x1a) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="852a62730000000016385e3aa352653d59ad5fbdc65ccecfc4fe07f653234f0c6e96683b72a66abfc39ec0a6517aa0c5d4ae81d2014756200745ec455bd9b53b2338b448632377f8fba4c9c2079b4db7ed7a69fc9acbc4643f2b038d1309039dd976f0a2d80a1f0000001f67c21cddf8f136490aff7a76bff24b923977364258b3481cd94d77bbf71070ce5232881de681525b7e7cc8379aa2a7d9a84f0b6cbd040000004acad0c8e2ab0984daa098d6e4f6a5cb85ed5cf027e7f763107ec5cc660d33b656d918f0f03ebbb02ebe7239da86e7a09c5dcb", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:17 executing program 4: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x4, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000040)) 13:55:17 executing program 3: clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) [ 394.200533] binder: 27349:27355 got transaction to invalid handle [ 394.219308] binder: 27349:27355 transaction failed 29201/-22, size 0-0 line 3013 13:55:17 executing program 1: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000f6bfe8)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000404000/0x600000)=nil, 0x600000}}) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f00000000c0)) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000b22000/0x2000)=nil, 0x2000}, 0x2}) ioctl$ASHMEM_GET_SIZE(r2, 0x7704, 0x0) [ 394.305720] binder: BINDER_SET_CONTEXT_MGR already set [ 394.318040] binder: 27364:27367 ioctl 40046207 0 returned -16 [ 394.330670] binder_alloc: 27349: binder_alloc_buf, no vma [ 394.336383] binder: 27364:27367 transaction failed 29189/-3, size 24-8 line 3136 [ 394.360179] binder: 27364:27367 ERROR: BC_REGISTER_LOOPER called without request 13:55:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 394.413618] binder: 27364:27374 got transaction to invalid handle [ 394.435137] binder: 27364:27374 transaction failed 29201/-22, size 0-0 line 3013 13:55:17 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:17 executing program 4: socketpair$unix(0x1, 0x800000400000003, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x80000, 0x1d0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/hash_stats\x00', 0x0, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x420000, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000000380)=r3) write$9p(r1, &(0x7f0000000440)="94c92dbc53bc51c3a643fb643af084376b14df700a160a26df13bebcd73893077f38e0d23791a674d11a01b4509f05b5f4f2949c602cd109dff649dcd3371ddac2d3c961220c24d676938939ca5a722c90cc4ac9ab96a883b3059a6bd563887f9b7355f0ae440fa89e49847ff1375a26840c0b30a23d0438375a660df467632164bc3a090212fdc2ac541ab355d0b7dce08bc759cf50eca7b6583069e2d6ddc00cc9d6ee6f8b31d1acd79aaaf2e8bef84e709e48b55ff1f373fd7da62043869dc25cdec7d6317c1ec582e8eab75f209fff515f2474a0af35b4b8cf2c0face833477b04263c0ab4bc0c5472fffa943cbc544a9448b67a618b09065e58bc0fa59833cf03e467ae711fad0e00ceb514fb351b47eb6bd7bd151abf4edc98040ec3", 0xfffffe35) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000280)={0xffffffffffffffc8, 0x33, 0x1, 'queue0\x00', 0x6}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x40) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x9, 0x4) setrlimit(0xc, &(0x7f0000000000)={0x0, 0xfffffffffffffffa}) open(&(0x7f0000000240)='./file0\x00', 0x8000, 0x80) futex(&(0x7f0000000040)=0x2, 0x3, 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000100), 0x0) 13:55:17 executing program 3: clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) 13:55:17 executing program 1: r0 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0x11}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000001580)=[{&(0x7f0000000080)=""/27, 0x1b}], 0x1, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x10081, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f0000000140)={0x2, 0x2, 'client1\x00', 0x7, "e94c741d7621d2d0", "fcb3b58a574a00f42c7c33286b0a3ac34abf437e5dcb12e5a5f2086031519c92", 0x2, 0x6}) 13:55:17 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000180)=0x10000000000062) r1 = epoll_create1(0x0) r2 = dup(r1) ioctl$BLKDISCARD(r2, 0x1277, &(0x7f00000001c0)=0x1ff) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x44, &(0x7f0000000000)={'TPROXY\x00'}, &(0x7f0000000040)=0x1e) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)) r4 = syz_open_pts(r0, 0x0) r5 = fcntl$dupfd(r0, 0x0, r1) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f0000000240)=0xc) write$FUSE_LK(r5, &(0x7f0000000100)={0x28, 0x0, 0x4, {{0x1, 0x4, 0x3, r6}}}, 0x28) ioctl$TCXONC(r4, 0x540a, 0x0) 13:55:17 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) fcntl$getownex(r0, 0x10, &(0x7f0000000140)) sendmsg$key(r0, &(0x7f000033efc8)={0x0, 0x0, &(0x7f0000aa8000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="0209007d068c58f5b37f020000000000c07740cf2da81a8c6b29a4bdbc0c54e7fe25bb30053472f6d0bb243df4c96bc751fba34e710f822d7ff74faff5a41dd2dd1585a4efea7b2d11b8ca9035942e9585d3e97147a579cad73559051329e61e88c010a04f6b8dc5af092c436fc301e19b143ad9282926920b402421d3ce47fc3b682a69b0379461e70740618a14645030e52610f243ed9497234e89616738ddd08e7635b7e3ac727e7a24c239f575af0002f60104"], 0x10}}, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x34) ioctl$TCFLSH(r1, 0x540b, 0x85) socket$key(0xf, 0x3, 0x2) ioctl$UI_END_FF_ERASE(r1, 0x400c55cb, &(0x7f0000000100)={0x4, 0x1, 0x6}) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="2321202e2f66696c65302020766d6e6574306d696d655f747970656eac82ac3e24d39af73b9e63c83b076f646576b5706f7369785f61636c5f6163636573732620656d302073656ce63e75785e2d657468316c2c2d202d25656d307d0ac809d473003bdfc490d16718b6a120c9eaf45a471bd807873a13b92a5d30b5f8a7227ae67b85014dc97f45f73d4c"], 0x8b) ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f0000000180)={0x5, 0x10001, 0x1ff, 0x2a0, 0x9}) 13:55:17 executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000240)={0x29, 0x3, 0x0, {0x1, 0x8, 0x0, 'group_id'}}, 0x29) open(&(0x7f0000000040)='./file0/file0\x00', 0xc0, 0x20) [ 394.906184] binder: undelivered TRANSACTION_ERROR: 29189 [ 394.914813] binder: undelivered TRANSACTION_ERROR: 29201 13:55:18 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000080)={0xe26f, 0x80000001, 0x0, 0x8}, 0x10) 13:55:18 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000040)=""/24, &(0x7f0000000480)=0x18) ioctl$TIOCCBRK(r0, 0x5428) r2 = inotify_add_watch(r0, &(0x7f0000000000)='./file0\x00', 0x100) inotify_rm_watch(r0, r2) 13:55:18 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @rand_addr}, {}, 0x8, {0x2, 0x0, @broadcast}, 'veth0_to_bond\x00'}) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/status\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='./file0\x00', 0x2) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f0000000240)={'filter\x00', 0xa9, "ff902618cef31239fe865146574934e32c4bd497ba5093011feebdfd36a1db945e2a29da0c7acebdfdb782546acf7b2d9f05a09f4fdcba7540baedab6232384362add5fd3828a7f72d0591e0deb25f5f8788048c64e9a983fc23d9042979d81074ecc44f850170bf3e9897ba4bb8befd0a3499e56d5c9acb9756bbcfbcd36713acf73dec007d5c309d1320906509c58342b7f188e1139cdadb69dfb6941e51ba6d36a42187f39b65b5"}, &(0x7f0000000080)=0xcd) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000000c0)=[{0xf, 0x401}, {0x4, 0x6}, {0x3, 0xfffffffffffffffa}, {0xf, 0x8}, {0x4, 0x100000000}, {0x7, 0x8}], 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000001c0)={'bond0\x00', 0x200}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{}, {}, 0x8, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000380)={0x4, {{0x2, 0x4e20, @multicast1}}, 0x1, 0x6, [{{0x2, 0x4e23, @broadcast}}, {{0x2, 0x4e21, @loopback}}, {{0x2, 0x4e22}}, {{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x16}}}, {{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}}, {{0x2, 0x4e22, @broadcast}}]}, 0x390) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x0, 0x4) [ 395.024299] binder: 27416:27421 transaction failed 29189/-22, size 24-8 line 3013 [ 395.044437] binder: 27416:27421 ERROR: BC_REGISTER_LOOPER called without request [ 395.054030] binder: 27416:27421 got transaction to invalid handle [ 395.060583] binder: 27416:27421 transaction failed 29201/-22, size 0-0 line 3013 [ 395.074691] binder: undelivered TRANSACTION_ERROR: 29189 [ 395.105899] binder: undelivered TRANSACTION_ERROR: 29201 13:55:18 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:18 executing program 7: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00007a0000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r0, r1) ioctl$ASHMEM_GET_SIZE(r2, 0x7704, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r4, &(0x7f0000e4ffc8)={&(0x7f0000beb000)=@abs, 0x6e, &(0x7f000000d000), 0x38d, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES32=r3, @ANYBLOB="00000000dd1d6e17a589eb57dcb6fcaa6b2085c882d8630bffa37c4022c5ce1e1e7fbbc0b72331f26d61fcb3b7b5f509737a65fdd60238db01662f51f96d20a65f80b53f5d456144ae1beffb9549"], 0x18}, 0x0) close(r3) close(r0) [ 395.109453] binder: 27364:27429 ERROR: BC_REGISTER_LOOPER called without request [ 395.134693] binder: release 27364:27429 transaction 708 in, still active [ 395.151188] binder: send failed reply for transaction 708 to 27364:27374 [ 395.166002] binder: undelivered TRANSACTION_COMPLETE 13:55:18 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) write$P9_RREADDIR(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="2a000000290100000000000000000000b5e6bdbed0770cf084fe43b7ef984c3e0000a73d11108f872400"], 0x2a) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000000140)=0xc) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getgid() r4 = getegid() getgroups(0x1, &(0x7f00000001c0)=[r3, r2, r3, r4]) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@afid={'afid', 0x3d, 0x80000001}}, {@cache_none='cache=none'}]}}) 13:55:18 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f0000000000)="f46ba5c526d1ce322495859d4893cdd5c17a09ba2981ea77a523") mknod(&(0x7f0000000080)='./file0\x00', 0x8000, 0x7f) [ 395.179112] binder: undelivered TRANSACTION_ERROR: 29189 [ 395.191294] binder: undelivered TRANSACTION_ERROR: 29189 [ 395.203691] binder: undelivered TRANSACTION_ERROR: 29201 13:55:18 executing program 5: select(0x40, &(0x7f0000000040)={0xffffffffffffff81, 0x0, 0x7, 0x401, 0x3, 0x3, 0x9d, 0x4def2da6}, &(0x7f0000000080)={0x2, 0x6, 0xfffffffffffffe01, 0x8, 0x51f, 0x2, 0x1000, 0x8}, &(0x7f00000000c0)={0x3, 0x4, 0x7, 0xc00000000000, 0x6, 0x0, 0x8}, &(0x7f0000000140)={0x0, 0x2710}) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockname$netlink(r0, &(0x7f0000000180), &(0x7f00000001c0)=0xc) getsockopt$netlink(r0, 0x10e, 0x9, &(0x7f0000000200)=""/160, &(0x7f0000000000)=0xa0) socket$nl_netfilter(0x10, 0x3, 0xc) 13:55:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ppp\x00', 0x101000, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000340)=0x1a, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = dup(r1) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x200000, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x4e24, 0x0, @local, 0xfffffffffffff801}, {0xa, 0x4e21, 0xc, @remote, 0x9}, 0x2, [0x1, 0x82, 0x3, 0x100000001, 0x0, 0x10000, 0x2, 0x3]}, 0x5c) r5 = getpid() sched_getattr(r5, &(0x7f0000000240), 0x30, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x240, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="00634040040000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r0, @ANYBLOB="000000000400000000000000"], @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000003000000000004febae42c63f67f19460"], @ANYBLOB="106308400400000000000000"], 0x0, 0x0, &(0x7f0000000480)="d6097f05301ce98ad340b6e2b88417c9ab113b812ef0d5790c9b29c428abe247d940bb9d604b5a4ee96fd8cefe19bcf9f6ff94ce19fffb3afd134c685e6731d56e43526d885eedcfc8921e48e7220baafbc947762158cc88f7e0a2dee50d620ece14e767175651dde7636ea3380174ce48abfd5d56c1638a732d975e3a4e5cef84712eeb581d58c17aa01136f6c76e55896ab5d0f3a3fcf46830775cd7b46cea12f64a1747e94a3090de0dfbd33c6a126e1f9273f09ad3919bb6157247dd415ee47f29e7204894e3bf99c1f23ba7bd094a8232c854b55de347a3985db6ae0608dfc020a4dd9da9b9a81f320162b0b8b20734836b7da53cd94be6ef2997230b9bb07dcb3fe55af0c0e0af49f50b7e89189d6b51821484391af6be3cdccd13a63416b1654c5054b60d97eb1699c956df96a218917c1f4e00a83709a16c21364facf48be05bca0ac212545fb18b80e2dcd9baa9fa04588f8c30deef39"}) write$binfmt_elf64(r3, &(0x7f0000004300)={{0x7f, 0x45, 0x4c, 0x46, 0x20, 0x80e9, 0x2000000000, 0x739885bf, 0x6, 0x3, 0x3f, 0xc, 0x129, 0x40, 0x134, 0x8, 0x20, 0x38, 0x1, 0xffffffffffffff80, 0x1, 0x3}, [{0x6474e553, 0x100, 0x7, 0x9628, 0x0, 0x8, 0x7fffffff, 0x100000001}, {0x4, 0x10, 0x87d5, 0x7, 0x1ff, 0x4, 0x669b, 0x7}], "636f954e510301242ae9cf37c83b618297493200ddbcf430bca6284954eca1c5f8268ca5f765b1b02c7815eae8b1abab851b96024ee428e0cf811cfa88920501ed07f513e99913da745b927a669468e23c5acd89bdd1db1b07effc863984a7e8f391308583c32df22aa5af325e2722692ed959a3b90d0a751aa1e46365ff4ca1f74d72208da91cb092050f8485604059524f", [[], [], [], []]}, 0x542) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000440)=0xff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) recvmmsg(r4, &(0x7f0000004000)=[{{&(0x7f0000000880)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000000b00)=[{&(0x7f0000000900)=""/192, 0xc0}, {&(0x7f00000009c0)=""/4, 0x4}, {&(0x7f0000000a00)=""/172, 0xac}, {&(0x7f0000000ac0)=""/10, 0xa}], 0x4, 0x0, 0x0, 0x800}}, {{&(0x7f0000000b40)=@pppol2tpv3in6, 0x80, &(0x7f0000000e00)=[{&(0x7f0000000bc0)=""/198, 0xc6}, {&(0x7f0000000cc0)=""/6, 0x6}, {&(0x7f0000000d00)=""/237, 0xed}], 0x3, &(0x7f0000000e40)=""/4096, 0x1000, 0x100000001}, 0x40}, {{&(0x7f0000001e40)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002200)=[{&(0x7f0000001ec0)=""/14, 0xe}, {&(0x7f0000001f00)}, {&(0x7f0000001f40)=""/109, 0x6d}, {&(0x7f0000001fc0)=""/71, 0x47}, {&(0x7f0000002040)=""/246, 0xf6}, {&(0x7f0000002140)=""/149, 0x95}], 0x6, 0x0, 0x0, 0x3ff}, 0xffff}, {{0x0, 0x0, &(0x7f0000002480)=[{&(0x7f0000002280)=""/42, 0x2a}, {&(0x7f00000022c0)=""/151, 0x97}, {&(0x7f0000002380)=""/216, 0xd8}], 0x3, 0x0, 0x0, 0x7}, 0x2}, {{&(0x7f00000024c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f0000002880)=[{&(0x7f0000002540)=""/76, 0x4c}, {&(0x7f00000025c0)}, {&(0x7f0000002600)=""/153, 0x99}, {&(0x7f00000026c0)=""/46, 0x2e}, {&(0x7f0000002700)=""/177, 0xb1}, {&(0x7f00000027c0)=""/143, 0x8f}], 0x6, &(0x7f0000002900)=""/241, 0xf1, 0x7}, 0xffffffff}, {{0x0, 0x0, &(0x7f0000002fc0)=[{&(0x7f0000002a00)=""/232, 0xe8}, {&(0x7f0000002b00)=""/100, 0x64}, {&(0x7f0000002b80)=""/155, 0x9b}, {&(0x7f0000002c40)=""/23, 0x17}, {&(0x7f0000002c80)=""/141, 0x8d}, {&(0x7f0000002d40)=""/238, 0xee}, {&(0x7f0000002e40)=""/222, 0xde}, {&(0x7f0000002f40)=""/108, 0x6c}], 0x8, 0x0, 0x0, 0x1}, 0x2}, {{&(0x7f0000003040)=@xdp, 0x80, &(0x7f0000003280)=[{&(0x7f00000030c0)=""/185, 0xb9}, {&(0x7f0000003180)=""/206, 0xce}], 0x2, &(0x7f00000032c0)=""/179, 0xb3, 0x5}, 0x10001}, {{&(0x7f0000003380)=@xdp, 0x80, &(0x7f0000003840)=[{&(0x7f0000003400)=""/215, 0xd7}, {&(0x7f0000003500)=""/49, 0x31}, {&(0x7f0000003540)=""/10, 0xa}, {&(0x7f0000003580)=""/139, 0x8b}, {&(0x7f0000003640)=""/201, 0xc9}, {&(0x7f0000003740)=""/201, 0xc9}], 0x6, &(0x7f00000038c0)=""/195, 0xc3, 0x4}, 0x1}, {{&(0x7f00000039c0)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000003d40)=[{&(0x7f0000003a40)=""/211, 0xd3}, {&(0x7f0000003b40)=""/63, 0x3f}, {&(0x7f0000003b80)=""/83, 0x53}, {&(0x7f0000003c00)=""/48, 0x30}, {&(0x7f0000003c40)=""/80, 0x50}, {&(0x7f0000003cc0)=""/105, 0x69}], 0x6, &(0x7f0000003dc0)=""/103, 0x67}, 0xea2}, {{&(0x7f0000003e40)=@pptp={0x18, 0x2, {0x0, @loopback}}, 0x80, &(0x7f0000003f00)=[{&(0x7f0000003ec0)}], 0x1, &(0x7f0000003f40)=""/175, 0xaf, 0xa31}, 0x1}], 0xa, 0x20, &(0x7f0000004280)={0x77359400}) ioctl$TUNSETIFINDEX(r4, 0x400454da, &(0x7f00000042c0)=r6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 395.274901] binder: 27443:27448 transaction failed 29189/-22, size 24-8 line 3013 [ 395.297334] binder: 27443:27448 ERROR: BC_REGISTER_LOOPER called without request [ 395.322786] binder: 27443:27448 got transaction to invalid handle 13:55:18 executing program 7: r0 = userfaultfd(0x80800) r1 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x800) read$FUSE(r1, &(0x7f0000000400), 0x1000) ioctl(r0, 0x1ff, &(0x7f0000000000)="94e6968bb792b12d5064f0351bb74cc08ebc1de62f92730740c093901df95f1999974ba9b81e8c370f4c8bdbefa122bfeec5f111d49574ff73d66620d2dfe9e4c364253ad793018fb2160f0f65c4767fc5e177dc9f24e0411bf731d4108f535ff073fdccbeece04634cb9f1cf903dbb2e3ebb46304e035fd5c859735fcade9143a0fb0d508d4e1a194721c3cdbac6f9935167d7d3179823a3db6b1d06cf12b356167f96b29b0ffcee21c1c6f10d946bffcc5549ef0f5b4c4a32319f3") socket$nl_route(0x10, 0x3, 0x0) 13:55:18 executing program 4: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000140)={0x0, &(0x7f0000000080)}, 0x10) r0 = perf_event_open(&(0x7f00000004c0)={0x7, 0x70, 0x2, 0x1, 0x80, 0x9, 0x0, 0x9, 0x8, 0x1, 0x6, 0x6c4, 0x40, 0x9, 0x2, 0x7, 0x3, 0x1f, 0x8, 0x2e0, 0x2, 0x4, 0x8, 0x9f58, 0x5, 0x93ff, 0x4, 0x7e000000, 0x4, 0xffff, 0x1ff, 0xfffffffffffffffc, 0x401, 0x6, 0x2, 0x100000001, 0x4030, 0x2d0, 0x0, 0xfe3, 0x5, @perf_config_ext={0x400, 0x9f7}, 0x200, 0x0, 0xffffffffffffffef, 0x0, 0x8, 0xb9e, 0x6}, 0x0, 0x3, 0xffffffffffffff9c, 0x1) readv(r0, &(0x7f0000001880)=[{&(0x7f0000002900)=""/152, 0x98}, {&(0x7f0000000600)=""/200, 0xc8}, {&(0x7f0000000700)=""/2, 0xfffffffffffffefb}, {&(0x7f0000000740)=""/23, 0x17}, {&(0x7f0000000780)=""/9, 0x9}, {&(0x7f00000029c0)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/176, 0xb0}], 0x7) r1 = socket$inet6(0xa, 0xf, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet(0x2, 0x3ffffffffffffffd, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80040000000002, &(0x7f00000000c0)=0x65, 0x4) bind$inet(r3, &(0x7f0000000200)={0x2, 0x4e23, @broadcast}, 0x10) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000280)) setsockopt$inet_tcp_int(r3, 0x6, 0xa, &(0x7f0000000000)=0x3f8, 0x4) ioctl$EVIOCGBITSW(r2, 0x80404525, &(0x7f0000000300)=""/196) prctl$intptr(0x6, 0x1) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000100)='illinois\x00', 0xd470041877f0fcc9) bind$inet(r3, &(0x7f0000000440)={0x2, 0x4e24, @multicast2}, 0x10) sendto$inet(r3, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, &(0x7f0000000240)={'nr0\x00', 0xfffffffffffffff8}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000180), &(0x7f00000001c0)=0x30) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x3f, &(0x7f00000002c0)=0xc4, 0x4) shutdown(r3, 0x1) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='pids.events\x00', 0x0, 0x0) ioctl$RTC_VL_CLR(r4, 0x7014) ioctl$sock_inet_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f0000000480)={'nr0\x00', {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x17}}}) [ 395.345572] binder: 27443:27448 transaction failed 29201/-22, size 0-0 line 3013 [ 395.368726] binder: undelivered TRANSACTION_ERROR: 29189 [ 395.376786] binder: undelivered TRANSACTION_ERROR: 29201 13:55:18 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x40080, 0x0) r2 = syz_open_pts(r0, 0x1) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000040)={0x0, 0x3b}) write$binfmt_elf32(r2, &(0x7f0000001740)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38}, [{0x0, 0x0, 0x0, 0x0, 0xa}], "383343fa", [[], []]}, 0x25c) 13:55:18 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:18 executing program 2: r0 = socket(0x2, 0x80000000000001, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000200)=""/117, &(0x7f0000000280)=0x8) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x101000, 0x7f) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) ioctl(r4, 0x4000008912, &(0x7f0000000100)="295ee1311f") ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001a00)={'team0\x00'}) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000001a40)={@empty, @multicast1}, &(0x7f0000001a80)=0xc) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000140)={0x55, 0x4, 0xfffffffffffff801, {0xb62, 0x3}, {0x18000, 0xffff}, @const={0x4, {0x0, 0x8, 0x44a, 0x6}}}) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000001b00)={{{@in=@multicast2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@dev}}, &(0x7f0000001c00)=0xe8) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000001c0)={0x0, @remote, @local}, &(0x7f0000001cc0)=0xc) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000001e40)={0x0, @empty, @multicast1}, &(0x7f0000001e80)=0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'veth0_to_bridge\x00', r5}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000001f00)={{{@in=@rand_addr, @in=@multicast1}}, {{@in6=@ipv4}, 0x0, @in6=@local}}, &(0x7f0000002000)=0xe8) setsockopt$inet6_buf(r2, 0x29, 0xdd, &(0x7f0000000480)="e451f55093e3cc8556636adc726c485b6fd131ea184871f8b1d60c36fd5bef22c32b975478faf58c3c3a24dd77a1ce4ddb84699da7cd6df893a47e3ed30aa9b6583118729acf0de1165bea0a11c5379d3693e7146ce933216aefc2e9066b4242ac647888be82bea292126c777dca7661df9c4bef184d52b4e40a64da5cc74a7d20e3ec7f8fb3a363b1d16abf9902619d9026e54f549c0ab2092ce5ab49486e8b92a348bb597e9348f7383bcf95fb148eabcdafcc9bfd45ce4ec8b0e3743b8d9569d1ad68129995347b1b706f35304408ec259770f855e925d3f865a0226763170a674cc0aa3cd14b5e4130803245bc9dfd2c00", 0xf3) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000002100)={'team0\x00'}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000002140)={0x0, @loopback, @dev}, &(0x7f0000002180)=0xc) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000300)=""/19) fcntl$F_SET_FILE_RW_HINT(r2, 0x40e, &(0x7f00000003c0)=0x3) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000001980)={@remote, @local, @loopback, 0x3, 0x7f, 0x3, 0x100, 0x0, 0x200}) r6 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) read(r1, &(0x7f0000000000)=""/11, 0xb) tkill(r6, 0x0) [ 395.393465] binder: 27457:27459 got transaction to invalid handle [ 395.403971] binder: 27457:27459 transaction failed 29201/-22, size 0-0 line 3013 [ 395.431918] binder: 27457:27459 ERROR: BC_REGISTER_LOOPER called without request 13:55:18 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() getpgrp(r1) sendfile(r0, r0, &(0x7f00000000c0), 0x6) r2 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0xa, &(0x7f0000000100)=0x3, 0x4) r3 = dup(r2) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) fcntl$notify(r3, 0x402, 0x4) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x7fff) open(&(0x7f0000000140)='./bus\x00', 0x800, 0x22) sendfile(r3, r4, &(0x7f0000d83ff8), 0x8000fffffffe) 13:55:18 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000480)=""/197, 0xc5) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000000)={0x0, 0x0, 0x0, 'queue1\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f00000002c0)={0x0, 0x1bcecd97, 0x3, 0xfc, 0x8, 0x9d}) tee(0xffffffffffffffff, r1, 0x0, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000000140), 0x28616813) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f0000000700)) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCDELDLCI(0xffffffffffffffff, 0x8981, &(0x7f0000000680)={'ifb0\x00', 0x7}) futex(&(0x7f000000cffc), 0x0, 0x4000000000001, &(0x7f0000000000)={0x77359400}, &(0x7f0000000200), 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x6000, 0x0) flistxattr(r2, &(0x7f0000000580)=""/249, 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f00000001c0)={0x0, 0x80, 0x0, 'queue1\x00', 0x20000000}) setsockopt$inet_tcp_int(r0, 0x6, 0x1f, &(0x7f00000000c0)=0x20, 0x4) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@loopback, 0x2, 0x3, 0x1, 0x1, 0x2, 0x8001, 0xd10}, 0x20) [ 395.469411] binder: 27466:27472 ERROR: BC_REGISTER_LOOPER called without request [ 395.477205] binder_alloc: 27466: binder_alloc_buf, no vma [ 395.488700] binder: 27466:27472 got transaction to invalid handle 13:55:18 executing program 6: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:18 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") socketpair(0x5, 0xa, 0x1, &(0x7f0000000040)) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) sendmsg(r1, &(0x7f0000000000)={&(0x7f00000000c0)=@in={0x2, 0x4e22}, 0x80, &(0x7f0000003580), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="2800000000000000000000000700a571f87d0f030001d5c9e8000000000000000000000000000000"], 0x28}, 0x0) 13:55:18 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup3(r0, r0, 0x80000) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000001440)=0x0) r3 = geteuid() r4 = getegid() sendmmsg$unix(r1, &(0x7f0000001540)=[{&(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000000)=[{&(0x7f0000000240)="31731e3d724623ac96e77bb5045ae1186d78b7e8fcace375d5b680e53f4f3c7f17e18b02b15f53a2898cb9bbf1a0835cbafc8775e77eb49fd6ed12154df04bca73b802d749b694fd8a8a57fc34c5be9ae33e5bf2318af5a8f3e36066e7", 0x5d}, {&(0x7f00000002c0)="c82c7659f8c93774bb3e177461363366db3d96bef113e12cbcaecce0e7bc6144b570d6dad99bf739b1451ad6e89928dfa6ecdfe9ff8fd65b26785cc4d7b7604b4e2ab989e11224474d159a44ed65601cfc27f39ac0a978f03b86fcc8228e0fda08414efb9541a7e35fa1586455a2ee15bef8c3", 0x73}], 0x2, 0x0, 0x0, 0x10}, {&(0x7f0000000340)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f00000001c0)=[{&(0x7f00000003c0)="f02b20c53195c06f219806720b26bd2fb7c1bf0b419d1aec07c2ac4d999fdf7d0f960340d21a802727590ef3f215be95bfc1f2ce3e1b871f3427e6b9134a650ecf2a9b3a01160767dfbd5f7944977e7abbe386ae5f8f55acf5322b451d1e6d63dac6511eef013fcb7c4c163a150462e34f1ed8d4e4bc4ee7e1bf2a1c1123e3c5809ef93c8fadad405c0aa2c3994654c8a09e486ebf067e82f8d18ee7b07e191392666108c35230b59848af660a20cfdaff0570bb8e93c39eee8388d726f9ba99e20982499de8224fa476131a0b5d953a22306ef79c89a9159b80f4417ee8d273390d95ff6bac52fcbb2a57eb47d2b995430b49143dd225a3964d916a2d8d04c27f986282eb9be20b7edf238f831fce49b45dca6db8d50ee0f2f93e0660cb4403fa29f19182e2e6813dfb2ef1510a9dcef11f808dc661faf6fd6dfaa3457f5c4fbb97f6b800cf0d45a64ff69e776489ef26ea668bb07cb1167c4504d074dd1ddbe07c0a9a1810b59a238c64b44989c86c11a8ff9af24d33b3e9babe5d5ec29b495e052332b6fc29c79ecabbd60087f9994666de48790fc58fcc5fbc01173bcfe1825c8fe8f11cc07a096db90c9b4f550725a8b351548ec5e8b8709166fb08ab5a31fb39367a287702f9e0b512ccceec9efa49f162bc651598a89c3f4b8fc69bacaf8366a15e77c740d48c93d66d3b969e5320c9f643211d29d794c54e25f917d36b2ba471f3e4be058d96dc68c6530660875650c2ce3ac69b945ff147d6d134688da2c22b89b5fc017ab3a3b7f79c5141cb1cb7006c8b24347cd23cd6d5b1abf53347c16fa28459be35adcaabb66d2da743b619c832b73762141af44ee9eb31791a47af982071ebd2ae82b710f7310dd49ca0884b3732fdbd5dcfd9fd532806d80215e9d2b573755a0cf8aeb1721c585a0a51d4614d3e1c5dee8583cf206696c9c4e1a1df5f8176a44d2cd8019896b68ac4090bee7847c8b6ad34b3d62b08b22fce77c6a25394594235ceaba76b5debfb7909d01ef2c80f58c123fdc636b0946d3df38680106aa671a34a60d891e38f3c4af7f126a7dcfabf1162734454874e2905b4288d4973d6b57286fad06ff5d416d9dce73204b782ad89156e026181ede96a0a9fedabf0896a11a77afda46c0b5698fc995fb433cb97816ff4229fca0f8a4e611c23adbf88df5ed3be84a88e47ee017c5bff41c828f00bc718f739bb30ac40a639056315c2b54137a9786db734e5d7e5b5686d2f51deccec8918db3b3407fd8e320a2e1eb33bb88bc12b08f1f7f8f782a2af33b06972c8069bf330ce6c13f10109d4315a83c3ade423fa34aa55bdb32a6d515c1097f2ea51fc4cdeb5719607cea423ff2de1ec4211e9fd5ff374c4d7cd11b9ef864743fdf42b096906a64a009c3c871a1c8fae227dfafd4e2f4adad41b3cff90d5fa73d15f4b781460c41199dadfe3426857032dcb6f0f93aa8e74d1b8067d1b0e5c8e2603edf6d81a4f05121212615b7bb97c8d3e273bd14e1fe7335b6c5c53c089310751f309c34019badaff9ef8d77b739f241545615d366862ab18585f44cae85f732422e37ec062b31aa6ee4ee400cdb587e82fde4a401cb7029068083f2ab05714337f7f4aa120c28799103e1d6a31cc916fa481b42d7c0024b58f9e965252300df56196ddb3e72b3fb9f145338d6e9f2092b251615d76afc90ac93c8b68bc98dda2330de66523700463c38ec248e24575a262f37eeb8a0e37901adc55fceb3ebb1c0f3d2666cc76dac19fc72c64e1533baba69d25c160b19bd4fd8ac5377a7e34a54c1a63e4f90ebc75fb9b81067a489fa960e40ecaeb891aa4c8582a0b1e0438e0a19a1746d95ceb985b59117451925dd1ab5853c416c80fe230052a6bd47b9f8a045deb65bb5cdab9dc7dc7fa322d7c682a84ed527d63b1cc2545d5d13b850198599ae9ac606e17d4a5a1d31b7f5be66ef491d952d73c8f01d8f30666ad56cbf5ea915f382a86c1a27e14f9c995c2fe8f3024ec55f8b9be21f9c572e902b33c8591434bc3b8cb6240d93c5e1e32b103cc7a0a2524a2e8a79bb9330d5b7e7966388aec0d9109b755030f2d514e1efed0861aa0c41b4bfa55b9cb30bd1426ae32ffba3e2fb3f3889c699b48fa0937a3c97d47172f1d5ec4f97c70d27796d7a959d69fd66c92d551b2a5a92fe449fa276358a080c5b9a1ac3929c758ac19f9649a9cf63f9a8061f357bec7c7850bf7611622de018e8b0bb129fd514bdf58b74f8788da155ef90e16644b6a4b22ba1af7f99988538d363f8f7816b96c52c26d048cc8e03fe5b264163d91af68ae2dd5685070a7ed44772032261d51c0b030aaa65fd364ccac2858e94ea263346fbfe23b94f330bcdf7e1f5ee12effd2d583fb9c14f298f3650510d3b85c1ad141e68826c882e7ef7ab42663e3bba01e06477ea5d525b0f9cb88d7bc8e96e99d33da1105619617d52c29490c47be0c4f5702a533314f066542e5ddd29465f8e99aefe0b81ed6816f6babb4173e2b08319b4c3a45992b1425ca17499e7debc1a360e535f83c0b280134e3419f5c7be13598a1e1d7c9966587e6e829a610fcb889a08f5f6f06fc90742a248e9983719b1dc4704ab27d256004675a02e572c9c47db0c0acf2fb2d2600d7bfabaaeb62d530829c384f9c46b4eb378644fc0573b23b72cd0a0dadedacef09d13b7fbb06e9d973cd310e49f20abf341ed40bca8277623402c307770a2cb791c2f167cc7fa88ea0433b82c699511c219adbfa17bdabc6cc08b077053e768546e268c29fdea2efa27c6c89bf221cd09bda223e37885d743986a26514c9b7894ca2c467be6789ef04e031dcfb4c27760d57af0bafc6d20518ecc5a4c26274f2bb3b9e9cf48e2a6bd29ca21c3db01acc322476165817676650cdfd3d12143639496dfff039371ecfffde5f9c31c6f835933e9a96a26ca83384b6a0b15de4372aa231e37e5fdb2d769ec73e916fc13abf271ead2b021eba9527fc141430c53d8f22c61efc62e29b3b14876a05c99b049392ac105d509592ba797cc39ca73dc779a4d9337e26cccb5f546c31a4a9a32c476f6bc4933e82ce6fe56a2f483028f3984b3fd0fe091ccd57bbec524a8f511f8ab1a0d955b336caca49bb3a351b4eecdf52612a5311d12afe88390c3d3fe57d5c37abf9a6544e47511c78e5bcfa66106148bb0d495c89480ea4e32c0138789663b1a48b130a229cf8afe71cc5d02c0807f52cb59139ae98a8881489d9965a56d9f7cb0e57f90f5f6c515bc36b9e259f958059885ad2f8356eadce73d263c20d01c121298e8723d452a910e4c133489b255fdc4ae255aebbff3529e9d20164497910800478e458c5c7657e7f5c68f030a66bdb35eb570b4f55e26141ae4044ea08a66b649ce72486fc214980a711f29c3877d34b6dd832cb2a5c5b548d320dc5ad62ce7f437bde566ceeb3db38a13a18576cfe044805d99f93e0301dac6e902c5bf34d2543c7cd9a7d1767df4d77b651f6495c4ac5b888664d67820ad77bd03a2466975d2fc7c40d9ccb9346ba2aecd5872e722ab4ad3e28ba1e4e862faf052645801cc7d7ccd3eb7d1068eaa30b65302726a20b5792b2b03c3ceb69e25f21482aa2d126cd4fe57464b1388b8e180de09dbb608ead369cfe02e8bee4828ebbf53a6fa397c0e22f6c6ff45033879c1b4b59a38689e7f61112d933daeddf0d5bbea87c0fe7f9a828b4d4ecfacdab34755604b5af1df8060fc39864079bbd0c83bc63cbe2f28e03bf72a022df9f53c3767e3475a65c9dd306f385da80e6b16d09283076116aeed981654fe0fc0db271693868de464cdf1fa854f4342c454afadcf94075192a0766bf6ec78ff5444d72ab204e22114a87266309ae05826da8e87c4ae3a35aba9b5a4a43e0ca2a1eb2154249dffe991683fb92236109fd37f05e573344f3f20668367cae0d254d96b757a39e7184501ad0f4992aa76962b27af52befe2c7fff8be8e5d7df9f8772085314c009b8bcc24389f79e3fd9ebd76cb74956a1748b407e2fb7ded1a7ace7bdfe99e1d3df57decf3492b3d115221516c00327ffdfd2f99930a9309c2c04fa0bd0b1662b3d532a021a841d03ce875d464068a4e4dd0c3061707667b15f328733ae2ab183dbc533cc486382d206e96b20216d0783f569f34e3c0a7589d96be4119f9092f870cc1f4bf9d94819b78cacf0e16bbe348e8e2be3137e570ba72b389ad3b2a82651bab058113b6155028d1a484925db3c6ba86ae31abac5f2af785297f9b85b4c1b7efc793cd2575a03c1fb750bfdaefacad7edd926251ff1115e436d82a76ae9f43f83b0b42d60f8e3e42fa044784ff91bea993e19e8e17420f49b02a314622393e12c4b147f5aae47b024e9c566b716632e9fbecfcac16af90e477a0b74a1d988a7368b52124370c6900fd2ae40fe49d5abd54b8c735a84e793dc45dd13159a5a009872b46bacf46ae2a3200de54400485fc00f0061ca581757404ec72e6270aae5e713db4066864d3d8aa01f5d8e688e154131ff3f3a82270a21e4f1d612a1cc6df872bf4d3818b78839d4f75b7b2ab97f4bb9de852696d95467603846cbf98f806dbc541fb7dd5c20e719630f78d4e480e39084085563830c72567fb1092296c162481389f3239abde379789c3b52bd322dea1143275569d49d129b9f842cdf2fa5dfd3bb645333e5a2f30b424b624b96d00a2cbb09d9e8482906db068d321a30931b945a73c1dc47cf199a67b2ac594f9ad1ffc8bd6750f99b464de9f4a6f00496cf77e1f0e1fadc8d5d5f8eb8e108b90db9f31cf325d5affb755cd828168ed748d4952f1dc12b12cb8ba88c11321a599c81589c4b4c8bdcfb0634cdff0ccd0a9349f69ea1a433fec3f7981dcfe70bfb5416dbaa121e2324eb794a01316dc05cd485d4a3105fa43c20e1e819c5f284b5f7391befe9641da1840a965d76b87de371563deb98f51e369aa7c8ed3ba8f5cfe1ee32cbc1071fd3548544248354aa184d2c0416ea6c5cee3ca3b387350e8c8a1fae529903cc8f8ecf830a0b84bc2edc7e27b3695cded206c58e7e49d412bb0b02c95e2ab71b8e7c8086a5b3789d2d0beef1358e001c66f280622ca642e8da8513bdd66a4d234a3eefc8d1e5b3ce2b55c8c7a45712b1294c7ea743ece4bf8eddddbcf487e312303e3a1ff4ca78bd209c69c1e76405e709f5504ffd9cd133f1281562bd76a34eb5c6157e901abfb5233694a100b34a930ca0c6b06cfbe4523b5cc95314c8099ab28b78cf7c39f7488e3286a6291f2ae8ae330799ca484b070995a860f92f37f7e37081fe04fdb42ff32d28bba4c8e45446b0d191efea6dcf084de281b80843a04c5e8551c63b6dd69eecd3cd2e99421e449a8363e2d28d0169fb5a4c6b4e9901667ec32e89d628f16c84fcdeeb9aa1cb44b963c6de75264e2b6a864cace9f0363349670dc54a43639328b766d90608133c7585e3962e985d1e109c62f99af18328d959002325c8d9ba3ccd2737c98de7d13da858550d4860f0493fda0adbac7c85b66f0a46c819b3ef24bda16868eb1707e3314562303cb443f096867cf13dfe2f230c3b467aceeb649433a9bd31387f9684dfafd652b708f4be089479be1a9b8ca7e704aa5192d466c22c314505a9f4774fd8d85e352b00019bfc79c31c34f098a9b85471e25ed9de527a3d9006f0630abf0c2a8a263fce798fae8147e005602141c7066feee72ad9ab97d92069ac77af00561d7f961269c1e2f3af6740a775333013dd7514305d6e4e712eef8b9e4d3d9760bb485fc8bda763ce08b", 0x1000}, {&(0x7f00000013c0)="ebf7cd8b40a14553da421acc0c43835df1e7cddf13feaf0f339238506ea229a1d17e6910ada18298332756b4ca089d4075e61658d0c8758245553d9db2fb04b861d76a0b0a253e9b9673d7e60f3336", 0x4f}], 0x2, &(0x7f0000001480)=[@rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r2, r3, r4}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}], 0x88, 0x801}], 0x2, 0x20008000) r5 = syz_open_procfs(0x0, &(0x7f0000000200)='net/raw\x00') r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001600)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f00000016c0)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001680)={&(0x7f0000001640)={0x1c, r6, 0x600, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) read(r5, &(0x7f0000000040)=""/230, 0xe6) [ 395.488711] binder: 27466:27472 transaction failed 29201/-22, size 0-0 line 3013 [ 395.488992] binder: release 27466:27472 transaction 715 out, still active 13:55:18 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000180)="f8768416169b4918572b91b6643f7c60e2fea25ebebde7b319f397d98d95d8cb7406b878c0e7e33505a55a946e374750b9edf4ab15372ff0af3fb53b5e656434cdcae28182ced93dc4bb7d0d9ae02d1dd06123c65b1984a84b006ab21d25d578ad2127c499d99955f492f34bda88d9ca9dc26650e12c669d6d8c71f162b2ec547c4a0ffc6e91fc8c05c1398ad43394866804af177b643cce1838ff94b3e943ebd88710d9e896d412d705d35ffccfab6549a25094b4d5b2af2f951de8c92d5f4e5ab64d3b7dd36b8e870d", &(0x7f0000000140), &(0x7f0000000040), &(0x7f0000000100)="903dbce4f7ac000001001185693f4a6f5aa3e45dea7f0aca73d1e1f80000000000") mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0) [ 395.488996] binder: unexpected work type, 4, not freed [ 395.488999] binder: undelivered TRANSACTION_COMPLETE 13:55:18 executing program 2: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x840, 0x0) ioctl$EVIOCGREP(r3, 0x80084503, &(0x7f0000000180)=""/104) ioctl$UI_SET_SNDBIT(r3, 0x4004556a, 0x2) setresuid(r2, 0x0, 0x0) keyctl$session_to_parent(0x12) [ 395.503166] binder: undelivered TRANSACTION_ERROR: 29201 [ 395.640586] binder: BINDER_SET_CONTEXT_MGR already set 13:55:18 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PIO_FONTX(r3, 0x4b6c, &(0x7f0000000700)="0f7f223f244311287930eac912a046f0317dfd25766dea09c48991cce922955b") connect$l2tp(r3, &(0x7f0000000140)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @remote}, 0x0, 0x2, 0x0, 0x2}}, 0x2e) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x100, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r3, 0x4058534c, &(0x7f00000003c0)={0x4f, 0x8000, 0x0, 0xfff, 0x80000001, 0x8}) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000540)) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f0000000080)=""/5, &(0x7f00000000c0)=0x5) socket$inet6(0xa, 0x80000000001, 0x0) userfaultfd(0x800) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/member\x00', 0x2, 0x0) mmap(&(0x7f0000012000/0x4000)=nil, 0x4000, 0x1, 0x80012, 0xffffffffffffff9c, 0x80000000000000) userfaultfd(0x800) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000680)='/proc/self/net/pfkey\x00', 0x500, 0x0) ioctl$LOOP_SET_STATUS(r2, 0x4c02, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x101, 0x2, 0x20, 0x10, "30720a1c8531ee010875af39e1f13ac4f276116bd1201106ef7488d5d3ae8a00d7281ad3ef4c01c0256707db2d29f44688b73934c16052136a0deaa87156de9d", "73aaad5ccb24a16ae82b640fe7d3c3f0804cef164c85d010cdb1916481909dcf", [0x6, 0x3]}) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000200)=0xe8) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r6, 0x1, 0x6, @remote}, 0x10) ioctl(r5, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") connect$l2tp(r0, &(0x7f00000006c0)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x3, 0x1, 0x4, 0x2, {0xa, 0x4e21, 0xba5, @mcast1, 0x5552}}}, 0x32) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000580)={{{@in6=@remote, @in6=@ipv4={[], [], @rand_addr=0x20}, 0x4e20, 0x0, 0x4e20, 0x20, 0xa, 0x20, 0x80, 0x21, 0x0, r7}, {0xfffffffffffffffa, 0x10001, 0x18, 0x8b, 0x5, 0x99, 0xfff, 0x4099}, {0x1, 0xfffffffffffffff9, 0x3, 0x80}, 0x7, 0x6e6bbb, 0x2, 0x0, 0x3}, {{@in=@broadcast, 0x4d2}, 0xa, @in=@multicast2, 0x3504, 0xcd6414a09a1bccf7, 0x0, 0x8, 0x0, 0x1, 0x401}}, 0xe8) socket$inet6(0xa, 0x1000000000002, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) r9 = socket$l2tp(0x18, 0x1, 0x1) close(r8) openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x1, 0x0) fallocate(r5, 0x40, 0x7f, 0x80000000) connect$l2tp(r9, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r8, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 395.640595] binder: 27489:27497 ioctl 40046207 0 returned -16 [ 395.641341] binder: 27489:27497 ERROR: BC_REGISTER_LOOPER called without request [ 395.695719] binder: 27489:27510 got transaction to invalid handle [ 395.695730] binder: 27489:27510 transaction failed 29201/-22, size 0-0 line 3013 [ 395.755640] binder: 27457:27459 transaction failed 29189/-3, size 0-0 line 3136 [ 395.768863] binder: BINDER_SET_CONTEXT_MGR already set [ 395.774268] binder: 27457:27513 ioctl 40046207 0 returned -16 [ 395.780595] binder: 27457:27513 got transaction to invalid handle 13:55:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) epoll_create1(0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="42007a69fc4a3124dff8754c7ccdb98f9422be9352fac0675bb30f8aee8b417e251a3081d6181ae919ea4cdd441a0ff22504b5580ad4a2eaa052cc00bd22a8a6a75371d89615c38ff7"], 0x1, 0x0, &(0x7f0000000140)="06"}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x80, 0x0) write$selinux_context(r2, &(0x7f00000000c0)='system_u:object_r:memory_device_t:s0\x00', 0x25) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:18 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x3, &(0x7f0000000080), &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) 13:55:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', r1}) writev(r0, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400192340834b80040d8c560a067fffffff81004e220000000058000b4824ca945f64009400050028925aa8000000000000ff7f00f0fffeffe809000000fff5dd001b2f10000100070abd00000000000000fcff", 0x58}], 0x1) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r2, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14) ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000100)=0xffffffff7fffffff) 13:55:18 executing program 4: r0 = socket$inet(0x10, 0x3, 0x100000009) r1 = dup(r0) r2 = socket(0xc, 0x800, 0x2000080000000) dup(r0) fcntl$getownex(r2, 0x10, &(0x7f00000000c0)={0x0, 0x0}) syz_open_procfs(r3, &(0x7f0000000100)='net/psched\x00') ioctl$TCGETS(r1, 0x5401, &(0x7f0000000080)) sendmsg(r0, &(0x7f0000000040)={0x0, 0x193, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000530407031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x24000891) 13:55:18 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() getpgrp(r1) sendfile(r0, r0, &(0x7f00000000c0), 0x6) r2 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0xa, &(0x7f0000000100)=0x3, 0x4) r3 = dup(r2) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) fcntl$notify(r3, 0x402, 0x4) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x7fff) open(&(0x7f0000000140)='./bus\x00', 0x800, 0x22) sendfile(r3, r4, &(0x7f0000d83ff8), 0x8000fffffffe) 13:55:18 executing program 2: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000100)='eOp\x00\x00\x00\x00\x00\b') kexec_load(0x0, 0x10, &(0x7f0000000040)=[{&(0x7f0000000200)}], 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400000, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000240)={{{@in6=@loopback, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@remote}}, &(0x7f0000000080)=0xe8) sendto$packet(r0, &(0x7f0000000140)="ac5e69670c4bb6ddbe2153ff0e03ba72722ef7dd0b97395f496fd8eb3b292f7349f377e5dd707dfcaf85cab9af2f6475e0e3f9e0be402eaee1281f8213feb0635677aa9c15936f52d93cf94ca004f3dfa3b3c594d0d3f79722e20b60ef9b79d0ceca11db4f1b0562af860fe3581b88ce836d7cef5c0fb356f13a5d71e7ab2703ac24f28c1153488de4ba938cab3ea8bc580863b6ff2218804b9b7fc543ed443acc2f1dc0dfb5970000e34dac5fb425f45df8a8763023be0119f12b44543f97c15f28e50a4edd4cce", 0xc8, 0x1, &(0x7f00000000c0)={0x11, 0x11, r1, 0x1, 0xffffffffffffffc0}, 0x14) [ 395.786870] binder: 27457:27513 transaction failed 29201/-22, size 0-0 line 3013 [ 395.798295] binder: 27457:27459 ERROR: BC_REGISTER_LOOPER called without request [ 395.806455] binder: 27457:27513 got transaction to invalid handle [ 395.812798] binder: 27457:27513 transaction failed 29201/-22, size 0-0 line 3013 [ 395.821280] binder: undelivered TRANSACTION_ERROR: 29201 [ 395.827647] binder: release 27457:27459 transaction 715 in, still active [ 395.835141] binder: send failed reply for transaction 715, target dead [ 395.842182] binder: undelivered TRANSACTION_ERROR: 29189 [ 395.848014] binder: undelivered TRANSACTION_ERROR: 29201 [ 395.853578] binder: undelivered TRANSACTION_ERROR: 29201 13:55:18 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000280), &(0x7f0000000140), &(0x7f0000000040), &(0x7f0000000240)="0ff82e8fd0fbb372ff5eb076d96617") clone(0x0, &(0x7f0000000080)="a81b35f36aeeb8faec85e2e74733753fe111a09f7af88cd13eb31540d856afe3451d05dbbf3bf7299eac10108d1ba643a87d8953d6d579a45dffe43f28bc30cef50da9124d1ebe326a409daac57573982b97dbdb6aa1821a96cdd9caf6e22d30cdd9b6c53151e1737cbff19a1ac93f2399c47d247630505060084fbc360d19a415f8829bbcd721b82ac1db2051f72a4407139a1dc8db0f64e5b048f0f0cb82cd6cfff571b0d28dc51fb9cbde096c6d58fe6e8650b1cc6d3146", &(0x7f0000000000), &(0x7f0000000180), &(0x7f00000001c0)="204b54ed9eccba15266d22fab68badede53e2f52516a12fe2559585b6ccc785482cb4c86aab743") 13:55:18 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) unlink(&(0x7f0000000000)='./file0\x00') sync() r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x0, 0x0) bind(r1, &(0x7f0000000300)=@ethernet={0x6}, 0x80) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = accept4$inet(r1, &(0x7f0000000380)={0x2, 0x0, @local}, &(0x7f00000003c0)=0x10, 0x80000) flock(r3, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mincore(&(0x7f0000003000/0x3000)=nil, 0x3000, &(0x7f0000000480)=""/4096) ioctl$TIOCLINUX3(0xffffffffffffffff, 0x541c, &(0x7f0000001580)) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, &(0x7f0000000280)={{0x7f, @broadcast, 0x4e24, 0x0, 'ovf\x00', 0x0, 0x1, 0x52}, {@multicast1, 0x0, 0x0, 0xfffffffffffffffb, 0x7, 0x1}}, 0x44) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000001480)={{{@in=@dev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@rand_addr}}, &(0x7f0000000440)=0xe8) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000001640)={r4, @broadcast, @remote}, 0xc) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) perf_event_open(&(0x7f00000015c0)={0x3, 0x70, 0x1, 0x5, 0x5, 0x1, 0x0, 0xffff, 0x800, 0xe, 0x6, 0x4, 0x7, 0x0, 0x31a, 0x0, 0x7cd, 0x3c8e9837, 0x7fff, 0x92aa, 0x140d, 0x0, 0x4, 0x4, 0x7, 0x800, 0xb8e0, 0x22b, 0x54ca, 0x1000, 0x600000000000000, 0x6, 0x3, 0x0, 0x80, 0x14, 0x88, 0x1b, 0x0, 0x9, 0x1, @perf_config_ext={0x100000001, 0x8}, 0x0, 0x0, 0x0, 0x7, 0x6fd5, 0x4, 0x2}, 0x0, 0x9, 0xffffffffffffffff, 0xb) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) connect$unix(r5, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) 13:55:18 executing program 4: pipe(&(0x7f0000000040)={0x0, 0x0}) capset(&(0x7f0000000100)={0x19980330}, &(0x7f0000000140)) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$TIOCEXCL(r0, 0x540c) ioctl(r1, 0x8000000008912, &(0x7f0000000080)="0a5cc80700315f85715070") pipe2(&(0x7f0000000000), 0x0) pipe2(&(0x7f00000000c0), 0x800) 13:55:19 executing program 2: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x44) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000300)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0xd67, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x16c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x8000}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f00009e1000)='./file0\x00', 0x8040, 0x0) fcntl$setsig(r2, 0xa, 0xb) fcntl$setlease(r2, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, &(0x7f00000003c0), &(0x7f0000000400)={0x77359400}, 0x8) open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x0) waitid(0x0, 0x0, &(0x7f0000000180), 0x3, 0x0) r3 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x1) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000200)={{{@in=@local, @in6=@local}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000100)=0xe8) [ 395.973904] binder: 27533:27541 unknown command 1769603138 [ 395.980443] binder: 27533:27541 ioctl c0306201 20000040 returned -22 [ 395.990352] binder_alloc: 27533: binder_alloc_buf, no vma [ 395.996048] binder: 27533:27541 transaction failed 29189/-3, size 0-0 line 3136 [ 396.005813] binder: BINDER_SET_CONTEXT_MGR already set [ 396.011203] binder: 27533:27543 ioctl 40046207 0 returned -16 [ 396.017310] binder_alloc: 27533: binder_alloc_buf, no vma [ 396.022980] binder: 27533:27543 transaction failed 29189/-3, size 24-8 line 3136 [ 396.031394] binder: 27533:27541 unknown command 1769603138 [ 396.037116] binder: 27533:27541 ioctl c0306201 20000040 returned -22 [ 396.050915] binder: 27533:27546 got transaction to invalid handle [ 396.057276] binder: 27533:27546 transaction failed 29201/-22, size 0-0 line 3013 [ 396.065395] binder: undelivered TRANSACTION_ERROR: 29189 [ 396.071609] binder: undelivered TRANSACTION_ERROR: 29189 [ 396.079218] binder: send failed reply for transaction 724 to 27533:27541 [ 396.087312] binder: undelivered TRANSACTION_ERROR: 29201 [ 396.094002] binder: undelivered TRANSACTION_COMPLETE [ 396.099440] binder: undelivered TRANSACTION_ERROR: 29189 13:55:19 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getegid() clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) 13:55:19 executing program 1: r0 = socket(0x4, 0xa, 0x4) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uhid\x00', 0x2, 0x0) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x241, 0x0) write$eventfd(r2, &(0x7f0000000080)=0x20000100100001, 0x8) write$P9_RAUTH(r2, &(0x7f0000000040)={0x14}, 0x14) pipe(&(0x7f00000001c0)) write$UHID_CREATE(r1, &(0x7f0000000200)={0x0, 'syz1\x00', 'syz1\x00', "73797a30000000000000000000000000000000000000000000000000100000000000000013cc47fc00", &(0x7f0000000000)=""/11, 0xb, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xff}, 0x120) write$UHID_DESTROY(r1, &(0x7f0000000080), 0x4) write$UHID_DESTROY(r1, &(0x7f0000000100), 0x4) llistxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340)=""/171, 0xab) 13:55:19 executing program 6: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x22030, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x351, 0x0, &(0x7f00000000c0)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1109004003"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:19 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x0) write$sndseq(r0, &(0x7f00000002c0), 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000440)={{{@in=@multicast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast1}}, &(0x7f0000000540)=0xe8) setuid(r1) r2 = memfd_create(&(0x7f0000000340)='bcsf0\x00', 0x3) ioctl$EVIOCGSND(r2, 0x8040451a, &(0x7f00000008c0)=""/201) r3 = socket$inet_udp(0x2, 0x2, 0x0) fchmod(0xffffffffffffffff, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x27, &(0x7f000001b000)={@multicast2, @remote, @loopback}, 0xc) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f00000005c0)={0x0, 0xd119}) socket$inet_tcp(0x2, 0x1, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000580)) prctl$seccomp(0x16, 0x0, &(0x7f0000000240)={0x1, &(0x7f00000001c0)=[{0x8bad, 0x80000000, 0x8, 0x7f}]}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) ioctl$KDENABIO(r2, 0x4b36) fchdir(r4) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x62c4, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) fcntl$setstatus(r5, 0x4, 0x4000) write$selinux_create(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB='s'], 0x1) write$selinux_access(r5, &(0x7f00000002c0)=ANY=[@ANYBLOB="73797374656d5f753a6f626a6563745f723acfb073c6743a7330202f757362696e2f51747064203030303030303030303030303030303030301d3000f4dd4a14dbe64bfd8876cf391549f1b63fb5f12c013b3aa317"], 0x55) syz_open_procfs(0x0, &(0x7f0000000280)='net/mcfilter\x00') sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x9) 13:55:19 executing program 4: 13:55:19 executing program 5: r0 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000100)='/dev/pktcdvd/control\x00', 0x200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000140)={0xffffffff80000001, 0x80000001, 0x7fffffff}, 0xc) sendmmsg(0xffffffffffffffff, &(0x7f0000004a40)=[{{&(0x7f0000000740)=@xdp, 0x80, &(0x7f0000000e00)=[{&(0x7f0000001280)="368589288dcd550cc644821c7a261c0fc0e3709f9c27243735d1da2c3af905b2a5717266511dbbdb78fd292e435195f936fc6244a5f30dbbf8022f134383b655762e5c81f8940c63cfde2f35aba5c008aeda71e97844c143715b9f803bcbeaa03abce8114627f45dc0a4a99ac6e13509fac0037b85e21d40b9bbfa0b21f55bd4fe996c9e5fcacdb2b81d1e3a3ee93da0f354b9630ee62a5ab97a8f57965dcc9ce13e72b3c95a189891b8b9c6bbd79bc77731bdeb47c1b18f6b8c67d83a6f1a5e22a591e7b63fc13cfbee76cbe9c721c3c615aca5d36f943965cc8d6eb3c23244d9768b160ef0dd5092fe3ebf9e7f32e09b2473c0d0aa4ef88bbc525df251e96cc33034514ad3b6cd12208c9c88083abf3af069ab681a22008c8c5e6f12a87305736ed13e39411cd15eee20ddfce72ea44c3cc6ff43888c4d0746873180c0de29ee25254127bd77f3391a56307b6a3f5e6ffa9cfd4d388579b31ee66a4ce64646288f36aecb945687d1c444b2c9d942c4557f9ebf02057c3342cb444cf4e6af7dcab2d5753011ab989e3f5459b2401db0bdc459a3aa5a1d7acffd3e856acc916e60e453d286fc831d926196d4d06267e9df81fd75514ec73e97278e358558a2f248343c090808ddd01fbc5d659f22c9afaafdcdce14c237790611932170143842c54395a95b485978f2978951b0f2816de28b485eb17de2f15ae99de9373e5a4d45efbff01044561f9b0b7453ade6fc94275d12029b470750535ce5eda081b0c17fd73b942dc699cf6f2dbb08633167ae857e339129de6866eab745c248542dca5b253552bbe0c3e22d24a6e8bbd499cf60e472ec28d2dc6cf93f2f8d28e8b375e3f82329caa2454cbd353a619068f60629992fd3d5f0cb8c59acf07eaccf8be835c7e5efdcbee0f4306bfa879d8adfe5792df77a683ecca39bce5397dc689693de1a455238b7beec59ff32e92a2bd44049d1cdcc174740f47931e1d2a0bb02a2a6c892449d45ac88e340c15517bb619db24cafc1ec2549968c1ac87f5afbf7c748169c2c98e175f096244cd10baeb42b977fa6a49086a212f281ee20ae7c8e63ab553f11b8c91574a913af58c1d306d17e03da07b2c2d3c1ab02e3aec2c8451e39b845c9425c83023ec928ceb4c24576d72c7c0e03c100fe9cfd9b6ecb9575412411944181062ffb652976e3427a35c9eecee506fc0ad84f9e8081983aa5405cff9436bcbfdfa0ee8c85dbb79663a8ee664da48b43eca3d1d81ba54d09046e6974fbd76814f1c1297a7989ed65da73d824fbc72977680be83bb79d7a487bb3ce0b9f6e1e38e03106bdf1fece021cc6058e7b17938abd30710a40697fd07172fdd07f8099606dcf12b9bde4aaabe27f5821448895491a78ef54288db63cc6382c4f88c1e0d398bee7d6e0737abf78acb48ca2ba4687b55c45eed5aab79d9d1d140fea512da113a334738956be8216666ee4a9cb90608008ac9b384935b163c54f05bb0de30f8f93f37e096783d08c77ef1b0687598b7ad58a14d2ea99e3ed050bb96cd5d7565c3af296264e4c604c0358cc6d6f46be63f789e50213ae229cc87ab8aebff64a5329745a13d32f7f363968b91297d103c72ff34b72737c39462427c5a1e1d152ddbc13ff9324087e71b3f3e8a78c00477d58abe1c03cd24193a4cffd5a4d830a3a4b390ce2a0584fe14b13b27d8b97f0144c2b45ed7f26b6b591aafeb1a5e236d009eda745a1fae8c6779c96ff5256892cf928bea93c907a37cab41f073364532a0ea95a4eb02a401bacb2594602291f9f3b59b529784fe2550c8bced2f4f2fd45a2b54421bed5e372dd66e6ddb76875e1081c66555bf77a84b80c3776ee69d60d09eced5d8e60f01200789bb57cf9085925200d4688c27fc754bf05b832203b006a6caf60a3f64797189c8a6011655df86f2d748446fdc8efb0afad0b7f2810d3d8a19d955bd481296e477e93b571b91e14d4763ec195f7c4557321ffdbd92e87ca6ebc7341273f7fbdfc5341afe49352dc58109a02ef9df4b2d8047de90e077678bdd557a47e4c775d939de3604a8de28aeab98e7bdafe903e4aa8e8394b779102d9b121a5168a5fa3f8f7a33ce9ced9a1e2094c92aafe5630eb976d6867484b5674a24897a26bed0fefafe730aacd5f124a61f8c9f8a6f4eab851c8643b0951a6f94bb4f77b6ba95b9a06e6657faf2db7acf5ada08f46556fade5667718d645f3c1da4a0007d9f9ddd951bf0c38834ffc5d147a13ca27283f50005c965091c741fb0080c0473b2b7ce062bffebad6974559415918419364ac2887dc8eb278012ce3b6ca43c8132f5e9458799ce0a9188073d9e6ca0c38477874028b76c5004c1292dddec192216eb37179a85967540311de40a70d2415448a766929190641ce44727e5fe6633ca14c7f4574c3a872ff005ebfe806c71b15f115425ddaab9db657e4fd8cbdfb1138f9f85d40ba3d12a6844e4b249edf5dae876999d8758ec78aeca1752e54111cb24a1993246eb0e4a0f63735df1ad93510bc0d4afd6a3ae518981f2d025018daf2089d35dc60554f567cece7cbdbae30fd545a4bacc89b4fb91b5ef196a88955bdf106ad38bc0145d06db26a16da7a3ea4adfce184245f6292f957abc4a554e6d3da99960385b6efcd20f62479d0a39d47b64bb256b2fbff784c8a7a002efbb370cb92063e450394801e923812c1bd4dcb3c960b47e273edb2046ed06846bb1f38bf142a7f857f1e266c1fd965a0415a752eb929acc89467be70c13fe39d54bb2de014d77a8e77feb1fbb9f7c45daf52ec50fa8bc59dd37c4aa09df31bbd88f08a5c70a9f7ce93cab28acd22be21b5bf66ab1af7381ae8c4dc1441c28c4cdd5e1aabdaaa49bd08e0a3e3fd3c781df205ce8a4f967d3276265d5ecc8fd95e675092a45af1ab48f71d6f0251ada9dc4fa9183cb1856f28d7e7522f2d0d8ce1650ed4f54bfd87969775f19b25ab8441a6e086a98974169f044c9b4510fa02b846684e935de4122ff2bf74dd5a4f74bc4c48d08b2c61fb3e8f0796c76cab1cf43c4df9e1bd3118d66229b72542381b8f7450231eb1f97e571b488841f8dd38199bb72aa58d56177f66c3ea1019e8e4326ee45f89c070c0cf17465f216da099addb6cd656907927669f2cad17b21a572430b9675568f1652d06782b94b2833a8d71dfb180a97328a546ecfdbe7a83be27f5cf69fe5efb20bdcfe0dc4568abe451432473d825c3509f6eecd6bb54e8cfb06122e8911404c34fffd72515625d23db5a94514dd0c35a26a57527bb1eb495a0797d42a8e6b7cb57e6ad745400de6aa4ee87a2109af140ac3a7d6ba07b51ac6b3e14953d8f2472165d226192115300955d592a9f3dade2c684a543d27aef15dbee56245cde5b4e4d150b57940a5da08d963e516dc108c2518de58482ae3786cb253aa1532d6afab3251b441517d8e0a4e5324229cbe9", 0x991}], 0x1, &(0x7f0000002280)}}], 0x1, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r1, &(0x7f0000000000)=[{{&(0x7f0000000080)=@in={0x2, 0xc67a}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000000200)}}, {{&(0x7f0000001c00)=@in={0xa, 0x4e23, @broadcast}, 0x80, &(0x7f0000000280), 0x0, &(0x7f0000000100)}}], 0x2, 0x0) [ 396.424676] binder: undelivered TRANSACTION_ERROR: 29201 13:55:19 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) write$FUSE_GETXATTR(r0, &(0x7f0000000080)={0x18, 0x0, 0x7}, 0x18) mprotect(&(0x7f00000f5000/0x2000)=nil, 0x2000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) 13:55:19 executing program 4: r0 = memfd_create(&(0x7f0000000140)="25c6af41caeaf200652aff0f55272216de4a08dab7515b68b0", 0x3) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000000)) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) 13:55:19 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0}) ppoll(&(0x7f0000000280)=[{r0}], 0x1, &(0x7f0000000200)={r1}, &(0x7f0000000240), 0x8) r2 = dup(r0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x8001, 0x0) ioctl$TIOCSBRK(r2, 0x40044591) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) 13:55:19 executing program 1: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000001300)=ANY=[@ANYBLOB="38eaf9c58d6669c939"], 0x9) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x3}, 0x1c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000140), 0x4) sendmmsg(r0, &(0x7f00000002c0), 0x4cc, 0x0) [ 396.465692] binder: BINDER_SET_CONTEXT_MGR already set [ 396.473446] binder: 27573:27578 ioctl 40046207 0 returned -16 [ 396.499424] binder: 27573:27578 ERROR: BC_REGISTER_LOOPER called without request 13:55:19 executing program 7: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffffff) ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f00000002c0)=""/143) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) open$dir(&(0x7f0000000040)='./file0\x00', 0x44202, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffff7f}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x80) [ 396.543967] binder: BINDER_SET_CONTEXT_MGR already set [ 396.549722] binder: 27573:27593 unknown command 1073744145 [ 396.549732] binder: 27573:27593 ioctl c0306201 20000080 returned -22 [ 396.562386] binder: 27585:27592 ioctl 40046207 0 returned -16 [ 396.576958] binder: 27585:27592 ERROR: BC_REGISTER_LOOPER called without request 13:55:19 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x501000, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000040), 0x0) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x3a) 13:55:19 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f00000000c0)=0x30) [ 396.623080] binder: 27585:27599 got transaction to invalid handle [ 396.629983] binder: 27585:27599 transaction failed 29201/-22, size 0-0 line 3013 13:55:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) personality(0xfffffffffffffffc) uname(&(0x7f0000000040)=""/176) set_tid_address(&(0x7f0000000100)) 13:55:20 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = memfd_create(&(0x7f00000000c0)="237d00d3fc1ee4671fbaa0a455e73e678b8e96f7fd829d4d39f1828ebf765e220913b73db94f6d495077a6df5ab82b4c4f8d", 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000000)=0x3, 0x4) getpeername$packet(r1, &(0x7f0000000100), &(0x7f0000000140)=0x14) ftruncate(r1, 0x40001) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0xfffffffffffffef0) connect$inet(r0, &(0x7f0000000240)={0x2, 0x4e1f, @rand_addr=0xc}, 0x10) sendfile(r0, r1, &(0x7f0000000080), 0xffe4) 13:55:20 executing program 3: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x2) write$P9_RMKNOD(r0, &(0x7f00000000c0)={0x14, 0x13, 0x1, {0x1, 0x3, 0x1}}, 0xfedb) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 13:55:20 executing program 7: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/route\x00') fstat(r0, &(0x7f0000000240)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000140)=""/246) time(&(0x7f0000000040)) dup3(r0, r1, 0x0) [ 397.262587] binder: BINDER_SET_CONTEXT_MGR already set [ 397.268029] binder: 27573:27645 ioctl 40046207 0 returned -16 [ 397.274035] binder: BINDER_SET_CONTEXT_MGR already set [ 397.279401] binder: 27573:27593 ioctl 40046207 0 returned -16 [ 397.279551] binder_alloc: 27573: binder_alloc_buf, no vma [ 397.279570] binder: 27573:27645 transaction failed 29189/-3, size 24-8 line 3136 [ 397.288423] binder: 27573:27646 unknown command 1073744145 [ 397.288434] binder: 27573:27646 ioctl c0306201 20000080 returned -22 13:55:20 executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = dup(r0) eventfd(0x4) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/create\x00', 0x2, 0x0) r2 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r2, 0x80003) restart_syscall() sendfile(r1, r2, &(0x7f0000000000), 0x8080fffffffe) setsockopt$inet6_tcp_buf(r1, 0x6, 0x1a, &(0x7f00000000c0)="bc9abcc2802fa868bb1c22ebcdcd0859d1913987cbe7027b396543c7b1636f663adb6712a42ef1e30e6431570dc7caaf4dd52dd6aefb61c3eb92fce70c6ff10dc4f3de098c571d9590f66efc00e9555e010337d4a09b3f99c9fd447790d2e830511eb490ccd205b2b7af40a43c3dbd97c02615f05c8b7f0a1ff7b10b3f79947bd6", 0x81) 13:55:20 executing program 6: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:20 executing program 3: mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x40800000000) clone(0x0, &(0x7f0000000000), &(0x7f00000000c0), &(0x7f0000000040), &(0x7f0000000080)) 13:55:20 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x1, 0x0) inotify_add_watch(r0, &(0x7f0000000180)='./file0\x00', 0x10000003) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") mmap$binder(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2, 0x100000002132, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xc812, r2, 0x0) futex(&(0x7f0000000000), 0x5, 0x0, &(0x7f0000000040), &(0x7f0000000140), 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f00000000c0)={@empty, r3}, 0x14) 13:55:20 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="666464cd3d", @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d303030303030303030303030303030303030346572df69643d00000000000000", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) r1 = syz_open_pts(0xffffffffffffffff, 0x80000) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rtc0\x00', 0x20000, 0x0) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/enforce\x00', 0x240, 0x0) ioctl$KDGKBMODE(r3, 0x4b44, &(0x7f00000004c0)) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f00000002c0)={0x34, 0x0, &(0x7f0000000280)}) ioctl$KDDELIO(r1, 0x4b35, 0x800) getpgrp(0xffffffffffffffff) sched_setaffinity(0x0, 0xffffffffffffff11, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c831, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) getsockopt$sock_buf(r2, 0x1, 0x37, &(0x7f00000005c0)=""/190, &(0x7f0000000340)=0xbe) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000680)=0x5, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0/file0\x00', 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000030c0), 0x1000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, &(0x7f00000003c0)="b9726ea8ed49197104fd7466770e2596a6503295f33f3c977504b99f402bb0258d67e24b990e059c19887bee24e8bb64db94bd435a1c3b35ad0d52cd13cc95deff46c15f5cb124ead6689866b21fd69e309029a9f43d0c941b673dbdc67ee0a248c7baf2f6a277238986d2c1f7fbbc6c73f7f98ca0fe335accf4023de2349731e7c9246919827c0ebe23963a0623cdd7423cf725dcae021bcc0d8bd960f893f705b24961e1c15904a4827693eb8cd709091870f9f7fdf8e8cc97304d84b68dee36826f3107d37ed5ca5080799367a2001e6033ce5ea9eb6e65efd1193ec4c9409ffffe7b6b86675c026e1dd774299a79ed155df4e26ccefd7e19aa65089cd346") read$FUSE(r0, &(0x7f0000001000), 0x1000) accept$inet6(0xffffffffffffff9c, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, &(0x7f00000001c0)=0x1c) 13:55:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=ANY=[@ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYPTR=&(0x7f0000000180)=ANY=[@ANYPTR, @ANYRESDEC=r0, @ANYBLOB="5cf95e5a3f2570691b8a8ef2e3f6972e8c89412c960407a541ecd27858067bdd3d6381abaf57ed83966ea7ea8b597db0f967ffebe139d49cb04b9c05dbc9ea29a44ffde6"], @ANYRES64=r1, @ANYRES64=r1, @ANYPTR=&(0x7f0000000480)=ANY=[@ANYRESHEX=r0, @ANYRESDEC=r0, @ANYBLOB="a477379fba65a99195dd0011b5fdbf5e03660eba5ba1522141a0fc9c5cfea8877d08a109d0cd32c58753a6ac151abbf08617d950d9cf36dfcb76abe5091f7c01d582cd01cf623f9acd378e0b733fc06175f8e9db640c915fcb82bd2a99e663f79f5b701b57bdf883e0d4d48759ea02f9ffde36d7d948348b550480154d3e51e4648b4a98433a5f966ae2f90a43dd7d1d9f20cee509fe06a5f5f60f32116d57f5e7a8af541bfb2a02cc54c7", @ANYRESDEC=r1]]], 0x0, 0x0, &(0x7f0000000480)}) 13:55:20 executing program 4: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x1, 0x0) r1 = socket$inet(0x2, 0x80800, 0xffffffffffff7fff) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000240)={{{@in6=@mcast2, @in6=@ipv4={[], [], @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}}}, &(0x7f0000000340)=0xe8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x844000, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_any='access=any'}, {@dfltuid={'dfltuid', 0x3d, r2}}, {@mmap='mmap'}, {@debug={'debug', 0x3d, 0x8}}, {@uname={'uname', 0x3d, '/dev/ptmx\x00'}}, {@cachetag={'cachetag'}}, {@access_uid={'access', 0x3d, r3}}, {@dfltuid={'dfltuid', 0x3d, r4}}]}}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x201, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000900)={0x0}, &(0x7f0000000940)=0xc) ptrace$cont(0xffffffffffffffff, r6, 0xffffffffffffffff, 0x3f) write$binfmt_aout(r5, &(0x7f00000004c0)={{}, "", [[], [], [], []]}, 0x420) [ 397.288702] binder: send failed reply for transaction 731 to 27573:27578 [ 397.291339] binder: undelivered TRANSACTION_COMPLETE [ 397.291347] binder: undelivered TRANSACTION_ERROR: 29189 [ 397.354432] binder: undelivered TRANSACTION_ERROR: 29201 [ 397.460925] binder: 27660:27666 ERROR: BC_REGISTER_LOOPER called without request [ 397.476805] binder: BINDER_SET_CONTEXT_MGR already set [ 397.484784] binder: 27663:27670 ioctl 40046207 0 returned -16 [ 397.492656] binder: 27663:27670 ERROR: BC_REGISTER_LOOPER called without request [ 397.502217] binder: 27660:27666 unknown command 536871104 13:55:20 executing program 5: mkdir(&(0x7f0000001b40)='./file0\x00', 0x0) ioctl$TCGETS(0xffffffffffffffff, 0x5401, &(0x7f0000000100)) syz_mount_image$f2fs(&(0x7f0000000180)='f2fs\x00', &(0x7f0000000200)='./bus\x00', 0x6, 0x1, &(0x7f00000002c0)=[{&(0x7f0000000280)="2dee6b37e0b0546d76bfa63a64bda5d1773026ab3ba4dd658ceea3af759799ca132416ae64345ace06c01a459d3bf5df0f535e6431fd", 0x36, 0x1f}], 0x1000810, &(0x7f0000000300)={[{@six_active_logs='active_logs=6'}, {@six_active_logs='active_logs=6'}, {@noacl='noacl'}]}) mount(&(0x7f0000000080)='./bus\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x0, &(0x7f0000000140)) chdir(&(0x7f00000001c0)='./file0\x00') r0 = open(&(0x7f00000000c0)='./file0\x00', 0x141042, 0x0) write$selinux_validatetrans(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0) write$evdev(r0, &(0x7f0000000440)=[{{0x77359400}}], 0x18) ioctl(0xffffffffffffffff, 0x100, &(0x7f0000000200)) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpgrp(0x0) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f00000007c0)) getgid() r2 = memfd_create(&(0x7f0000000200)="00ac3d9dd2dbe6bfb408ed634a8e84d44e129b1f09bd112b865416a3b3ae309f393fef6fa46b01323ea19c86781c9f841935de975f097ef3591222705ec10f", 0x0) write(r2, &(0x7f0000002000)='/', 0x1) ftruncate(r2, 0xb2c8) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r2, 0x0) openat(0xffffffffffffffff, &(0x7f0000001000)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000840), &(0x7f0000000880)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000008c0)={{{@in6=@loopback, @in=@local}}, {{@in=@remote}, 0x0, @in=@remote}}, &(0x7f00000009c0)=0xe8) fstat(r1, &(0x7f0000000a00)) getpgid(0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000dc0)={{{@in, @in6=@mcast2}}, {{@in=@loopback}, 0x0, @in6=@local}}, &(0x7f0000000ec0)=0xe8) getegid() gettid() getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000f00)={{{@in=@broadcast, @in=@loopback}}, {{@in6=@remote}, 0x0, @in6=@local}}, &(0x7f0000001000)=0xe8) lstat(&(0x7f0000001040)='./file0\x00', &(0x7f0000001080)) getpgrp(0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000001100)={{{@in=@rand_addr, @in=@multicast2}}, {{@in6=@ipv4}, 0x0, @in6=@remote}}, &(0x7f0000001200)=0xe8) 13:55:20 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$getenv(0x4201, r0, 0x3, &(0x7f0000000080)) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) socketpair(0x0, 0x4, 0x3, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00') getsockopt$inet6_mreq(r2, 0x29, 0x14, &(0x7f0000000200)={@dev, 0x0}, &(0x7f0000000240)=0x14) accept$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f0000000300)={@empty, 0x0}, &(0x7f0000000340)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000380)={'team0\x00', 0x0}) getpeername$packet(r1, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000400)=0x14) getpeername$packet(r1, &(0x7f0000000500)={0x11, 0x0, 0x0}, &(0x7f0000000540)=0x14) accept4$packet(r2, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000680)=0x14, 0x80000) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000840)={{{@in=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@loopback}}, &(0x7f0000000940)=0xe8) read(r1, &(0x7f0000000440)=""/112, 0x70) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000002200)={{{@in=@rand_addr, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}}}, &(0x7f0000002300)=0xe8) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000002340)={@loopback, 0x0}, &(0x7f0000002380)=0x14) accept$packet(r2, &(0x7f00000028c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000002900)=0x14) getpeername$packet(r2, &(0x7f0000002a00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000002a40)=0x14) accept4$packet(r2, &(0x7f0000002a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002ac0)=0x14, 0x800) getpeername$packet(r2, &(0x7f0000002b00)={0x11, 0x0, 0x0}, &(0x7f0000002b40)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000002c80)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast2}}, &(0x7f0000002d80)=0xe8) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000004740)={0x0, @multicast2, @local}, &(0x7f0000004780)=0xc) getsockopt$inet_mreqn(r2, 0x0, 0x20, &(0x7f00000047c0)={@dev, @loopback, 0x0}, &(0x7f0000004800)=0xc) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000004ec0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004e80)={&(0x7f0000004840)={0x608, r3, 0x800, 0x70bd2a, 0x25dfdbfe, {}, [{{0x8, 0x1, r4}, {0xc0, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xb3e}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r8}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}}]}}, {{0x8, 0x1, r9}, {0x128, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r11}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x7c, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x1f}}, {0x8}}}]}}, {{0x8, 0x1, r14}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}]}}, {{0x8, 0x1, r15}, {0xc4, 0x2, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0x273d, 0x1, 0x7, 0x2}, {0xfffffffffffffffe, 0x9, 0x3, 0xffffffff}]}}}]}}, {{0x8, 0x1, r16}, {0x40, 0x2, [{0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x6, 0xffffffffffffff81, 0x84, 0x8}]}}}]}}, {{0x8, 0x1, r17}, {0x1d4, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x100000001}}, {0x8, 0x6, r18}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xffffffffffffffe0}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r19}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r20}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x3, 0xffffffffffffffc1, 0x80000000, 0x8}, {0x8, 0x9, 0x20, 0x6}, {0x4, 0x2, 0x81, 0x5}, {0x4, 0x9, 0x1, 0xf8ad}, {0x7f, 0xff, 0x7, 0x4}]}}}]}}]}, 0x608}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f0000000100)={0x1d, ""/29}) 13:55:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x22030, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x351, 0x0, &(0x7f00000000c0)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1109004003"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x22030, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x351, 0x0, &(0x7f00000000c0)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1109004003"], 0x0, 0x0, &(0x7f0000000480)}) [ 397.511175] binder: 27660:27666 ioctl c0306201 20000080 returned -22 [ 397.541945] binder: 27663:27677 got transaction to invalid handle [ 397.548954] binder_alloc: binder_alloc_mmap_handler: 27660 20001000-20004000 already mapped failed -16 13:55:20 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x105203, 0x0) mknodat(r0, &(0x7f0000000040)='./bus\x00', 0x2, 0x9) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r2 = creat(&(0x7f00000001c0)='./file0\x00', 0x80) r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x1000f4) r4 = open(&(0x7f00000000c0)='./bus\x00', 0x4000, 0x0) sendfile(r3, r4, &(0x7f0000d83ff8), 0x8000fffffffe) open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) ioctl$fiemap(r1, 0x40086602, &(0x7f00000004c0)=ANY=[@ANYRESHEX=r2]) [ 397.566076] binder: 27663:27677 transaction failed 29201/-22, size 0-0 line 3013 [ 397.585878] binder: BINDER_SET_CONTEXT_MGR already set [ 397.585889] binder: 27660:27666 ioctl 40046207 0 returned -16 13:55:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x22030, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x351, 0x0, &(0x7f00000000c0)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1109004003"], 0x0, 0x0, &(0x7f0000000480)}) [ 397.590699] binder: BINDER_SET_CONTEXT_MGR already set [ 397.590708] binder: 27676:27681 ioctl 40046207 0 returned -16 [ 397.590824] binder: BINDER_SET_CONTEXT_MGR already set [ 397.590831] binder: 27676:27681 ioctl 40046207 0 returned -16 [ 397.590968] binder_alloc: 27660: binder_alloc_buf, no vma 13:55:20 executing program 1: syz_mount_image$vfat(&(0x7f0000001680)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000dfff, 0x1, &(0x7f0000000040)=[{&(0x7f00000016c0)="eb64c86d4f66732e66617400020441000500077008f8", 0x16}], 0x0, &(0x7f0000000140)=ANY=[]) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000780)) mknod(&(0x7f0000000240)='./file0/file0\x00', 0x20, 0x4) r0 = fcntl$getown(0xffffffffffffffff, 0x9) timer_create(0x0, &(0x7f0000000180)={0x0, 0x0, 0xfffffffffffffffe, @tid=r0}, &(0x7f0000000540)) perf_event_open(&(0x7f000001d000)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x10000000, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = epoll_create1(0x80000) r2 = dup3(r1, 0xffffffffffffffff, 0x80000) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f0000000140)={0x0, 0x19, 0x0, 0x39, "c0bb8f112c48ab20a3e76d0e7be59c7baca6ad4021f84ca6d662c3ae763f780c"}) ioctl$TIOCMBIS(r2, 0x5416, &(0x7f0000000700)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x9) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) ioctl$EVIOCGPHYS(r2, 0x80404507, &(0x7f0000000cc0)=""/105) syz_genetlink_get_family_id$ipvs(&(0x7f0000000800)='IPVS\x00') getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000680)={&(0x7f0000ffb000/0x4000)=nil, 0x4000}, &(0x7f00000006c0)=0x10) sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x801000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="c6bacdf595bcaced0e2ed1aa72152e6125eb673024a4"], 0x1}, 0x1, 0x0, 0x0, 0x4000}, 0x0) time(&(0x7f00000003c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000000) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet(0x2, 0x200000002, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x27, &(0x7f0000000080)={@multicast1, @local}, 0xc) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r5, 0x0, 0x4000000000000027, &(0x7f0000000000)={@multicast1, @local, @remote}, 0xc) close(r5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$iso9660(&(0x7f0000000300)='iso9660\x00', &(0x7f0000000340)='./file0/file1\x00', 0x5, 0x1, &(0x7f0000000380)=[{&(0x7f0000000400)="5f9c21cbed20154b7a181c33084c09b3883f9dc6b9e4cae7dfa9d2f118136e59e2899d0e223d05aeb121f3342724720eea78b9aa9fff350d813015bf0221d351c8f0c50821f3f01e1bed9179b73adac4d44d0498b146866a9144cc713c036cd3aefaa030b77ee1aef4acd3556d738c36bcd7e14c0d", 0x75, 0x1}], 0x1000, &(0x7f0000000480)={[{@unhide='unhide'}, {@map_off='map=off'}, {@norock='norock'}, {@norock='norock'}]}) acct(&(0x7f0000000200)='./file0/file0\x00') umount2(&(0x7f0000000a00)='./file0\x00', 0x4000000000000001) 13:55:20 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='oom_score_adj\x00') pread64(r0, &(0x7f0000003c00)=""/4096, 0x200000, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) 13:55:20 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f0000000180)="a9f7ec326ad21bcc6c8a3639f1e83f8e5be17f9dd69e054520634ed1dc0a0dd7351044843066315a0b273789da3ccd96614e4c4904f23850c287e0b3f6947680f63cb87c8788df68dc2272387f1299a6e0b8a8c7f02a35b433020864c72b3be07c6ad9eada0effe3c3ce4b709a4cc1337e161c053a0c5f17dce31e7e2a568f0ac14f0f51d2f5ce055deb862f4e90e582ff2aa272907f0789ee7d1d950aeb2652c41ac29bafbfa18e97b7809e2dc15ba3812848e9eb91ecdddf2cb7213aff6ecc4d79") r0 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/pktcdvd/control\x00', 0x400000, 0x0) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f0000000100)) fchdir(r0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x800, 0x0) ioctl$BLKFRASET(r1, 0x1264, &(0x7f0000000080)=0x100000000) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000280), 0x4) [ 397.590985] binder: 27676:27681 transaction failed 29189/-3, size 24-8 line 3136 [ 397.591258] binder: 27676:27681 unknown command 1073744145 [ 397.591266] binder: 27676:27681 ioctl c0306201 20000080 returned -22 [ 397.703856] binder_alloc: 27660: binder_alloc_buf, no vma [ 397.716250] binder: 27660:27699 transaction failed 29189/-3, size 24-8 line 3136 [ 397.729104] binder: 27660:27666 ERROR: BC_REGISTER_LOOPER called without request [ 397.736909] binder: 27660:27678 unknown command 536871104 [ 397.742740] binder: 27660:27678 ioctl c0306201 20000080 returned -22 [ 397.750345] binder: undelivered TRANSACTION_ERROR: 29189 [ 397.755865] binder: release 27660:27666 transaction 737 in, still active [ 397.779139] binder: send failed reply for transaction 737 to 27660:27666 [ 397.790640] binder: undelivered TRANSACTION_COMPLETE [ 397.795905] binder: undelivered TRANSACTION_ERROR: 29189 13:55:20 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="020300020a000000000000008000000003000600000000f901000000e00000c1000000000000000002000100000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x50}}, 0x0) getgroups(0xa, &(0x7f0000000080)=[0xffffffffffffffff, 0xee00, 0x0, 0xee00, 0xffffffffffffffff, 0xee00, 0xee01, 0xee01, 0xee00, 0xee00]) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair(0x4, 0x3, 0x100000001, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$TIOCLINUX6(r3, 0x541c, &(0x7f0000000180)={0x6, 0x401}) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x3, &(0x7f0000000200)=[r1, r2, r4]) 13:55:21 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = fcntl$getown(r1, 0x9) fcntl$setownex(r0, 0xf, &(0x7f00000000c0)={0x2, r2}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x22030, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x351, 0x0, &(0x7f00000000c0)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1109004003"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:21 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) listxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=""/140, 0x8c) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) 13:55:21 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x4c}, {0x6}]}, 0x10) 13:55:21 executing program 1: mkdir(&(0x7f0000000380)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f000000aff8)='./file0\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, &(0x7f000001c000)) chdir(&(0x7f0000000180)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$eventfd(r0, &(0x7f0000000080), 0xfffffe5e) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000500)={{{@in=@dev, @in6=@mcast1}}, {{@in=@multicast1}, 0x0, @in6=@dev}}, &(0x7f0000000100)=0xe8) creat(&(0x7f0000000000)='./file0\x00', 0x12e) lstat(&(0x7f00000006c0)='./bus\x00', &(0x7f0000000700)) fstat(0xffffffffffffffff, &(0x7f0000000880)) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000ac0)={0x53, 0xffffffffffffffff, 0x1e, 0x7b0, @scatter={0x7, 0x0, &(0x7f0000000800)=[{&(0x7f00000001c0)=""/103, 0x67}, {&(0x7f0000000040)=""/28, 0x1c}, {&(0x7f0000000240)=""/226, 0xe2}, {&(0x7f0000000440)=""/85, 0x55}, {&(0x7f0000000600)=""/184, 0xb8}, {&(0x7f0000000780)=""/86, 0x56}, {&(0x7f0000000900)=""/239, 0xef}]}, &(0x7f0000000140)="598a32efdce8836a650044a42159b6fb454fca2dea2993a3ea78912794e9", &(0x7f0000000a00)=""/134, 0x10000, 0x0, 0x3, &(0x7f0000000340)}) 13:55:21 executing program 4: r0 = accept(0xffffffffffffff9c, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, &(0x7f0000000140)=0x80) getpeername$unix(r0, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x3, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f00009e1000)='./file0\x00', 0xc007d1bed8eee74, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000240)={0x0, 0x0}) write$FUSE_LK(r3, &(0x7f0000000280)={0x28, 0xfffffffffffffff5, 0x7, {{0x200, 0x100000001, 0x97cd606478dfa4b9, r4}}}, 0x28) fcntl$setlease(r2, 0x400, 0x2) 13:55:21 executing program 7: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@noextend='noextend'}]}}) write$P9_RREADDIR(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="2a000000290100000000000000000000000000000000000000000000000000000007002e2f66696c6530"], 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RATTACH(r1, &(0x7f0000000040)={0x14, 0x69, 0x2, {0x10, 0x2, 0x7}}, 0x14) write$P9_RWALK(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="160000006f0100010000000000000000171d0e010000"], 0x16) r2 = getuid() stat(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f00000000c0)='./file0\x00', r2, r3) write$P9_RGETATTR(r1, &(0x7f0000000540)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RWRITE(r1, &(0x7f0000000400)={0xb, 0x77, 0x1}, 0xb) write$P9_RGETATTR(r1, &(0x7f0000000640)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RGETATTR(r1, &(0x7f0000000a00)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RWALK(r1, &(0x7f0000000940)={0x9, 0x6f, 0x1}, 0x9) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000008c0)='9p\x00', 0x0, &(0x7f0000000440)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r4 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) writev(r4, &(0x7f0000002d00)=[{&(0x7f0000002c80)="17", 0x1}], 0x1) 13:55:21 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x802, 0x0) sendto$inet6(r1, &(0x7f0000000700)="dfe278d84f047e1808a3a992ddc3897e9a0e72c21d071d767c92f5a76aabd0152fcbd05c4db7f4e5e729497dfc375f1a021a5b1fd8ea7d7047775b8daf66303ddae94f4cc9d10f0e4bd21802c30927bf91de19baad5d68d29e6c0265b15278bc3a26defe99b129cae1e0377939e119e495cb84900b82d2c0689fd8d30bcd08437ed371f99c2b1cb8434a8ed7a106d463883ccdd36f76022dd29c59311fd01f26dc7cb7bb2578798d919b871cbb90dda4fccbca8d521c0c9c95c6278cad91c144f5079d7aa44b35c54465cb314586eae1b2afb0d94912bea757906d494c2e049598bae15d4a1b6892ed414e4ca5448a7e457350859333529825a60e93889fece46d4917cb7b429852148679694cbbb5d71bd8c81da130daf7387dc095c6ea85a19f5c62434a0b42723ae95420971a2edaa24f04e1c558013be5b08d1903dd2aa5b55ff876b7df8ad497a163fc1667bf677560acc9bdc58fd2190ceb7ee16969f2b7924651b5256b83fa8cee4a85b601371092d883db7c63cc060f80cc96a47d90dfc06ebf61665b68ab6c40e701325f2ad65b98bbc038fc1f70c5cec0ef6de84b30f331304e18333bf6018ab00b454771618a74cdcb90bae013843a586b8da3f26fc134faea8f02f500ccfc8d8e056bfe8154a816b1c836d2f0345fe72801be88a7bf12b5b70f3fca631f4f27ade17670201ca78090a2ce78f7660b62d6b1ae74b433a537ec8972cd75ed3aef141e6e274274ceed44bdcd0bdfb649d39a860042261fc9ab949991711eac9264633a7f15ff272779b3015c402e43e63fa3cbb3baaffe971b739673c5313ef74a7c2a480a7302734a607e1cd559189f4aee38fbcd3bde9776c29fc8426b18bb0029546358d39ce716f03359f656cb3103e1ef253bd061d7a3e006f9f04e326f391426a8618dcf4747f189c892ca162d7a2949aedf8eb6ead2a7f8673c03830282983f880d7ff55b9bc04afd7439857238bef451407dbd506b94d8a0085a9649e9d2f24d4442ce81791d7f0b00eefc6547c57493812cb93d1166bd506ff8cd0852edd7d8ccf90a2f5f137e82c7f2b356ab3f7fc0f854f82608949d79e780d563642ee0ee73397a83117059d2b30f4dc169f98474d01200cd765918dde6c075b3444d46c0859a7d921469c7ffa6a1caac885a8f285fe70c48233d29061f13b216ac406247a68aa3c516fac4cacbd78a303377130cd92ba8331614365765b2c80cb717626c9f6e9b45d6d16b10ca7325316e8107c2b57d630b46fb8369905a2e9b75e0a3b0972634b46e44430310580e9ae49ac0f065261ca26053dc08aafb3308e40d709a6404fa39e45e9643edf205ba121470c36389e3c161ab41179418b71652f92cb4b3a6d925fcd7d5c0a13ab9c020446aae0e7d3eedf23fec3ffa6ed748953bf8a5e19960f43313f16e5bb43f3e6adc62a5a45db3ea43e44ed6ee5596a6c66c747aab8757ee26d5912a07edecd4e4b9d6f6a03c6f4d7445d041fab5cdd668280b392be052ca3095a8408ac836e6d361f5c7512768f6897b7529d658503f61bcffc714e95adabd1178191b3d82d959200e508c6358af53b7684d2cab8ed404cdfd134e004a71deaaaec8c9835e5a711b51e1829f96c2be8ad2c851f8b70c70114cbb7d647cfb26ba91f62ec29925e6f10aebbb0a28a7ffcfc360d86a70ade4d3d2bbbea005b41823f2a54b1513ee080e62d3f337a0e2", 0x4c3, 0x8000, &(0x7f00000005c0)={0xa, 0x3, 0x0, @mcast2}, 0x1c) sendto$inet6(r1, &(0x7f0000000000)="078195770684a97ec6071c6426f24f6381202674c2567864ecfa48ca593b414be0056e4fa1a5a9e43718a472b623b451f0ffa38c5ed89334f5df1e5791926a5bec9675977918454c2988c0516d8e4b3557426750482804a3870e8c16b5621767a100b988a1a905f9c472c43656b7071421b0b2afc3781384d5f3205c276e0dffbaf14bb9220bd8f911291ba8828d125fae5e6b7752c2f7462d7534c1de0d5d46fe1e37d1512ceac522b4858f71669f3542197c5a3f87d766fd4fb9127e5151a5197aeb79e20e1c546fbae6be5da95d436cf1e0723fe74592cb5fe414d7ad", 0xde, 0x8000, &(0x7f0000000100), 0x1c) r2 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000140)='/dev/pktcdvd/control\x00', 0x111000, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f00000001c0)=0x6, 0x4) write(r1, &(0x7f00000003c0)="679294a82c94a09830a9d437", 0xc) accept4$inet6(r1, &(0x7f0000000340)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000380)=0x1c, 0x80800) mount$9p_unix(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x40000, &(0x7f00000002c0)={'trans=unix,', {[{@mmap='mmap'}, {@version_L='version=9p2000.L'}, {@msize={'msize', 0x3d, 0x9}}, {@uname={'uname', 0x3d, 'posix_acl_access'}}]}}) [ 398.261163] binder: undelivered TRANSACTION_ERROR: 29201 [ 398.293946] binder: 27731:27738 ERROR: BC_REGISTER_LOOPER called without request [ 398.304904] binder_alloc: 27731: binder_alloc_buf, no vma 13:55:21 executing program 5: syz_mount_image$vfat(&(0x7f0000000100)='vfat\x00', &(0x7f0000000140)='./file0\x00', 0xffff, 0x1, &(0x7f0000000200)=[{&(0x7f0000000000)="f7f5d36f7024716626f88b475e28c84ff6cea634f792294151524baac07b59c3238175f30b542b5056185a390d7788b0e1e02f4f89d11a118cc14ad258356dddbc3534c2ffb964ccd11e7907f1ac4626c1be217108d3b9aeee4519f599924aec4487e71a183adc8b63daf432ad27bfaa4cc4d5473dcc75a7107df34dc323c840fcc07803ef3677a8d3d37144222307988647d158832cd6201736f544bd6593ee74d85df1c1b523eb401012a3e84d277aa81bd1a0f886ab61b2460fdb83355b44a9fbe1614fe8b6d496cf3bbd149d2d777b97f23ebbf352", 0xd7, 0x200}], 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="73686f72746e61ed653d6c6f7765724700584f39d14b8b690d225c40d1eb330d88f33ccea401000080035966be3afc9513c7bbe49527e00ba7e310fa8e4fe95ce6c08a9e60aa3299d62b5487a7de577db528d5073d8ad234d87493b7f56e8bfb110ef55dd9830f25bc723346a05db31470870e654aad676fb156e62e385421764e001fc52ab1e4c735e4d96700359813eeeb093875148b349c750ea6435681"]) 13:55:21 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x5, 0x200000) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000080)={0x2, 0x68, 0x312, 0x9, 0x10001, 0x9}) mprotect(&(0x7f0000687000/0x1000)=nil, 0x1000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) [ 398.315432] binder: 27731:27738 transaction failed 29189/-3, size 0-0 line 3136 [ 398.336139] binder: BINDER_SET_CONTEXT_MGR already set [ 398.342014] binder: 27731:27749 ioctl 40046207 0 returned -16 [ 398.348957] binder_alloc: 27731: binder_alloc_buf, no vma [ 398.354587] binder: 27731:27738 transaction failed 29189/-3, size 24-8 line 3136 13:55:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4, 0x14, r0, 0x11) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) eventfd(0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 398.364360] binder: 27731:27749 ERROR: BC_REGISTER_LOOPER called without request [ 398.397873] binder: undelivered TRANSACTION_ERROR: 29189 [ 398.405094] binder: release 27731:27738 transaction 744 in, still active 13:55:21 executing program 7: socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000080)=0x65) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000012c0)={&(0x7f0000000000), 0xc, &(0x7f0000001280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000010000105000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000182ab32e7b35203a9dcee8001200080041007369740a0c0001ffffffe6000000000400000000"], 0x38}}, 0x0) 13:55:21 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r0, 0x4, 0x2000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x5, 0x2, 0x11) r2 = syz_open_procfs(0x0, &(0x7f0000000080)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f02acc7edbcd7a071fb35331ce39c5a") sendfile(r1, r2, &(0x7f00000000c0), 0x200080000004) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r2, 0xc0505405, &(0x7f0000000100)={{0x0, 0xfffffffffffffffc, 0xffff, 0x3, 0x400}, 0x2, 0x7fffffff, 0x1}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x4000, 0x0) mknodat(r3, &(0x7f0000000180)='./file0\x00', 0x1028, 0x200) 13:55:21 executing program 1: r0 = socket(0x10, 0x2, 0xc) write(r0, &(0x7f0000000300)="1f0000000104ff00fd4354c007000000f3e90000084a6f00dcffdf00000000", 0x1f) [ 398.414994] binder: send failed reply for transaction 744 to 27731:27738 [ 398.422009] binder: undelivered TRANSACTION_ERROR: 29189 [ 398.428226] binder: undelivered TRANSACTION_COMPLETE [ 398.433393] binder: undelivered TRANSACTION_ERROR: 29189 [ 398.449030] binder: 27753:27757 ERROR: BC_REGISTER_LOOPER called without request 13:55:21 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000480)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c03, 0x0) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000000)) [ 398.498384] binder: 27753:27763 got transaction to invalid handle [ 398.506255] binder: 27753:27763 transaction failed 29201/-22, size 0-0 line 3013 13:55:21 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_tcp_buf(r0, 0x6, 0x2b, &(0x7f0000000140)="c75556b7c8830add44a6b07b08922fe1d0bd35fe68c1fd95fa6cd638c3add48969a6f17bed79b57baa4fcb1d7866f15537e64aa1414e6874d7c7b444be716cbde8efea75a109954318eaa69cdcc8bee56abeb7ff87ac622eab297c30357aac87d8b31f010024bfc67ded50e3d95d659d1e655eb80ddcc2b4f513bdb202082cb786c46bfb5a3997eca08b8553399123348accc95af355ce3ef43b18e327091ed128311b0ccf6967276692fc62380681a537acd774b340da7b97f0dc55c2da5a100a28c133d5d85c2143a94cc7a41979ff38296c7717c409b68906b3247bac5360ab57", 0xe2) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$sock_ifreq(r0, 0x893f, &(0x7f0000000240)={'nr0\x00', @ifru_addrs=@llc={0x1a, 0x337, 0x3, 0x2, 0x4, 0x6, @random="1501038c5852"}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f00000002c0), &(0x7f0000000300)=0x10) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$sock_timeval(r1, 0x1, 0x9, &(0x7f0000000100)={0x77359400}, 0x10) 13:55:21 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x104) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f0000000080)) [ 398.577507] binder: BINDER_SET_CONTEXT_MGR already set [ 398.587036] binder: 27768:27772 ioctl 40046207 0 returned -16 [ 398.595255] binder: 27768:27772 ERROR: BC_REGISTER_LOOPER called without request [ 398.602627] binder: release 27753:27757 transaction 751 in, still active [ 398.602633] binder: send failed reply for transaction 751 to 27768:27772 [ 398.602649] binder: undelivered TRANSACTION_ERROR: 29201 13:55:21 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = fcntl$getown(r0, 0x9) ptrace$getregset(0x4204, r1, 0x203, &(0x7f0000000240)={&(0x7f00000000c0)=""/51, 0x33}) r2 = open(&(0x7f0000000080)='./file0/file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f00003b9fdc)) getsockopt(0xffffffffffffffff, 0x1, 0x2, &(0x7f0000008d00)=""/130, &(0x7f0000008dc0)=0x82) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000000100)=[{}]}, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f0000000300)={0x110, r4, 0x124, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x401}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xb2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9d38bdd}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfff}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xffffffff}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7fff}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7a49}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x110}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) sendto$inet(r2, &(0x7f0000000200)="8f2c429e149fd96ce8b07324a51a67ed79456740dd0d62b8a5f5ff724da952fb38", 0x21, 0x0, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000052c0)) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000005400)={{{@in6=@dev, @in6=@loopback}}, {{}, 0x0, @in6=@remote}}, &(0x7f0000005240)=0x2c) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000007700), &(0x7f0000007740)=0xc) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000007780)) lstat(&(0x7f0000005300)='./file0/file0\x00', &(0x7f0000007940)) ioctl$TIOCEXCL(r3, 0x540c) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000008c00)=""/134, &(0x7f0000008cc0)=0x86) ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, &(0x7f00000001c0)={'team_slave_0\x00', 0x1f}) 13:55:21 executing program 7: r0 = socket$inet6(0xa, 0x40000000080005, 0x2100) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = epoll_create1(0x80000) r2 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0x0, 0x0) r3 = dup2(r0, r0) write$P9_RREMOVE(r3, &(0x7f0000000100)={0x7, 0x7b, 0x2}, 0x7) ioctl$BLKFLSBUF(r1, 0x40480923, &(0x7f0000000140)=0x82) ioctl$BLKROTATIONAL(r2, 0x127e, &(0x7f00000000c0)) 13:55:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0xfffffffffffffcbf, &(0x7f00000000c0)=0x8000009) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='tunl0\x00', 0x10) sendto$inet(r0, &(0x7f0000000100), 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0)={0x2, 0x0, @rand_addr}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000640)={{{@in6=@mcast2, @in=@remote}}, {{@in=@rand_addr}, 0x0, @in6}}, &(0x7f0000000740)=0xe8) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$selinux_user(r1, &(0x7f0000000180)={'system_u:object_r:updpwd_exec_t:s0', 0x20, 'staff_u\x00'}, 0x2b) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000100)='.', &(0x7f00000001c0)='loefs\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f000095bffc), 0x4) [ 398.641037] binder: 27768:27778 got transaction to invalid handle [ 398.647437] binder: 27768:27778 transaction failed 29201/-22, size 0-0 line 3013 [ 398.662435] netlink: 24 bytes leftover after parsing attributes in process `syz-executor7'. [ 398.677473] netlink: 24 bytes leftover after parsing attributes in process `syz-executor7'. 13:55:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x101000, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x80000, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x200, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) perf_event_open(&(0x7f0000000100)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 13:55:21 executing program 1: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000003c0)) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x0) mount(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ext3\x00', 0x0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x10440, 0x0) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='9p\x00', 0x40000, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@fscache='fscache'}]}}) mount$9p_rdma(&(0x7f0000000200)='127.0.0.1\x00', &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x2, &(0x7f00000002c0)={'trans=rdma,', {'port', 0x3d, 0x4e24}, 0x2c, {[{@common=@version_u='version=9p2000.u'}, {@sq={'sq', 0x3d, 0x80000000}}, {@sq={'sq', 0x3d, 0x3}}, {@common=@aname={'aname', 0x3d, '/dev/sequencer\x00'}}, {@timeout={'timeout'}}, {@common=@noextend='noextend'}, {@sq={'sq', 0x3d, 0x6}}, {@rq={'rq'}}]}}) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x28, 0x1) bind$unix(r1, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e24}, 0x6e) [ 398.719389] netlink: 11 bytes leftover after parsing attributes in process `syz-executor1'. [ 398.731329] netlink: 11 bytes leftover after parsing attributes in process `syz-executor1'. 13:55:21 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f0000000000)="c0268c4fed5ae9") [ 398.766963] binder: 27795:27800 ERROR: BC_REGISTER_LOOPER called without request 13:55:21 executing program 7: set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f0000000300)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) ioctl$EVIOCGMTSLOTS(0xffffffffffffffff, 0x8040450a, &(0x7f0000000300)) mlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000380)=0x4, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000100)=0x4, 0x4) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) lstat(&(0x7f0000000340)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000440)=0x0, &(0x7f0000000480), &(0x7f0000000540)) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000580)={0x0, 0x0, 0x0}, &(0x7f00000005c0)=0xc) fstat(r1, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000f80)=@nat={'nat\x00', 0x19, 0x6, 0x8f8, [0x20000680, 0x0, 0x0, 0x200009c0, 0x20000cb8], 0x0, &(0x7f00000002c0), &(0x7f0000000680)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x3, 0x1, 0x88fb, 'bridge_slave_1\x00', 'team_slave_0\x00', 'ipddp0\x00', 'ip_vti0\x00', @local, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], @random="94b14fee8ccf", [0x0, 0xff, 0x0, 0xff], 0x1c8, 0x238, 0x270, [@vlan={'vlan\x00', 0x8, {{0x2, 0x6, 0x8809, 0x4, 0x1}}}, @comment={'comment\x00', 0x100}]}, [@arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffd}}}, @snat={'snat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 0xffffffffffffffff}}}]}, @arpreply={'arpreply\x00', 0x10, {{@link_local, 0xffffffffffffffff}}}}, {{{0x3, 0x40, 0xf7, 'ip6gre0\x00', 'vlan0\x00', 'syzkaller1\x00', 'teql0\x00', @local, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], 0x70, 0x70, 0xa0}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x8}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x2, [{{{0x3, 0x28, 0x88cf, 'syzkaller0\x00', 'veth1_to_bridge\x00', 'dummy0\x00', 'bcsh0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0xff, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0xff, 0xff], 0xc0, 0x128, 0x160, [@ipvs={'ipvs\x00', 0x28, {{@ipv6=@remote, [0xffffffff, 0xffffff00, 0xff, 0xffffffff], 0x4e22, 0x2c, 0x1, 0x4e20, 0x11, 0x2}}}]}, [@common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}, @arpreply={'arpreply\x00', 0x10, {{@local, 0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffd}}}}, {{{0x15, 0x10, 0x8848, 'veth0_to_bond\x00', 'yam0\x00', 'bcsh0\x00', 'veth0\x00', @dev={[], 0x1b}, [0xff, 0x0, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xe0, 0x130, 0x168, [@stp={'stp\x00', 0x48, {{0xfff, {0x7, 0x9, 0x7, @local, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x1f, 0xfff, 0xf999, 0x3f, @dev={[], 0xc}, [0x0, 0x0, 0x0, 0x0, 0xff], 0x4e20, 0x4e21, 0x3f, 0x800, 0x4, 0x1, 0x6, 0x8, 0x3, 0x2}, 0x8, 0x2}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x2, 'syz0\x00', 0x7}}}]}, @arpreply={'arpreply\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x4, 0xffffffffffffffff, 0x2, [{{{0x9, 0x20, 0x600f, 'vcan0\x00', 'bcsf0\x00', 'veth1_to_bridge\x00', 'bond_slave_0\x00', @local, [0xed55855b4698c572, 0x0, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x138, [@limit={'limit\x00', 0x20, {{0xa2, 0x100000000, 0x1, 0x40000, 0xfffffffffffeffff, 0x1f}}}, @ip={'ip\x00', 0x20, {{@multicast1, @broadcast, 0x0, 0xff000000, 0x20, 0x89, 0x4, 0xa, 0x4e24, 0x4e21, 0x4e23, 0x4e21}}}]}}, @arpreply={'arpreply\x00', 0x10, {{@broadcast, 0xffffffffffffffff}}}}, {{{0x5, 0x2, 0x880b, 'bcsf0\x00', 'syzkaller1\x00', 'bridge_slave_1\x00', 'veth0_to_bond\x00', @link_local, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @random="947c8ab8728d", [0x0, 0xff, 0xff, 0x0, 0xff], 0xb0, 0x120, 0x158, [@owner={'owner\x00', 0x18, {{r3, r4, r5, r6, 0x4, 0x1}}}]}, [@common=@dnat={'dnat\x00', 0x10, {{@local, 0x10}}}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffc}}}]}, @snat={'snat\x00', 0x10, {{@dev={[], 0x18}, 0xffffffffffffffff}}}}]}]}, 0x970) sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) mount(&(0x7f0000000200)='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='sockfs\x00', 0x60a782820fec975e, 0x0) perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000040)=""/125) [ 398.820035] binder: 27795:27806 got transaction to invalid handle [ 398.832745] binder: 27795:27806 transaction failed 29201/-22, size 0-0 line 3013 13:55:21 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) fcntl$dupfd(r1, 0x406, r1) r2 = fcntl$getown(r1, 0x9) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x200, 0x7, 0x0, 0x9, 0x0, 0x9, 0x0, 0x4, 0x6, 0x6, 0x2, 0x1, 0x3, 0xffffffff80000000, 0x0, 0x1, 0x800, 0x3, 0x2, 0x4, 0x5df, 0x101, 0x8, 0x1000, 0x401, 0x6b, 0x7ff, 0x6, 0x8, 0x9, 0x4, 0x0, 0xfffffffffffffffe, 0x9, 0x0, 0x5, 0x0, 0x10001, 0xb1752eb5e07fdd93, @perf_config_ext={0x27c, 0x1}, 0x42, 0x1, 0xfffffffffffffffa, 0xa9fa02a13d1ac9c8, 0xffffffff, 0x0, 0x1400000}, r2, 0xb, r1, 0x8) sendmsg$nl_route(r0, &(0x7f0000000580)={&(0x7f0000000500), 0xc, &(0x7f0000000540)={&(0x7f00000015c0)=@ipv4_newroute={0x1c, 0x18, 0x331, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x2}}, 0x1c}}, 0x0) [ 398.894505] 9pnet: Could not find request transport: rdma [ 398.909948] 9pnet: Could not find request transport: rdma [ 399.378221] binder: BINDER_SET_CONTEXT_MGR already set [ 399.383678] binder: 27768:27833 ioctl 40046207 0 returned -16 [ 399.389909] binder: 27768:27833 ERROR: BC_REGISTER_LOOPER called without request [ 399.402935] binder: release 27795:27800 transaction 757 in, still active [ 399.411002] binder: send failed reply for transaction 757 to 27768:27778 [ 399.418047] binder: undelivered TRANSACTION_ERROR: 29201 [ 399.436260] binder: 27768:27834 got transaction to invalid handle [ 399.443210] binder: 27768:27834 transaction failed 29201/-22, size 0-0 line 3013 [ 399.452272] binder: undelivered TRANSACTION_COMPLETE [ 399.458065] binder: undelivered TRANSACTION_ERROR: 29189 [ 399.471544] binder: undelivered TRANSACTION_ERROR: 29201 [ 399.478766] binder: undelivered TRANSACTION_ERROR: 29201 13:55:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x13) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x21100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)={0xa8, r2, 0x200, 0x70bd2b, 0x1, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x7}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}]}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x2}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x20}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffffff}]}, 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:22 executing program 5: r0 = openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/member\x00', 0x2, 0x0) r1 = timerfd_create(0x1, 0x80800) ioctl$FICLONE(r0, 0x40049409, r1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket(0x18, 0x0, 0x1) prctl$getname(0x10, &(0x7f0000000240)=""/154) connect(r2, &(0x7f0000dcd000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}, 0x2}}, 0xfffffffffffffd02) socket$packet(0x11, 0xa, 0x300) sendmmsg(r2, &(0x7f00000002c0), 0x4000000000000f4, 0x0) 13:55:22 executing program 1: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x16881, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000040)={0x9, {{0x2, 0x4e21, @multicast1}}}, 0x88) 13:55:22 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f0000000000)) 13:55:22 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = dup3(r0, r1, 0x80000) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000000)={'nr0\x00', 0x200}) getsockopt$inet_opts(r1, 0x0, 0x40000000000000b, &(0x7f0000937fed)=""/16, &(0x7f0000000040)=0x10) 13:55:22 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setlease(r0, 0x400, 0x1) recvmsg(r0, &(0x7f0000004040)={&(0x7f0000003dc0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0xfffffffffffffe59, &(0x7f0000000040)=[{&(0x7f00000002c0)=""/117, 0xfffffffffffffd0f}, {&(0x7f00000001c0)=""/218, 0xda}], 0x10000000000000c6, 0x0, 0x0, 0x4}, 0x2) sendmsg$nl_netfilter(r0, &(0x7f0000000100)={&(0x7f00000000c0), 0xc, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="1000e6baef137a88ac5ba9af5d"], 0x14}}, 0x0) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000140)={0x7, 0x81}) 13:55:22 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:22 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000400)={&(0x7f0000000300), 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, r1, 0x325}, 0x14}}, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000000)=0x8, 0x4) readv(r0, &(0x7f0000001600)=[{&(0x7f0000000100)=""/228, 0xe4}], 0x1) [ 399.484951] binder: undelivered TRANSACTION_COMPLETE [ 399.490816] binder: undelivered TRANSACTION_ERROR: 29189 13:55:22 executing program 3: mprotect(&(0x7f0000232000/0x4000)=nil, 0x4000, 0x0) clone(0x0, &(0x7f0000000000), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) futex(&(0x7f0000000000)=0x2, 0x9, 0x0, &(0x7f00000000c0)={r0, r1+10000000}, &(0x7f0000000100), 0x1) 13:55:22 executing program 7: set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f0000000300)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) ioctl$EVIOCGMTSLOTS(0xffffffffffffffff, 0x8040450a, &(0x7f0000000300)) mlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000380)=0x4, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000100)=0x4, 0x4) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) lstat(&(0x7f0000000340)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000440)=0x0, &(0x7f0000000480), &(0x7f0000000540)) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000580)={0x0, 0x0, 0x0}, &(0x7f00000005c0)=0xc) fstat(r1, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000f80)=@nat={'nat\x00', 0x19, 0x6, 0x8f8, [0x20000680, 0x0, 0x0, 0x200009c0, 0x20000cb8], 0x0, &(0x7f00000002c0), &(0x7f0000000680)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x3, 0x1, 0x88fb, 'bridge_slave_1\x00', 'team_slave_0\x00', 'ipddp0\x00', 'ip_vti0\x00', @local, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], @random="94b14fee8ccf", [0x0, 0xff, 0x0, 0xff], 0x1c8, 0x238, 0x270, [@vlan={'vlan\x00', 0x8, {{0x2, 0x6, 0x8809, 0x4, 0x1}}}, @comment={'comment\x00', 0x100}]}, [@arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffd}}}, @snat={'snat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 0xffffffffffffffff}}}]}, @arpreply={'arpreply\x00', 0x10, {{@link_local, 0xffffffffffffffff}}}}, {{{0x3, 0x40, 0xf7, 'ip6gre0\x00', 'vlan0\x00', 'syzkaller1\x00', 'teql0\x00', @local, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], 0x70, 0x70, 0xa0}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x8}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x2, [{{{0x3, 0x28, 0x88cf, 'syzkaller0\x00', 'veth1_to_bridge\x00', 'dummy0\x00', 'bcsh0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0xff, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0xff, 0xff], 0xc0, 0x128, 0x160, [@ipvs={'ipvs\x00', 0x28, {{@ipv6=@remote, [0xffffffff, 0xffffff00, 0xff, 0xffffffff], 0x4e22, 0x2c, 0x1, 0x4e20, 0x11, 0x2}}}]}, [@common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}, @arpreply={'arpreply\x00', 0x10, {{@local, 0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffd}}}}, {{{0x15, 0x10, 0x8848, 'veth0_to_bond\x00', 'yam0\x00', 'bcsh0\x00', 'veth0\x00', @dev={[], 0x1b}, [0xff, 0x0, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xe0, 0x130, 0x168, [@stp={'stp\x00', 0x48, {{0xfff, {0x7, 0x9, 0x7, @local, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x1f, 0xfff, 0xf999, 0x3f, @dev={[], 0xc}, [0x0, 0x0, 0x0, 0x0, 0xff], 0x4e20, 0x4e21, 0x3f, 0x800, 0x4, 0x1, 0x6, 0x8, 0x3, 0x2}, 0x8, 0x2}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x2, 'syz0\x00', 0x7}}}]}, @arpreply={'arpreply\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x4, 0xffffffffffffffff, 0x2, [{{{0x9, 0x20, 0x600f, 'vcan0\x00', 'bcsf0\x00', 'veth1_to_bridge\x00', 'bond_slave_0\x00', @local, [0xed55855b4698c572, 0x0, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x138, [@limit={'limit\x00', 0x20, {{0xa2, 0x100000000, 0x1, 0x40000, 0xfffffffffffeffff, 0x1f}}}, @ip={'ip\x00', 0x20, {{@multicast1, @broadcast, 0x0, 0xff000000, 0x20, 0x89, 0x4, 0xa, 0x4e24, 0x4e21, 0x4e23, 0x4e21}}}]}}, @arpreply={'arpreply\x00', 0x10, {{@broadcast, 0xffffffffffffffff}}}}, {{{0x5, 0x2, 0x880b, 'bcsf0\x00', 'syzkaller1\x00', 'bridge_slave_1\x00', 'veth0_to_bond\x00', @link_local, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @random="947c8ab8728d", [0x0, 0xff, 0xff, 0x0, 0xff], 0xb0, 0x120, 0x158, [@owner={'owner\x00', 0x18, {{r3, r4, r5, r6, 0x4, 0x1}}}]}, [@common=@dnat={'dnat\x00', 0x10, {{@local, 0x10}}}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffc}}}]}, @snat={'snat\x00', 0x10, {{@dev={[], 0x18}, 0xffffffffffffffff}}}}]}]}, 0x970) sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) mount(&(0x7f0000000200)='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='sockfs\x00', 0x60a782820fec975e, 0x0) perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000040)=""/125) 13:55:22 executing program 4: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_EDIT(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000340)={0x3f, @local, 0x4e22, 0x0, 'none\x00', 0x8, 0x1f}, 0x2c) r0 = accept(0xffffffffffffff9c, &(0x7f0000000200)=@ipx, &(0x7f0000000280)=0x80) setsockopt$inet_mreq(r0, 0x0, 0x526bf2f2b6e2115d, &(0x7f00000002c0)={@loopback, @local}, 0x8) r1 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x22083, 0x0) r3 = gettid() ptrace$cont(0x1f, r3, 0x9, 0xbb) write$P9_RREADLINK(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="10009d00170007002e2f66696c653000"], 0x10) ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000300)=""/57) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000180)={'HL\x00'}, &(0x7f00000001c0)=0x1e) mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x0, 0x4011, r1, 0x0) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0xfffffc47) 13:55:22 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='#em1#+\x00', 0x0) write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f0000000300)={0x28, 0x2, 0x0, {0x1, 0x0, 0xfffffffffffffffe}}, 0xffffff5e) sendfile(r0, r0, &(0x7f0000001000), 0xffff) openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x0, 0x0) r1 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffb) r2 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$reject(0x13, r1, 0x0, 0x4, r2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x33, &(0x7f000002eff0)={0x709, &(0x7f0000000000)=[{}]}, 0x10) [ 399.546487] binder: 27840:27850 ERROR: BC_REGISTER_LOOPER called without request [ 399.591888] binder: 27840:27857 got transaction to invalid handle [ 399.598295] binder: 27840:27857 transaction failed 29201/-22, size 0-0 line 3013 [ 399.624871] binder: BINDER_SET_CONTEXT_MGR already set [ 399.630532] binder: 27856:27858 ioctl 40046207 0 returned -16 13:55:22 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:22 executing program 5: eventfd2(0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = fcntl$getown(r0, 0x9) ptrace$getsig(0x4202, r1, 0x80000001, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x151, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00634040000000000000000000000000000000ff13ffffff0000000000000000000000000018000000000000000800000000000000576740e4ac9b57d487fea36c3b5af221be37969688aaa1068f567a527b3445902e41b4ef0c5748cbb59bea17051a5875139ff0000000000000000000dedebd9f7abb207ef8d20fba8f60fb6a80366639bf795f4597d6bf65b045ce2f0eaace5edad7748644ca5ae7575ff276dc37a1cb406144148d29237407259888bc0b859e484170aafb2918c1c494108807072ad493b2dfca52d09d63acf6a08af6f3a60334aeafa66f432de68b395dd83347a05033fa77cd8b30ac1d02f301768313089ae52796ef19d6bca39a5a3080821db29d572fcab0be7e9a3000a156e661a1242fc3a922992fb725b6c979f7f93186e6d8c9ea8bd046267cb37b68afdd3f7dd8c173be733d12517dff597b3e9cb9fb1dc38bab9d3323b786179644ef81"], 0x0, 0x0, &(0x7f00000003c0)}) [ 399.639370] binder: 27856:27858 ERROR: BC_REGISTER_LOOPER called without request [ 399.643582] binder: release 27840:27850 transaction 763 in, still active [ 399.643588] binder: send failed reply for transaction 763 to 27856:27858 [ 399.643603] binder: undelivered TRANSACTION_ERROR: 29201 [ 399.689759] binder: 27856:27862 got transaction to invalid handle [ 399.696531] binder: 27856:27862 transaction failed 29201/-22, size 0-0 line 3013 13:55:22 executing program 2: r0 = memfd_create(&(0x7f0000000ffe)='$\x00', 0x0) fcntl$getflags(r0, 0x40a) fcntl$getflags(r0, 0x408) 13:55:22 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000000), &(0x7f00000001c0)) [ 399.806490] binder: 27876:27881 got transaction with invalid offset (0, min 0 max 0) or object. [ 399.817658] binder: 27876:27881 transaction failed 29201/-22, size 0-8 line 3199 [ 399.827670] binder: 27876:27881 ERROR: BC_REGISTER_LOOPER called without request [ 399.880252] binder: 27876:27888 got transaction to invalid handle [ 399.890265] binder: 27876:27888 transaction failed 29201/-22, size 0-0 line 3013 [ 400.437473] binder_alloc: binder_alloc_mmap_handler: 27856 20001000-20004000 already mapped failed -16 [ 400.452005] binder: BINDER_SET_CONTEXT_MGR already set [ 400.457315] binder: 27856:27862 ioctl 40046207 0 returned -16 [ 400.459416] binder: undelivered TRANSACTION_ERROR: 29201 [ 400.463553] binder: 27856:27897 ERROR: BC_REGISTER_LOOPER called without request [ 400.464872] binder: release 27876:27881 transaction 770 in, still active [ 400.464879] binder: send failed reply for transaction 770 to 27856:27897 [ 400.464894] binder: undelivered TRANSACTION_ERROR: 29201 [ 400.465953] binder: 27856:27899 got transaction to invalid handle [ 400.465979] binder: 27856:27899 transaction failed 29201/-22, size 0-0 line 3013 [ 400.466257] binder: undelivered TRANSACTION_COMPLETE [ 400.466264] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.466283] binder: undelivered TRANSACTION_COMPLETE [ 400.466287] binder: undelivered TRANSACTION_ERROR: 29189 13:55:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000000c0)=0x0) ptrace$getregset(0x4204, r2, 0x3, &(0x7f0000000180)={&(0x7f0000000480)=""/177, 0xb1}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:23 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000180)='/dev/urandom\x00', 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000300)=""/78, 0x4e, 0x12101, &(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10) fcntl$F_GET_RW_HINT(0xffffffffffffffff, 0x40b, &(0x7f00000000c0)) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB='i'], 0x1) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) fcntl$setstatus(r1, 0x4, 0x4000) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x6, &(0x7f0000000200)=""/209, &(0x7f0000000100)=0xd1) munmap(&(0x7f000004a000/0x1000)=nil, 0x1000) write$selinux_access(r1, &(0x7f0000000000)={'system_u:object_r:etc_t:s0', 0x20, '/usr/sbin/ntpd'}, 0xfffffeff) 13:55:23 executing program 2: ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000100)={0x5, 0x0, 0x1, 0x100000000, 0xfffffffffffffffe, 0x4}) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x803, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x4) sendto(r1, &(0x7f0000000000)="120000001600e70d017b00000000000000a1", 0x12, 0x0, 0x0, 0x0) r2 = accept4$inet(r1, &(0x7f0000000180)={0x2, 0x0, @multicast2}, &(0x7f00000001c0)=0x10, 0x800) tee(r1, r2, 0xbd, 0x0) write(r0, &(0x7f0000000200), 0x0) 13:55:23 executing program 3: clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$input_event(r0, &(0x7f0000000080)={{0x77359400}, 0x0, 0x100000000, 0x6}, 0x18) 13:55:23 executing program 1: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/checkreqprot\x00', 0x200, 0x0) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000340)=0x110) inotify_init1(0x807ff) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000fa4000)) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000000540)) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x82) r2 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) setpriority(0x2, 0x0, 0x100000000) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) r3 = request_key(&(0x7f0000000180)='id_legacy\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000240)='/dev/loop#\x00', 0xffffffffffffffff) keyctl$clear(0x7, r3) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0xff, 0x4000010001}) ioctl$BLKTRACETEARDOWN(r4, 0x1276, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) 13:55:23 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:23 executing program 7: set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f0000000300)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) ioctl$EVIOCGMTSLOTS(0xffffffffffffffff, 0x8040450a, &(0x7f0000000300)) mlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000380)=0x4, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000100)=0x4, 0x4) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) lstat(&(0x7f0000000340)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000440)=0x0, &(0x7f0000000480), &(0x7f0000000540)) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000580)={0x0, 0x0, 0x0}, &(0x7f00000005c0)=0xc) fstat(r1, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000f80)=@nat={'nat\x00', 0x19, 0x6, 0x8f8, [0x20000680, 0x0, 0x0, 0x200009c0, 0x20000cb8], 0x0, &(0x7f00000002c0), &(0x7f0000000680)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x3, 0x1, 0x88fb, 'bridge_slave_1\x00', 'team_slave_0\x00', 'ipddp0\x00', 'ip_vti0\x00', @local, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], @random="94b14fee8ccf", [0x0, 0xff, 0x0, 0xff], 0x1c8, 0x238, 0x270, [@vlan={'vlan\x00', 0x8, {{0x2, 0x6, 0x8809, 0x4, 0x1}}}, @comment={'comment\x00', 0x100}]}, [@arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffd}}}, @snat={'snat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 0xffffffffffffffff}}}]}, @arpreply={'arpreply\x00', 0x10, {{@link_local, 0xffffffffffffffff}}}}, {{{0x3, 0x40, 0xf7, 'ip6gre0\x00', 'vlan0\x00', 'syzkaller1\x00', 'teql0\x00', @local, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], 0x70, 0x70, 0xa0}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x8}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x2, [{{{0x3, 0x28, 0x88cf, 'syzkaller0\x00', 'veth1_to_bridge\x00', 'dummy0\x00', 'bcsh0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0xff, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0xff, 0xff], 0xc0, 0x128, 0x160, [@ipvs={'ipvs\x00', 0x28, {{@ipv6=@remote, [0xffffffff, 0xffffff00, 0xff, 0xffffffff], 0x4e22, 0x2c, 0x1, 0x4e20, 0x11, 0x2}}}]}, [@common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}, @arpreply={'arpreply\x00', 0x10, {{@local, 0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffd}}}}, {{{0x15, 0x10, 0x8848, 'veth0_to_bond\x00', 'yam0\x00', 'bcsh0\x00', 'veth0\x00', @dev={[], 0x1b}, [0xff, 0x0, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xe0, 0x130, 0x168, [@stp={'stp\x00', 0x48, {{0xfff, {0x7, 0x9, 0x7, @local, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x1f, 0xfff, 0xf999, 0x3f, @dev={[], 0xc}, [0x0, 0x0, 0x0, 0x0, 0xff], 0x4e20, 0x4e21, 0x3f, 0x800, 0x4, 0x1, 0x6, 0x8, 0x3, 0x2}, 0x8, 0x2}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x2, 'syz0\x00', 0x7}}}]}, @arpreply={'arpreply\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x4, 0xffffffffffffffff, 0x2, [{{{0x9, 0x20, 0x600f, 'vcan0\x00', 'bcsf0\x00', 'veth1_to_bridge\x00', 'bond_slave_0\x00', @local, [0xed55855b4698c572, 0x0, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x138, [@limit={'limit\x00', 0x20, {{0xa2, 0x100000000, 0x1, 0x40000, 0xfffffffffffeffff, 0x1f}}}, @ip={'ip\x00', 0x20, {{@multicast1, @broadcast, 0x0, 0xff000000, 0x20, 0x89, 0x4, 0xa, 0x4e24, 0x4e21, 0x4e23, 0x4e21}}}]}}, @arpreply={'arpreply\x00', 0x10, {{@broadcast, 0xffffffffffffffff}}}}, {{{0x5, 0x2, 0x880b, 'bcsf0\x00', 'syzkaller1\x00', 'bridge_slave_1\x00', 'veth0_to_bond\x00', @link_local, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @random="947c8ab8728d", [0x0, 0xff, 0xff, 0x0, 0xff], 0xb0, 0x120, 0x158, [@owner={'owner\x00', 0x18, {{r3, r4, r5, r6, 0x4, 0x1}}}]}, [@common=@dnat={'dnat\x00', 0x10, {{@local, 0x10}}}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffc}}}]}, @snat={'snat\x00', 0x10, {{@dev={[], 0x18}, 0xffffffffffffffff}}}}]}]}, 0x970) sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) mount(&(0x7f0000000200)='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='sockfs\x00', 0x60a782820fec975e, 0x0) perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000040)=""/125) [ 400.466452] binder: undelivered TRANSACTION_ERROR: 29201 [ 400.595169] binder: undelivered TRANSACTION_ERROR: 29201 13:55:23 executing program 4: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_EDIT(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000340)={0x3f, @local, 0x4e22, 0x0, 'none\x00', 0x8, 0x1f}, 0x2c) r0 = accept(0xffffffffffffff9c, &(0x7f0000000200)=@ipx, &(0x7f0000000280)=0x80) setsockopt$inet_mreq(r0, 0x0, 0x526bf2f2b6e2115d, &(0x7f00000002c0)={@loopback, @local}, 0x8) r1 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x22083, 0x0) r3 = gettid() ptrace$cont(0x1f, r3, 0x9, 0xbb) write$P9_RREADLINK(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="10009d00170007002e2f66696c653000"], 0x10) ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000300)=""/57) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000180)={'HL\x00'}, &(0x7f00000001c0)=0x1e) mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x0, 0x4011, r1, 0x0) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0xfffffc47) 13:55:23 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000100)="2cf0b818cbda5f0fb8116c467fe2cde171b29e214540916928fd4e210cc92580d4e32487ec4c11420e15425ca458c3c514bdc338955bb9d9fc81b0388a36", &(0x7f0000000180), &(0x7f0000000040), &(0x7f00000001c0)) [ 400.654172] binder: 27906:27912 got transaction with invalid offset (0, min 0 max 0) or object. [ 400.666221] binder: 27906:27912 transaction failed 29201/-22, size 0-8 line 3199 [ 400.677415] binder: 27906:27912 ERROR: BC_REGISTER_LOOPER called without request 13:55:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 400.721484] binder: 27906:27920 got transaction to invalid handle [ 400.728001] binder: 27906:27920 transaction failed 29201/-22, size 0-0 line 3013 13:55:23 executing program 1: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000800)={0x0, 0x0}) ptrace$poke(0x5, r0, &(0x7f0000000840), 0x1f) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x100000000000000) fcntl$setstatus(r2, 0x4, 0x6100) ftruncate(r2, 0x8200) lseek(r2, 0x0, 0x2) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB=';'], 0x1) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) getxattr(&(0x7f0000000680)='./bus\x00', &(0x7f00000006c0)=ANY=[@ANYBLOB="6f73322e473a6e6f64657662646501042d776c3c6e316c6f283b84596c459bedc2888077997575"], &(0x7f0000000740)=""/156, 0x9c) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0x7, &(0x7f0000000880)={0x9, 0x1, 0x4, 0x5}, 0x10) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r3, r4, &(0x7f0000000100), 0x401) capset(&(0x7f0000000140)={0x20080522, r0}, &(0x7f0000000180)={0x9, 0xf9d, 0x3, 0x3, 0x3, 0x9}) fstatfs(r1, &(0x7f00000008c0)=""/252) fcntl$setstatus(r2, 0x4, 0x0) sendfile(r2, r4, &(0x7f0000002780), 0x8000fffffffe) ftruncate(r3, 0x0) [ 400.771600] binder: BINDER_SET_CONTEXT_MGR already set [ 400.785962] binder: 27917:27922 ioctl 40046207 0 returned -16 13:55:23 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:23 executing program 3: clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) [ 400.817260] binder: 27917:27922 got transaction to invalid handle [ 400.824857] binder: undelivered TRANSACTION_ERROR: 29201 [ 400.836799] binder: release 27906:27912 transaction 777 in, still active [ 400.844888] binder: 27917:27922 transaction failed 29201/-22, size 0-0 line 3013 [ 400.858323] binder: send failed reply for transaction 777 to 27917:27922 [ 400.858351] binder: undelivered TRANSACTION_ERROR: 29201 [ 400.878808] binder_alloc: 27917: binder_alloc_buf, no vma [ 400.886369] binder: 27917:27932 transaction failed 29189/-3, size 0-0 line 3136 [ 400.908090] binder: release 27917:27922 transaction 782 out, still active 13:55:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$sndtimer(&(0x7f0000000180)='/dev/snd/timer\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x0, 0x109000) sendmsg$IPVS_CMD_GET_INFO(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10202020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000280)) r3 = open(&(0x7f0000000180)='./bus\x00', 0x200, 0x0) r4 = socket$inet6(0xa, 0x0, 0x0) r5 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000340)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendto$inet6(r6, &(0x7f0000000000), 0xfdb0, 0x4008080, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c) sendmmsg(r6, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f0000000080)=@routing, 0x8) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r7 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) r8 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0xc00, 0x0) ioctl$EVIOCSABS2F(r8, 0x401845ef, &(0x7f0000000180)={0x7ff, 0x0, 0x7fff, 0x1000, 0x5, 0x8}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) sendto$inet6(r3, &(0x7f0000000480)="671c5e4ea87655b273c136c9e587f7d84e488351a326345bb2cc5c17", 0x1c, 0x20000080, &(0x7f00000004c0)={0xa, 0x4e22, 0x4, @mcast2, 0x659a}, 0x1c) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{}]}) [ 400.915665] binder: unexpected work type, 4, not freed 13:55:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 400.946745] binder: undelivered TRANSACTION_COMPLETE [ 400.958132] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.979068] binder: send failed reply for transaction 782, target dead [ 400.991866] binder: undelivered TRANSACTION_ERROR: 29201 [ 401.003316] binder: undelivered TRANSACTION_COMPLETE [ 401.016928] binder: undelivered TRANSACTION_ERROR: 29189 13:55:24 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000740)='/selinux/mls\x00', 0x0, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f0000000780)={0x2, {{0x2, 0x4e21}}, {{0x2, 0x4e23, @loopback}}}, 0x108) clone(0x0, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f00000001c0)) [ 401.062846] binder: 27936:27942 got transaction with invalid offset (0, min 0 max 0) or object. 13:55:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 401.109113] binder: 27936:27950 ERROR: BC_REGISTER_LOOPER called without request [ 401.125857] binder: 27936:27950 got transaction to invalid handle [ 401.125868] binder: 27936:27950 transaction failed 29201/-22, size 0-0 line 3013 [ 401.196803] binder: 27936:27942 transaction failed 29201/-22, size 0-8 line 3199 [ 401.231340] binder: undelivered TRANSACTION_ERROR: 29201 [ 401.263507] binder: undelivered TRANSACTION_ERROR: 29201 [ 401.285995] binder: 27945:27949 ERROR: BC_REGISTER_LOOPER called without request [ 401.330570] binder_alloc: 27945: binder_alloc_buf, no vma [ 401.349473] binder: 27945:27949 transaction failed 29189/-3, size 0-0 line 3136 13:55:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:24 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:24 executing program 1: unshare(0x2000400) r0 = timerfd_create(0x0, 0x0) clock_gettime(0x2, &(0x7f0000000140)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0x10001, 0xa54, 0x7, 0x6, 0xffffffffffffff01, 0x5, 0x885, 0x7}, &(0x7f00000000c0)={0x4, 0x1, 0x1f06, 0xfff, 0x1, 0x3, 0x5, 0xfd3}, &(0x7f0000000100)={0x3, 0x3, 0x1800, 0xe50, 0x7a4, 0x40, 0x6, 0x1}, &(0x7f0000000180)={r1, r2+30000000}, &(0x7f0000000200)={&(0x7f00000001c0), 0x8}) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x77359400}}, &(0x7f0000000040)) 13:55:24 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000180)='/dev/urandom\x00', 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000300)=""/78, 0x4e, 0x12101, &(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10) fcntl$F_GET_RW_HINT(0xffffffffffffffff, 0x40b, &(0x7f00000000c0)) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB='i'], 0x1) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) fcntl$setstatus(r1, 0x4, 0x4000) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x6, &(0x7f0000000200)=""/209, &(0x7f0000000100)=0xd1) munmap(&(0x7f000004a000/0x1000)=nil, 0x1000) write$selinux_access(r1, &(0x7f0000000000)={'system_u:object_r:etc_t:s0', 0x20, '/usr/sbin/ntpd'}, 0xfffffeff) 13:55:24 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x9) r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000340)='/dev/keychord\x00', 0x0, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCCONS(r1, 0x541d) clone(0x2, &(0x7f00000004c0)="d76a7b054ae3f3601aed5b83992416de322b7da8a4016d50392b6d45a635be639816ee15d469177642c3bdb051b24f38", &(0x7f0000000500), &(0x7f0000000040), &(0x7f0000000480)="c965751db521fa024716271f") ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, &(0x7f0000000240)) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x8003, 0x0) write$UHID_DESTROY(r0, &(0x7f0000000140), 0x4) getsockname$netlink(r3, &(0x7f00000002c0), &(0x7f0000000300)=0xc) ioprio_get$uid(0x3, r2) stat(&(0x7f0000000100)='\x00', &(0x7f0000000180)) [ 401.458458] binder: BINDER_SET_CONTEXT_MGR already set [ 401.475745] binder: 27945:27970 ioctl 40046207 0 returned -16 [ 401.496350] binder_alloc: 27945: binder_alloc_buf, no vma [ 401.502104] binder: 27945:27966 transaction failed 29189/-3, size 24-8 line 3136 13:55:24 executing program 7: set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f0000000300)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) ioctl$EVIOCGMTSLOTS(0xffffffffffffffff, 0x8040450a, &(0x7f0000000300)) mlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000380)=0x4, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000100)=0x4, 0x4) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) lstat(&(0x7f0000000340)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000440)=0x0, &(0x7f0000000480), &(0x7f0000000540)) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000580)={0x0, 0x0, 0x0}, &(0x7f00000005c0)=0xc) fstat(r1, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000f80)=@nat={'nat\x00', 0x19, 0x6, 0x8f8, [0x20000680, 0x0, 0x0, 0x200009c0, 0x20000cb8], 0x0, &(0x7f00000002c0), &(0x7f0000000680)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x3, 0x1, 0x88fb, 'bridge_slave_1\x00', 'team_slave_0\x00', 'ipddp0\x00', 'ip_vti0\x00', @local, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], @random="94b14fee8ccf", [0x0, 0xff, 0x0, 0xff], 0x1c8, 0x238, 0x270, [@vlan={'vlan\x00', 0x8, {{0x2, 0x6, 0x8809, 0x4, 0x1}}}, @comment={'comment\x00', 0x100}]}, [@arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffd}}}, @snat={'snat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 0xffffffffffffffff}}}]}, @arpreply={'arpreply\x00', 0x10, {{@link_local, 0xffffffffffffffff}}}}, {{{0x3, 0x40, 0xf7, 'ip6gre0\x00', 'vlan0\x00', 'syzkaller1\x00', 'teql0\x00', @local, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], 0x70, 0x70, 0xa0}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x8}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x2, [{{{0x3, 0x28, 0x88cf, 'syzkaller0\x00', 'veth1_to_bridge\x00', 'dummy0\x00', 'bcsh0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0xff, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0xff, 0xff], 0xc0, 0x128, 0x160, [@ipvs={'ipvs\x00', 0x28, {{@ipv6=@remote, [0xffffffff, 0xffffff00, 0xff, 0xffffffff], 0x4e22, 0x2c, 0x1, 0x4e20, 0x11, 0x2}}}]}, [@common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}, @arpreply={'arpreply\x00', 0x10, {{@local, 0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffd}}}}, {{{0x15, 0x10, 0x8848, 'veth0_to_bond\x00', 'yam0\x00', 'bcsh0\x00', 'veth0\x00', @dev={[], 0x1b}, [0xff, 0x0, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xe0, 0x130, 0x168, [@stp={'stp\x00', 0x48, {{0xfff, {0x7, 0x9, 0x7, @local, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x1f, 0xfff, 0xf999, 0x3f, @dev={[], 0xc}, [0x0, 0x0, 0x0, 0x0, 0xff], 0x4e20, 0x4e21, 0x3f, 0x800, 0x4, 0x1, 0x6, 0x8, 0x3, 0x2}, 0x8, 0x2}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x2, 'syz0\x00', 0x7}}}]}, @arpreply={'arpreply\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x4, 0xffffffffffffffff, 0x2, [{{{0x9, 0x20, 0x600f, 'vcan0\x00', 'bcsf0\x00', 'veth1_to_bridge\x00', 'bond_slave_0\x00', @local, [0xed55855b4698c572, 0x0, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x138, [@limit={'limit\x00', 0x20, {{0xa2, 0x100000000, 0x1, 0x40000, 0xfffffffffffeffff, 0x1f}}}, @ip={'ip\x00', 0x20, {{@multicast1, @broadcast, 0x0, 0xff000000, 0x20, 0x89, 0x4, 0xa, 0x4e24, 0x4e21, 0x4e23, 0x4e21}}}]}}, @arpreply={'arpreply\x00', 0x10, {{@broadcast, 0xffffffffffffffff}}}}, {{{0x5, 0x2, 0x880b, 'bcsf0\x00', 'syzkaller1\x00', 'bridge_slave_1\x00', 'veth0_to_bond\x00', @link_local, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @random="947c8ab8728d", [0x0, 0xff, 0xff, 0x0, 0xff], 0xb0, 0x120, 0x158, [@owner={'owner\x00', 0x18, {{r3, r4, r5, r6, 0x4, 0x1}}}]}, [@common=@dnat={'dnat\x00', 0x10, {{@local, 0x10}}}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffffffffffc}}}]}, @snat={'snat\x00', 0x10, {{@dev={[], 0x18}, 0xffffffffffffffff}}}}]}]}, 0x970) sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) mount(&(0x7f0000000200)='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='sockfs\x00', 0x60a782820fec975e, 0x0) perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000040)=""/125) [ 401.509907] binder: 27945:27970 ERROR: BC_REGISTER_LOOPER called without request [ 401.519599] binder: BINDER_SET_CONTEXT_MGR already set [ 401.519608] binder: 27972:27977 ioctl 40046207 0 returned -16 [ 401.519704] binder_alloc: 27945: binder_alloc_buf, no vma [ 401.519722] binder: 27972:27977 transaction failed 29189/-3, size 24-8 line 3136 [ 401.519810] binder: 27972:27977 ERROR: BC_REGISTER_LOOPER called without request [ 401.549582] binder: 27945:27949 got transaction to invalid handle [ 401.549607] binder: 27945:27949 transaction failed 29201/-22, size 0-0 line 3013 [ 401.550839] binder: release 27945:27949 transaction 790 in, still active [ 401.550847] binder: send failed reply for transaction 790 to 27945:27949 [ 401.550857] binder: undelivered TRANSACTION_ERROR: 29189 [ 401.550939] binder: undelivered TRANSACTION_COMPLETE [ 401.550945] binder: undelivered TRANSACTION_ERROR: 29189 13:55:24 executing program 4: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RSTATu(r1, &(0x7f0000000340)={0x88, 0x7d, 0x0, {{0x0, 0x71, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, "", 0xf, 'em1+mime_type%,', 0xb, 'vmnet0nodev', 0x24, 'vmnet0^procsystemGPLposix_acl_access'}, 0x2, '%&'}}, 0x88) read(r0, &(0x7f0000000100)=""/134, 0x86) accept(0xffffffffffffffff, &(0x7f00000000c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x80) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f00000001c0)={'broute\x00'}, &(0x7f0000000080)=0x78) 13:55:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:24 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) finit_module(r0, &(0x7f00000001c0)='nodev\\em0@)mime_typekeyringselinuxwlan1vboxnet0^--\x00', 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) r2 = dup2(r1, r1) socket(0x3, 0x0, 0xff) r3 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000200)='logon\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, r3) write$FUSE_NOTIFY_POLL(r2, &(0x7f0000000040)={0x18, 0x1, 0x0, {0xfffffffffffffffb}}, 0x18) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) r4 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000200), 0x0, 0xfffffffffffffff9) keyctl$set_timeout(0xf, r4, 0x3) r5 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f0000000180)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x989680}}, &(0x7f0000040000)) r6 = syz_open_dev$usbmon(&(0x7f00000001c0)='/dev/usbmon#\x00', 0x0, 0x0) read$eventfd(r6, &(0x7f0000000040), 0x8) tkill(r5, 0x1000000000016) 13:55:24 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000040), &(0x7f00000001c0)) r0 = memfd_create(&(0x7f0000000000)='-ppp1\'*mime_type)\x00', 0x2) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000080)) [ 401.578235] binder: 27972:27985 got transaction to invalid handle [ 401.578260] binder: 27972:27985 transaction failed 29201/-22, size 0-0 line 3013 [ 401.767100] binder: undelivered TRANSACTION_ERROR: 29189 13:55:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) r2 = getpid() write$cgroup_pid(r1, &(0x7f0000000180)=r2, 0x12) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x3, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="117b484001"], 0x0, 0x0, &(0x7f0000000480)}) 13:55:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000480)}) [ 401.796462] binder: undelivered TRANSACTION_ERROR: 29201 13:55:24 executing program 3: mprotect(&(0x7f000068a000/0x4000)=nil, 0x4000, 0x0) clone(0x2, &(0x7f0000000080), &(0x7f0000000140), &(0x7f0000000040), &(0x7f0000000080)="f108bbe9eb4b7c5dc4edf710c1307d22f9257e61243a828cd4a6994cba987c73b75159c2a9b472a78959fe96e0e7bace06984e74a22d75ade2d0ee775ce90dcc76fb23fc07d475a38f3cbdcbe55cc9bbd8d88c31f6c1dd") r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x0, 0x0) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000100)={0x15, 0x17, 0x10, 0xb, 0x0, 0xad84, 0x4, 0x54}) [ 401.898890] binder: 28006:28009 ERROR: BC_REGISTER_LOOPER called without request [ 401.921036] binder: 28006:28009 unknown command 1078491921 [ 401.940919] binder: 28006:28009 ioctl c0306201 200001c0 returned -22 [ 401.964604] binder_alloc: binder_alloc_mmap_handler: 28006 20001000-20004000 already mapped failed -16 [ 401.988068] binder: BINDER_SET_CONTEXT_MGR already set [ 401.993476] binder: 28006:28009 ioctl 40046207 0 returned -16 [ 401.999770] binder_alloc: 28006: binder_alloc_buf, no vma [ 401.999793] binder: 28006:28018 transaction failed 29189/-3, size 24-8 line 3136 [ 402.003602] binder: 28006:28022 ERROR: BC_REGISTER_LOOPER called without request [ 402.004516] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.004553] binder: release 28006:28009 transaction 799 in, still active [ 402.004560] binder: send failed reply for transaction 799 to 28006:28009 [ 402.004651] binder: undelivered TRANSACTION_COMPLETE [ 402.004658] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.312523] binder: undelivered TRANSACTION_ERROR: 29189 [ 419.198020] IPVS: stopping backup sync thread 13584 ... [ 572.567923] INFO: task kworker/u4:0:6 blocked for more than 140 seconds. [ 572.574922] Not tainted 4.9.124-g09eb2ba #31 [ 572.579982] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 572.588219] kworker/u4:0 D25528 6 2 0x00000000 [ 572.594122] Workqueue: netns cleanup_net [ 572.598674] ffff8801d9a38000 0000000000000000 ffff8801ba996a00 ffff8801d9a6b000 [ 572.606832] ffff8801db321c18 ffff8801d9a477a0 ffffffff839f0afd ffffffff85599a50 [ 572.615172] ffff8801d9a38000 00000000000011df 00ff8801d9a38980 ffff8801db3224e8 [ 572.623582] Call Trace: [ 572.626310] [] ? __schedule+0x64d/0x1bd0 [ 572.632106] [] schedule+0x7f/0x1b0 [ 572.637492] [] schedule_timeout+0x861/0xf70 [ 572.643545] [] ? __schedule+0x655/0x1bd0 [ 572.649667] [] ? usleep_range+0x140/0x140 [ 572.655551] [] ? mark_held_locks+0xc7/0x130 [ 572.661618] [] ? _raw_spin_unlock_irq+0x27/0x50 [ 572.668491] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 572.675399] [] wait_for_completion+0x203/0x2e0 [ 572.681720] [] ? wait_for_completion_interruptible+0x430/0x430 [ 572.689461] [] ? wake_up_q+0xe0/0xe0 [ 572.694878] [] kthread_stop+0xa6/0x5d0 [ 572.700552] [] stop_sync_thread.cold.10+0x260/0x363 [ 572.707265] [] ip_vs_sync_net_cleanup+0x57/0x80 [ 572.713814] [] ? __ip_vs_cleanup+0xb0/0xb0 [ 572.719794] [] __ip_vs_dev_cleanup+0x6b/0x80 [ 572.725907] [] ops_exit_list.isra.6+0xb0/0x160 [ 572.732251] [] cleanup_net+0x321/0x630 [ 572.737816] [] ? net_drop_ns+0x80/0x80 [ 572.743590] [] ? __lock_is_held+0xa2/0xf0 [ 572.749544] [] process_one_work+0x7e1/0x1500 [ 572.755651] [] ? process_one_work+0x728/0x1500 [ 572.762086] [] ? pwq_dec_nr_in_flight+0x2e0/0x2e0 [ 572.768632] [] worker_thread+0xd6/0x10a0 [ 572.774335] [] kthread+0x26d/0x300 [ 572.779588] [] ? process_one_work+0x1500/0x1500 [ 572.785976] [] ? kthread_park+0xa0/0xa0 [ 572.791655] [] ? __switch_to_asm+0x34/0x70 [ 572.797720] [] ? kthread_park+0xa0/0xa0 [ 572.803738] [] ? kthread_park+0xa0/0xa0 [ 572.809413] [] ret_from_fork+0x5c/0x70 [ 572.815016] [ 572.815016] Showing all locks held in the system: [ 572.821677] 4 locks held by kworker/u4:0/6: [ 572.826051] #0: ("%s""netns"){.+.+.+}, at: [] process_one_work+0x6ee/0x1500 [ 572.835663] #1: (net_cleanup_work){+.+.+.}, at: [] process_one_work+0x728/0x1500 [ 572.845574] #2: (net_mutex){+.+.+.}, at: [] cleanup_net+0x13f/0x630 [ 572.854331] #3: (ipvs->sync_mutex){+.+.+.}, at: [] ip_vs_sync_net_cleanup+0x22/0x80 [ 572.864403] 1 lock held by kworker/dying/24: [ 572.868831] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 572.880424] 2 locks held by khungtaskd/519: [ 572.884726] #0: (rcu_read_lock){......}, at: [] watchdog+0x11c/0xa20 [ 572.893482] #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x79/0x218 [ 572.903190] 2 locks held by rs:main Q:Reg/3664: [ 572.907856] #0: (&f->f_pos_lock){+.+.+.}, at: [] __fdget_pos+0xac/0xd0 [ 572.916884] #1: (sb_writers#3){.+.+.+}, at: [] vfs_write+0x3ae/0x530 [ 572.925842] 1 lock held by rsyslogd/3666: [ 572.930035] #0: (&f->f_pos_lock){+.+.+.}, at: [] __fdget_pos+0xac/0xd0 [ 572.938947] 2 locks held by getty/3762: [ 572.942906] #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 [ 572.952247] #1: (&ldata->atomic_read_lock){+.+...}, at: [] n_tty_read+0x202/0x16e0 [ 572.962224] 1 lock held by syz-executor3/3851: [ 572.966789] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 572.978255] 1 lock held by syz-executor5/3853: [ 572.982814] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 572.994296] 1 lock held by syz-executor1/3856: [ 572.998934] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.010398] 1 lock held by syz-executor2/13564: [ 573.015046] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.026552] 1 lock held by ipvs-b:1:0/13584: [ 573.030970] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.042393] 1 lock held by syz-executor6/15274: [ 573.047038] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.058528] 1 lock held by syz-executor0/18991: [ 573.063290] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.074739] 1 lock held by syz-executor7/21077: [ 573.079438] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.090990] 1 lock held by syz-executor4/26817: [ 573.095643] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.107111] 1 lock held by syz-executor6/27972: [ 573.111805] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.123401] 1 lock held by syz-executor6/27977: [ 573.128079] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.139592] 1 lock held by syz-executor6/27985: [ 573.144238] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.155666] 1 lock held by syz-executor5/27986: [ 573.160344] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.171761] 1 lock held by syz-executor5/27987: [ 573.176404] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.187873] 1 lock held by syz-executor5/27989: [ 573.192524] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.203976] 1 lock held by syz-executor7/27988: [ 573.208651] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.220086] 1 lock held by syz-executor7/27990: [ 573.224733] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.236181] 1 lock held by syz-executor7/27995: [ 573.241004] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.252429] 1 lock held by syz-executor1/27996: [ 573.257084] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.268556] 1 lock held by syz-executor1/28007: [ 573.273267] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.284718] 1 lock held by syz-executor1/28012: [ 573.289409] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.300998] 1 lock held by syz-executor4/28004: [ 573.305647] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.317281] 1 lock held by syz-executor4/28010: [ 573.321974] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.333516] 1 lock held by syz-executor4/28013: [ 573.338263] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.349795] 1 lock held by syz-executor0/28006: [ 573.354450] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.365952] 1 lock held by syz-executor0/28009: [ 573.370646] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.382094] 1 lock held by syz-executor0/28018: [ 573.386747] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.398260] 1 lock held by syz-executor0/28022: [ 573.402912] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.414421] 1 lock held by syz-executor2/28011: [ 573.419126] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.430587] 1 lock held by syz-executor2/28016: [ 573.435446] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.446933] 1 lock held by syz-executor3/28014: [ 573.451641] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.463178] 1 lock held by syz-executor3/28017: [ 573.467867] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.479347] 1 lock held by syz-executor3/28020: [ 573.484011] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.495487] 1 lock held by blkid/28015: [ 573.499490] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.511062] 1 lock held by syz-executor3/28019: [ 573.515714] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.527309] 1 lock held by syz-executor3/28021: [ 573.532015] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.543496] 1 lock held by getty/28023: [ 573.547449] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.558942] 1 lock held by getty/28024: [ 573.563045] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.574497] 1 lock held by getty/28025: [ 573.578473] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.590187] 1 lock held by getty/28026: [ 573.594279] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.605731] 1 lock held by getty/28027: [ 573.609725] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.621508] 1 lock held by getty/28028: [ 573.625458] #0: ((task_exit_notifier).rwsem){.+.+..}, at: [] blocking_notifier_call_chain+0x68/0xa0 [ 573.636972] [ 573.638630] ============================================= [ 573.638630] [ 573.645718] NMI backtrace for cpu 1 [ 573.649432] CPU: 1 PID: 519 Comm: khungtaskd Not tainted 4.9.124-g09eb2ba #31 [ 573.656682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 573.666013] ffff8801d8507d08 ffffffff81eb95e9 0000000000000000 0000000000000001 [ 573.673993] 0000000000000001 0000000000000001 ffffffff810b9fa0 ffff8801d8507d40 [ 573.681979] ffffffff81ec4927 0000000000000001 0000000000000000 0000000000000003 [ 573.689968] Call Trace: [ 573.692534] [] dump_stack+0xc1/0x128 [ 573.697876] [] ? irq_force_complete_move+0x320/0x320 [ 573.704604] [] nmi_cpu_backtrace.cold.2+0x48/0x87 [ 573.711121] [] ? irq_force_complete_move+0x320/0x320 [ 573.717927] [] nmi_trigger_cpumask_backtrace+0x12a/0x14f [ 573.725011] [] arch_trigger_cpumask_backtrace+0x14/0x20 [ 573.732094] [] watchdog+0x6b4/0xa20 [ 573.737424] [] ? watchdog+0x11c/0xa20 [ 573.742855] [] kthread+0x26d/0x300 [ 573.748019] [] ? reset_hung_task_detector+0x20/0x20 [ 573.754659] [] ? kthread_park+0xa0/0xa0 [ 573.760256] [] ? __switch_to_asm+0x34/0x70 [ 573.766115] [] ? kthread_park+0xa0/0xa0 [ 573.771712] [] ? kthread_park+0xa0/0xa0 [ 573.777308] [] ret_from_fork+0x5c/0x70 [ 573.783041] Sending NMI from CPU 1 to CPUs 0: [ 573.787587] NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff83a00606 [ 573.794973] Kernel panic - not syncing: hung_task: blocked tasks [ 573.801177] CPU: 0 PID: 519 Comm: khungtaskd Not tainted 4.9.124-g09eb2ba #31 [ 573.808428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 573.817768] ffff8801d8507cc8 ffffffff81eb95e9 ffffffff83c8c0a0 00000000ffffffff [ 573.825776] 0000000000000000 0000000000000000 dffffc0000000000 ffff8801d8507d88 [ 573.833780] ffffffff81423eb5 0000000041b58ab3 ffffffff843bb8e8 ffffffff81423cf6 [ 573.841778] Call Trace: [ 573.844421] [] dump_stack+0xc1/0x128 [ 573.849767] [] panic+0x1bf/0x3bc [ 573.854838] [] ? add_taint.cold.6+0x16/0x16 [ 573.860792] [] ? ___preempt_schedule+0x16/0x18 [ 573.866998] [] ? nmi_trigger_cpumask_backtrace+0x100/0x14f [ 573.874337] [] watchdog+0x6c5/0xa20 [ 573.879600] [] ? watchdog+0x11c/0xa20 [ 573.885133] [] kthread+0x26d/0x300 [ 573.890301] [] ? reset_hung_task_detector+0x20/0x20 [ 573.896938] [] ? kthread_park+0xa0/0xa0 [ 573.902557] [] ? __switch_to_asm+0x34/0x70 [ 573.908474] [] ? kthread_park+0xa0/0xa0 [ 573.914126] [] ? kthread_park+0xa0/0xa0 [ 573.919737] [] ret_from_fork+0x5c/0x70 [ 573.925688] Dumping ftrace buffer: [ 573.929349] (ftrace buffer empty) [ 573.933048] Kernel Offset: disabled [ 573.936658] Rebooting in 86400 seconds..