ET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000140)={@in6={{0xa, 0x4e24, 0x1, @empty, 0x80000001}}, 0x0, 0x9b, 0x0, "9e42361dc8bd87e5f0fff8a9dd459b94d27befc2615a6fb89b17aeff4a6dab2b5ab8fd9fdd6e25ed383e9f441db4ec12df141f749f09b424c03324d8d3f63409e59ac91bf96f47f317f3b46948ce2bee"}, 0xd8) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00[\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$RTC_UIE_ON(r3, 0x7003) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$TIOCGPTPEER(r4, 0x5441, 0xfffffffffffffff8) 22:57:45 executing program 1: pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r0, 0x0, r1, 0x0, 0x1003, 0x0) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) r2 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000600)) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f00000001c0)={0x9, &(0x7f0000000140)=[{0x81, 0x6, 0x1, 0x80000000}, {0x8, 0x4, 0x7f, 0x7}, {0x23ca, 0x0, 0x20, 0x101}, {0x2, 0x5, 0x2, 0x8}, {0x3, 0x0, 0x4, 0x6}, {0x6, 0x40, 0x4b, 0x205}, {0x0, 0x4f, 0x1f, 0x8001}, {0xfff, 0x9, 0x9b, 0x6b}, {0xfc, 0x1, 0x9, 0x1ff}]}, 0x10) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009d33a5f3741af69a884a5f8094b2ebcc76a8afeb49e38a1086dee18090aba5f7b4e5b3f0bf07389aa1271ddbbcad6d05edee9afd304d17cb28080d72dd45a12f4b9239f9b35f165332da9ae48bba"], 0x0, 0x0, 0x0}) 22:57:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000001800000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 771.068781] binder_alloc: 4229: binder_alloc_buf, no vma [ 771.068820] binder: 4234:4235 transaction failed 29189/-3, size 2465066254-0 line 3137 [ 771.075349] binder: undelivered TRANSACTION_ERROR: 29189 [ 771.103106] binder: 4208:4227 transaction failed 29189/-3, size 120-24 line 3137 [ 771.103197] binder: undelivered TRANSACTION_ERROR: 29189 [ 771.141059] binder: 4241:4243 got transaction with invalid offset (1526726696, min 40 max 120) or object. [ 771.153877] binder: 4244:4246 got transaction with invalid data ptr [ 771.160764] binder: 4241:4243 transaction failed 29201/-22, size 120-24 line 3199 [ 771.168885] binder: 4244:4246 transaction failed 29201/-14, size 3786-0 line 3155 [ 771.178559] binder: undelivered TRANSACTION_ERROR: 29201 [ 771.185577] binder: undelivered TRANSACTION_ERROR: 29201 [ 771.194770] binder: BINDER_SET_CONTEXT_MGR already set [ 771.201186] binder: 4241:4249 ioctl 40046207 0 returned -16 [ 771.225723] binder: 4241:4249 transaction failed 29189/-22, size 120-24 line 3014 [ 771.244244] binder: undelivered TRANSACTION_ERROR: 29189 22:57:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) [ 771.267287] binder: undelivered TRANSACTION_ERROR: 29201 22:57:45 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0xac, 0x0, &(0x7f0000000480)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x28, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000140)={@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/111, 0x6f, 0x2, 0x30}, @fda={0x66646185, 0xa, 0x1, 0x24}}, &(0x7f0000000200)={0x0, 0x18, 0x40}}, 0x1000}, @release, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000340)={@flat=@weak_handle={0x77682a85, 0x102, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/208, 0xd0, 0x2}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000003c0)={0x0, 0x18, 0x40}}}, @dead_binder_done, @increfs={0x40046304, 0x1}], 0xe9, 0x0, &(0x7f0000000600)="41640f6515da12494e0d97b66d84330bcc914706f92cb9d2763e8102766745777cb25d12e430b6c40481e0116bc64331f9a5e70ae9c52286daecc1e756cbd1cbd967f5e32764718a4c10b7c397809536145ab2fbe7d3fd389877ba8236d657ccd43f9f142169ac2c15934e494104487c9fd0972baeb92badcc042fa46f17c3b4ceba320ba4562c2403d9fcc5ee8edb246eaba32f601ab082870d85be2ee09d90b7f32041530d1eeee44d8742eb3e341ec25f2a9ec57626b7f719dcb468534d417cc0de4fd0045404cbc8625396c913504643f3fc10dc9ec02815c3ba1421fdd51ae74d45b91af11861"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0xfffffffffffffffd) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) r4 = fcntl$dupfd(r3, 0x605, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = creat(&(0x7f0000000080)='./bus\x00', 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r6, 0x0, r7, 0x0, 0x1003, 0x0) fsync(r0) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r6, &(0x7f0000000280)={&(0x7f0000000140), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r8, 0x1, 0x70bd29, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20044800}, 0x8000) ioctl$FS_IOC_FIEMAP(r5, 0xc020660b, &(0x7f0000000740)={0x0, 0x8, 0x0, 0x0, 0x492492492492672}) write$P9_RREADLINK(r5, &(0x7f0000000000)={0xffffffffffffff14, 0x17, 0x2, {0x5, './bus'}}, 0xe) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r9, 0xffffffffffffffff, 0x0, 0x0) r10 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r10, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r11 = dup3(r9, r10, 0x0) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000000200)={0x3e78dbfce968a54c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="116348400000010000000000000000000000000000081c2a000000000000ea000000debb09529942c5c10000000000"], 0x109, 0x0, 0x0}) r12 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r12, 0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r14, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r13, 0x0, r14, 0x0, 0x1003, 0x0) r15 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r15, &(0x7f00000005c0), 0x0) r16 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r15, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x11004000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r16, @ANYBLOB="640025bd7000ffdbdf2501000000000000000141000000180017000000010000c33069623a6e6c6d6f6e30000000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8000) sendmsg$TIPC_CMD_GET_LINKS(r13, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r16, 0x800, 0x70bd28, 0x25dfdbfd, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x4}}, [""]}, 0x24}}, 0x10000000) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000100)={0x0, r12, 0x2, 0x7f, 0x4, 0xffffffffffff8000}) 22:57:45 executing program 3: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000080)={0x0, 0xff, 0x4}) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x2) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000100)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010006081000418e00000904fcff", 0x58}], 0x1) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x11004000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r5, 0x0, 0x70bd25, 0x25dfdbff, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x1, 0xc330, @l2={'ib', 0x3a, 'nlmon0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8000) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10040000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r5, 0x8, 0x70bd26, 0x25dfdbfd, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x4}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4080}, 0x8000) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$HDIO_GETGEO(r2, 0x301, &(0x7f0000000000)) r7 = fcntl$dupfd(r6, 0x0, r6) pwrite64(r2, &(0x7f0000000100)="350abcaa6e78fcd12474cec5df95f2fa5aa05c4061f4d9e46275be619f2462cfcbdf10ab5419c98315e3dd0835bc407761f16c476d7fc0e88bba4a510d78b4f7c04b14327695f3cb133e80de221726eba18517cceeff908999f11146f6650078e83d951c5587b26bd85739dda4f4316ee3bed904ba79cb192c467e0927a4e1a05c56634bb1817cee91b90520daef7a7fc7b6e65140f16035c5f7829576ddda8af864782c4267e64dc9229002499513bc0119843a096d4d3d6ee567e41813dc5b01ccf1c935a66abba7736b2bddb5d7f2cd917b80cb1dff9c8cef3ebe584024d4651e827b656529374ac1", 0xea, 0xff) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163484000000000000800111ab87abc56b6570545d70711c79400000000010000000000000000000100ba77605cfb9e422db7f70069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$KDSETLED(r1, 0x4b32, 0x7) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000001000"/64], 0x0, 0x0, 0x0}) setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000000), 0x4) 22:57:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) getsockname(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f0000000140)=0x80) connect$unix(r3, &(0x7f0000000200)=@file={0x0, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0, 0x156}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:45 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000002fb600000000000000000000000000000000000000000000000010000000000000002b00000000000000081900"/78], 0x0, 0x0, 0x0}) [ 771.590545] binder: 4264:4268 got transaction with invalid data ptr [ 771.607529] binder: 4264:4268 transaction failed 29201/-14, size 4096-0 line 3155 [ 771.607621] binder: 4273:4274 got transaction with too large buffer [ 771.607675] binder: 4273:4274 transaction failed 29201/-22, size 120-24 line 3295 [ 771.617468] binder: undelivered TRANSACTION_ERROR: 29201 22:57:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80040, 0x0) r5 = accept4$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000100)=0x1a, 0x800) dup3(r4, r5, 0x180000) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000f1fcffff0000000000000057ca0e0000000000000000"], 0x0, 0x0, 0x0}) [ 771.641944] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket [ 771.655740] binder: 4265:4270 ioctl 301 20000000 returned -22 [ 771.662419] binder: 4265:4270 transaction failed 29201/-22, size 8627208040476573696--596958661444936608 line 3137 [ 771.674799] binder: undelivered TRANSACTION_ERROR: 29201 [ 771.675154] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=65535 sclass=netlink_tcpdiag_socket 22:57:45 executing program 2: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000080)={0x0, 0xff, 0x4}) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x2) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000100)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010006081000418e00000904fcff", 0x58}], 0x1) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x11004000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r5, 0x0, 0x70bd25, 0x25dfdbff, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x1, 0xc330, @l2={'ib', 0x3a, 'nlmon0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8000) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10040000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r5, 0x8, 0x70bd26, 0x25dfdbfd, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x4}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4080}, 0x8000) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$HDIO_GETGEO(r2, 0x301, &(0x7f0000000000)) r7 = fcntl$dupfd(r6, 0x0, r6) pwrite64(r2, &(0x7f0000000100)="350abcaa6e78fcd12474cec5df95f2fa5aa05c4061f4d9e46275be619f2462cfcbdf10ab5419c98315e3dd0835bc407761f16c476d7fc0e88bba4a510d78b4f7c04b14327695f3cb133e80de221726eba18517cceeff908999f11146f6650078e83d951c5587b26bd85739dda4f4316ee3bed904ba79cb192c467e0927a4e1a05c56634bb1817cee91b90520daef7a7fc7b6e65140f16035c5f7829576ddda8af864782c4267e64dc9229002499513bc0119843a096d4d3d6ee567e41813dc5b01ccf1c935a66abba7736b2bddb5d7f2cd917b80cb1dff9c8cef3ebe584024d4651e827b656529374ac1", 0xea, 0xff) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163484000000000000800111ab87abc56b6570545d70711c79400000000010000000000000000000100ba77605cfb9e422db7f70069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 771.681794] binder: BINDER_SET_CONTEXT_MGR already set [ 771.681803] binder: 4262:4285 ioctl 40046207 0 returned -16 [ 771.702568] binder: BINDER_SET_CONTEXT_MGR already set [ 771.705560] binder_alloc: 4283: binder_alloc_buf size 989855744 failed, no address space [ 771.705570] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) [ 771.706631] binder: 4283:4284 transaction failed 29201/-28, size 268435456-721420288 line 3137 [ 771.731799] binder: undelivered TRANSACTION_ERROR: 29201 [ 771.732198] binder: undelivered TRANSACTION_ERROR: 29201 [ 771.773433] binder_alloc: 4288: binder_alloc_buf size 7093839425345910320 failed, no address space [ 771.782693] binder: 4264:4279 ioctl 40046207 0 returned -16 [ 771.788723] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 771.788938] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=65535 sclass=netlink_tcpdiag_socket [ 771.799931] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket 22:57:45 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) ioctl$TIOCNOTTY(r3, 0x5422) [ 771.800659] binder: 4298:4301 ioctl 301 20000000 returned -22 [ 771.801099] binder: 4298:4301 transaction failed 29201/-22, size 8627208040476573696--596958661444936608 line 3137 [ 771.801489] binder: undelivered TRANSACTION_ERROR: 29201 [ 771.846475] binder: 4305:4306 got transaction with invalid data ptr [ 771.863793] binder: 4288:4300 transaction failed 29201/-28, size 0-0 line 3137 [ 771.865089] binder: 4305:4306 transaction failed 29201/-14, size 3786-0 line 3155 [ 771.870543] binder: undelivered TRANSACTION_ERROR: 29201 [ 771.900136] binder: undelivered TRANSACTION_ERROR: 29201 22:57:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0xa1fead79580681cb) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$TUNGETDEVNETNS(r2, 0x54e3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0}, 0x1000}], 0x32f, 0x0, 0x0}) 22:57:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) getsockopt$netlink(r1, 0x10e, 0x9, &(0x7f0000000180)=""/84, &(0x7f0000000100)=0x54) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x28, r3, 0x100, 0x70bd26, 0x25dfdbfc, {{}, 0x0, 0xb, 0x0, {0xc, 0x14, 'syz1\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x4008000) r4 = syz_open_dev$binderN(0x0, 0x0, 0x400) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/user\x00', 0x2, 0x0) r7 = fcntl$dupfd(r5, 0x0, r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x6) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x2d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000010000000080000000000000000ea"], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r7, 0xc018620b, &(0x7f0000000000)={0x3}) 22:57:45 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = getgid() setgid(r3) r4 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="12e71963484000000000000000000000000069d5aba057ca0e00"/40], 0x0, 0x0, 0x0}) r5 = getpid() capset(&(0x7f0000000000)={0x0, r5}, &(0x7f0000000080)={0x601b0ba4, 0x6, 0x3, 0x4, 0x7, 0x400}) [ 771.955283] binder: undelivered TRANSACTION_COMPLETE [ 771.960567] binder: BINDER_SET_CONTEXT_MGR already set [ 771.966320] binder: 4242:4252 ioctl 40046207 0 returned -16 [ 771.966352] binder: undelivered transaction 2923, process died. 22:57:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x10000, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x10012) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000013d836c684d592c12cccbb8bc0c20db6ae54e15ac95f1e2924e366f06e10"], 0x0, 0x0, 0x0}) [ 772.009012] binder: undelivered TRANSACTION_COMPLETE [ 772.014474] binder: undelivered transaction 2948, process died. [ 772.024230] binder: 4315:4320 unknown command 1662641938 [ 772.029721] binder: 4315:4320 ioctl c0306201 20000200 returned -22 [ 772.040959] binder: undelivered TRANSACTION_COMPLETE [ 772.044607] binder: BINDER_SET_CONTEXT_MGR already set [ 772.044615] binder: 4327:4328 ioctl 40046207 0 returned -16 [ 772.045296] binder_alloc: 4318: binder_alloc_buf, no vma [ 772.045334] binder: 4327:4328 transaction failed 29189/-3, size 0-0 line 3137 [ 772.046600] binder: BINDER_SET_CONTEXT_MGR already set [ 772.046607] binder: 4327:4328 ioctl 40046207 0 returned -16 [ 772.058802] binder: 4314:4330 got transaction with too large buffer [ 772.058866] binder: 4314:4330 transaction failed 29201/-22, size 120-24 line 3295 [ 772.114072] binder: undelivered TRANSACTION_ERROR: 29189 [ 772.120059] binder: undelivered transaction 2950, process died. 22:57:46 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x14, &(0x7f0000000000), 0x10) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x804) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000001000"/63], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) r3 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x80000) ioctl$RTC_VL_CLR(r3, 0x7014) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) ioctl$UI_END_FF_UPLOAD(r2, 0x406855c9, &(0x7f0000000000)={0x2, 0x8, {0x54, 0x401, 0x9, {0x7ff, 0x8}, {0x0, 0x1}, @rumble={0xfff8, 0x200}}, {0x57, 0x3f, 0x20, {0x4, 0x1f}, {0x9c2a, 0x6}, @cond=[{0xfffb, 0x18a4, 0x5, 0x5, 0x2, 0x9a8}, {0x7717, 0x1ff, 0x1, 0x200, 0x1000, 0x87}]}}) 22:57:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) fallocate(r0, 0x41, 0x8, 0x1) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000ea71000000000000000000000c0000000000000000000000955292fa9d5ec663220c22a84c763eed0a7c9511dd36a0e8b2108216c8a036a1d39ee155b4246354d5328d5b6024f8a1bf5c20b7aacce670"], 0x0, 0x0, 0x0}) 22:57:46 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000100)={0x1, 'veth1\x00', {}, 0x4b}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet(0x2, 0x5, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000280)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x2000000, 0xffffffff, 0x3f, 0x7ff, 0x2, 0x4}) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r5, 0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, 0x0, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r7, 0x0, r8, 0x0, 0x1003, 0x0) r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000180)='nbd\x00') pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r10, 0x0, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) sendmsg$NBD_CMD_RECONFIGURE(r8, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)={0x44, r9, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x24, 0x7, [{0x8, 0x1, r10}, {0x8}, {0x8, 0x1, r4}, {0x8, 0x1, r0}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008060}, 0x4000080) r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r11, 0xffffffffffffffff, 0x0, 0x0) fcntl$notify(r11, 0x402, 0x4) [ 772.428638] binder: BINDER_SET_CONTEXT_MGR already set [ 772.434002] binder: 4263:4336 ioctl 40046207 0 returned -16 [ 772.440087] binder: 4263:4336 transaction failed 29189/-22, size 120-24 line 3014 [ 772.448097] binder: undelivered TRANSACTION_ERROR: 29189 [ 772.465861] binder: 4338:4339 got transaction with invalid data ptr 22:57:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000000)) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x402) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 772.473197] binder: 4338:4339 transaction failed 29201/-14, size 4096-0 line 3155 [ 772.484364] binder: undelivered TRANSACTION_COMPLETE [ 772.490445] binder: BINDER_SET_CONTEXT_MGR already set [ 772.496373] binder: 4340:4346 ioctl 40046207 0 returned -16 [ 772.496408] binder: undelivered transaction 2959, process died. [ 772.516876] binder: 4344:4347 got transaction with too large buffer 22:57:46 executing program 1: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/mls\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000340)=0x8) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r2 = dup(0xffffffffffffffff) getsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000080)=0x8) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) accept4$unix(r4, &(0x7f0000000140), &(0x7f00000001c0)=0x6e, 0x1000) ioctl$PPPIOCGNPMODE(r3, 0xc008744c, &(0x7f0000000100)={0x0, 0x3}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BLKFRASET(r1, 0x1264, &(0x7f0000000000)=0x3f) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000033ee562358b9b2ed57ce7d9bf9fcc95b495d04a8a4804f2b698667b86a0a56dc3d145630fe70c76f4f468b2f15e5e075ea5abcc80e7fdf447c0c19a1f0e45ff544a551b340a92ece7e25d4e43b9e3a859e758acc88cbe6bb4c828e68a4ff88915ccb240b0df0f8be635c1dca8271a67b8f72143af57c9a709add3a3622804e5a8bc57a6040bdc4704dda401a8cd4bd80c00582621098d4c3747a0030e2258a08a9955071402fd3633da78430d68692f7bf99b7f8509224201084fb7b6357065bdecd72b16601f46149dffa2d1efcd6c1915710d5facaae41b37bac3d1964bcd7e297228dcf9338483fb24616db062c09e000"/327], 0x0, 0x0, 0x0}) [ 772.523900] binder: 4344:4347 transaction failed 29201/-22, size 120-24 line 3295 [ 772.533564] capability: warning: `syz-executor.3' uses deprecated v2 capabilities in a way that may be insecure [ 772.534220] binder: undelivered TRANSACTION_COMPLETE [ 772.534923] binder: undelivered transaction 2963, process died. [ 772.561427] binder: undelivered TRANSACTION_ERROR: 29201 [ 772.567678] binder: BINDER_SET_CONTEXT_MGR already set 22:57:46 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f0000000200)=""/220) 22:57:46 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 772.578669] binder: 4344:4354 ioctl 40046207 0 returned -16 [ 772.625014] binder: 4356:4361 ioctl 1264 20000000 returned -22 [ 772.630413] binder: 4362:4364 got transaction with invalid data ptr [ 772.630471] binder: 4362:4364 transaction failed 29201/-14, size 3786-0 line 3155 [ 772.645095] binder: undelivered TRANSACTION_ERROR: 29201 [ 772.655977] binder: 4363:4365 got transaction with too large buffer [ 772.662622] binder: 4363:4365 transaction failed 29201/-22, size 120-24 line 3295 [ 772.671228] binder: undelivered TRANSACTION_ERROR: 29201 [ 772.679073] binder: 4363:4368 got transaction with too large buffer [ 772.685621] binder: 4363:4368 transaction failed 29201/-22, size 120-24 line 3295 [ 772.694148] binder: undelivered TRANSACTION_ERROR: 29201 [ 772.801053] binder: undelivered TRANSACTION_ERROR: 29201 [ 772.810448] binder: BINDER_SET_CONTEXT_MGR already set [ 772.817740] binder: 4313:4332 ioctl 40046207 0 returned -16 22:57:46 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x650082, 0x0) r5 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r5, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000080)=0x0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r8) write$FUSE_CREATE_OPEN(r4, &(0x7f0000000240)={0xa0, 0xfffffffffffffffe, 0x8, {{0x3, 0x1, 0x80000001, 0x1, 0x80000001, 0x0, {0x1, 0xffffffffffffffff, 0x4, 0x0, 0x8a, 0x1, 0x2dc97785, 0x8, 0xffffff20, 0x8d0a, 0x4, r6, r8, 0x3, 0x20}}, {0x0, 0x4}}}, 0xa0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000010000000080000000000000000ea"], 0x0, 0x0, 0x0}) 22:57:46 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) dup(r1) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x2000, 0x4052ad772c506149) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r4 = fcntl$dupfd(0xffffffffffffffff, 0x406, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:46 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:46 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x10000, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x10012) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000013d836c684d592c12cccbb8bc0c20db6ae54e15ac95f1e2924e366f06e10"], 0x0, 0x0, 0x0}) 22:57:46 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) getsockopt$netlink(r1, 0x10e, 0x9, &(0x7f0000000180)=""/84, &(0x7f0000000100)=0x54) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x28, r3, 0x100, 0x70bd26, 0x25dfdbfc, {{}, 0x0, 0xb, 0x0, {0xc, 0x14, 'syz1\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x4008000) r4 = syz_open_dev$binderN(0x0, 0x0, 0x400) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/user\x00', 0x2, 0x0) r7 = fcntl$dupfd(r5, 0x0, r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x6) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x2d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000010000000080000000000000000ea"], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r7, 0xc018620b, &(0x7f0000000000)={0x3}) [ 772.903917] binder: 4374:4376 got transaction with too large buffer [ 772.908004] binder_alloc: 4375: binder_alloc_buf, no vma [ 772.908043] binder: 4375:4378 transaction failed 29189/-3, size 0-0 line 3137 [ 772.908702] binder: undelivered TRANSACTION_ERROR: 29189 [ 772.925137] binder_alloc: 4373: binder_alloc_buf size 3175488 failed, no address space [ 772.925144] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 772.925182] binder: 4373:4380 transaction failed 29201/-28, size 3786-0 line 3137 [ 772.925531] binder: undelivered TRANSACTION_ERROR: 29201 [ 772.965356] binder: 4374:4376 transaction failed 29201/-22, size 120-24 line 3295 [ 772.984888] binder: 4379:4384 got transaction with invalid offsets ptr [ 772.994791] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.001730] binder: 4379:4384 transaction failed 29201/-14, size 0-234 line 3164 [ 773.011773] binder: 4374:4387 got transaction with too large buffer [ 773.018526] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.025990] binder: 4374:4387 transaction failed 29201/-22, size 120-24 line 3295 [ 773.034105] binder: undelivered TRANSACTION_ERROR: 29201 22:57:47 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) io_cancel(0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x6, 0xc2, r1, &(0x7f0000000000)="78160fd5bca0c6c1af8b9b92d7543a69d324630e69f9db2fe4", 0x19, 0xfffffffffffffffa, 0x0, 0x0, r2}, &(0x7f0000000080)) 22:57:47 executing program 3: mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r3, 0x0, r4, 0x0, 0x1003, 0x0) setsockopt$inet_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f0000000040)=@gcm_128={{0x304}, "c0f2e78cfe82fb69", "23d38c32e49ba33be27a790f48db11d3", "8a113f19", "e5cbb332416cac91"}, 0x28) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000cf5b012fa4e74b98467c000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:47 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000040)='system_u:object_r:auditd_initrc_exec_t:s0\x00', 0x2a, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2d, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000010000000080000000000000000ea09ccba2c576689cde17e27b2"], 0x0, 0x0, 0x0}) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x501042, 0x0) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x10000, 0x0) getsockopt$IP6T_SO_GET_INFO(r5, 0x29, 0x40, &(0x7f0000000240)={'security\x00'}, &(0x7f00000001c0)=0x54) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r4, 0xc018620c, &(0x7f0000000140)) 22:57:47 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x1000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000007854491088440eb4c0091788f3cca85e000000000000001800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/27], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 773.262753] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.292403] binder: BINDER_SET_CONTEXT_MGR already set [ 773.297804] binder: 4338:4351 ioctl 40046207 0 returned -16 [ 773.349109] binder_alloc: 4395: binder_alloc_buf size -5991831972568798176 failed, no address space [ 773.358941] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 773.368548] binder: 4397:4400 transaction failed 29201/-22, size -5472361146029091720-6820926981984946624 line 3137 [ 773.382535] binder: 4395:4398 transaction failed 29201/-28, size 0--8546047393264825878 line 3137 22:57:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000000140)=[@exit_looper], 0x0, 0x0, 0x0}) 22:57:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x152, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000800000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:47 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) ioctl$EVIOCGUNIQ(r5, 0x80404508, &(0x7f0000000240)=""/185) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r3, 0x0, r4, 0x0, 0x1003, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@weak_handle={0x77682a85, 0xea0703f1f876e8f0, 0x2}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r6 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/loop-control\x00', 0x40, 0x0) r7 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r6, 0x4c81, r7) [ 773.394734] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.398634] binder: 4401:4403 got transaction with invalid data ptr [ 773.398691] binder: 4401:4403 transaction failed 29201/-14, size 4096-0 line 3155 [ 773.400040] binder: BINDER_SET_CONTEXT_MGR already set [ 773.400048] binder: 4401:4405 ioctl 40046207 0 returned -16 [ 773.400765] binder_alloc: 4401: binder_alloc_buf, no vma [ 773.400804] binder: 4401:4405 transaction failed 29189/-3, size 4096-0 line 3137 [ 773.428707] binder: BINDER_SET_CONTEXT_MGR already set [ 773.428716] binder: 4356:4357 ioctl 40046207 0 returned -16 [ 773.429157] binder: 4356:4357 ioctl 1264 20000000 returned -22 [ 773.460718] binder: BINDER_SET_CONTEXT_MGR already set [ 773.477224] binder: 4408:4414 got transaction with invalid data ptr [ 773.483699] binder: 4397:4406 ioctl 40046207 0 returned -16 [ 773.486769] binder: undelivered TRANSACTION_ERROR: 29189 22:57:47 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x283, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000010000000080000000000000000ea"], 0x0, 0x0, 0x0}) 22:57:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000770500000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 773.486901] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.489643] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.506532] binder: 4397:4416 transaction failed 29189/-22, size -5472361146029091720-6820926981984946624 line 3014 [ 773.527164] binder: 4418:4420 got transaction with invalid offsets ptr [ 773.529960] binder: undelivered TRANSACTION_ERROR: 29189 [ 773.533598] binder: 4408:4414 transaction failed 29201/-14, size 3786-0 line 3155 22:57:47 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r1, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) fsetxattr$security_capability(r1, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000040)=@v1={0x1000000, [{0x3, 0xd1d}]}, 0xc, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a74700000000000000000009ace0a000000000000000000000000000000000000000000000000000000852a747051665b34df320f4c00000000000000000000000000000000000000000000000000000000852a747000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 22:57:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)={0x70000000}) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES16=r5, @ANYBLOB="00022cbd7000ffdbdf25090000004c00010008000900070000000c0007000d00000008000000080008000000000014000300ac1414160000000000000000000000000800020014000000080001001e00000008000200000000001800010008000500030000000c0007000600000000000000"], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x88) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000100000600000000000000004c5f6924b5670000000000000000000000000000000000000000000000200000000000001a000000000000000000"], 0x0, 0x0, 0x0}) [ 773.534967] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.583031] binder: 4423:4427 got transaction to invalid handle [ 773.616132] binder: 4423:4427 transaction failed 29201/-22, size 3786-0 line 3014 [ 773.622455] binder: 4418:4420 transaction failed 29201/-14, size 0-234 line 3164 [ 773.631867] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.637440] binder: 4409:4415 got transaction with fd, 5, but target does not allow fds [ 773.637531] binder: 4409:4415 transaction failed 29201/-1, size 72-24 line 3241 [ 773.645877] binder: 4430:4433 transaction failed 29201/-28, size 114027697626956-0 line 3137 [ 773.647630] binder: BINDER_SET_CONTEXT_MGR already set [ 773.647638] binder: 4430:4435 ioctl 40046207 0 returned -16 22:57:47 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x650082, 0x0) r5 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r5, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000080)=0x0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r8) write$FUSE_CREATE_OPEN(r4, &(0x7f0000000240)={0xa0, 0xfffffffffffffffe, 0x8, {{0x3, 0x1, 0x80000001, 0x1, 0x80000001, 0x0, {0x1, 0xffffffffffffffff, 0x4, 0x0, 0x8a, 0x1, 0x2dc97785, 0x8, 0xffffff20, 0x8d0a, 0x4, r6, r8, 0x3, 0x20}}, {0x0, 0x4}}}, 0xa0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000010000000080000000000000000ea"], 0x0, 0x0, 0x0}) 22:57:47 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x2000, 0x0) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x200, 0x8]) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x2d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000010000000080000000000000000ea"], 0x0, 0x0, 0x0}) 22:57:47 executing program 1: link(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='./file0\x00') r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x100) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0}, &(0x7f0000000300)=0xc) readv(0xffffffffffffffff, 0x0, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) pipe(&(0x7f0000000000)) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000011c0)='tasks\x00', 0x2, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340)="4e0e25b561211d9ea321054aef46997621e931832c4a843b36b24460f63ea76cfa85ec5244809b9d1f88a1a1cf9cd4cdf660ff949a2df49e20430d8f35c65f4cc2bb107941757f52ba0842604a00", 0x4e) read(r5, &(0x7f0000000200)=""/250, 0x50c7e5e2) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r7, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r7, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') ptrace(0x537cb90df83a7d4c, 0x0) getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000440)={0x78, 0xffffffffffffffda, 0x8, {0x2, 0x10001, 0x0, {0x2, 0x8, 0x7fff, 0x10000, 0x746, 0x254, 0xfff, 0x6, 0x3, 0xeeb, 0x1, r4, r8, 0x2, 0xaf0c47d7}}}, 0x78) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x5e, 0x0, &(0x7f0000000240)="b98a8609356293104d91edf85f614c83a12e657ada3b5946aea015fab43d9dff151d2faa85f7f02c31aa1a77403ec87a1b4aad5fc7ad4d74d2f94ed0006eeb4d6345812b57d7e795821a8e5d93a2b7459f61915c0756cd214c6f72678907"}) r9 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000007f700"/64], 0x0, 0x0, 0x0}) 22:57:47 executing program 4: pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x18, 0x0, 0x1, 0x1, 0x25dfdbff, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x604c890}, 0x40) r1 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/user\x00', 0x2, 0x0) fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000140)='y\x00', 0x2, 0x1) r2 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = creat(&(0x7f0000000200)='./bus\x00', 0x8e) ioctl$BLKSECTGET(r3, 0x1267, &(0x7f0000000240)) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) fcntl$F_SET_RW_HINT(r4, 0x40c, &(0x7f0000000180)=0x2) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000005000000000000000000000000000000000069d5aba017ca0e00000000000000"], 0x0, 0x0, 0x0}) [ 773.687796] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.717606] binder: undelivered TRANSACTION_ERROR: 29201 22:57:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000e795000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 773.754804] binder: 4443:4445 got transaction with invalid offsets ptr [ 773.765986] binder: 4446:4450 got transaction with too large buffer [ 773.773404] binder: 4443:4445 transaction failed 29201/-14, size 0-234 line 3164 [ 773.776728] binder: 4442:4451 got transaction to invalid handle [ 773.776736] binder: 4442:4451 transaction failed 29201/-22, size 0-0 line 3014 [ 773.776955] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.810113] binder: 4449:4452 got transaction with invalid offsets ptr [ 773.822792] binder: 4446:4450 transaction failed 29201/-22, size 120-24 line 3295 [ 773.835037] binder: 4449:4452 transaction failed 29201/-14, size 0-234 line 3164 [ 773.840520] binder: 4455:4456 got transaction with invalid data ptr [ 773.840576] binder: 4455:4456 transaction failed 29201/-14, size 3786-0 line 3155 22:57:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x58, 0x0, &(0x7f0000000180)=ANY=[@ANYRESHEX=0x0, @ANYRESDEC=0x0, @ANYRESOCT, @ANYRES32, @ANYRESOCT=r3], 0x0, 0x0, 0x0}) getxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@random={'security.', '/dev/binder#\x00'}, &(0x7f0000000100)=""/21, 0x15) [ 773.840813] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.877273] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.884617] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.893569] binder: BINDER_SET_CONTEXT_MGR already set [ 773.903422] binder: 4446:4458 ioctl 40046207 0 returned -16 [ 773.929391] binder: undelivered TRANSACTION_ERROR: 29201 [ 773.988749] binder: release 4441:4444 transaction 3017 out, still active [ 773.995857] binder: undelivered TRANSACTION_COMPLETE [ 774.001489] binder: send failed reply for transaction 3017, target dead 22:57:48 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000000)='trusted.overlay.redirect\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x10000, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x20, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x1) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x2d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000010000000080000000000000000ea"], 0x0, 0x0, 0x0}) 22:57:48 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x10000, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x10012) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000013d836c684d592c12cccbb8bc0c20db6ae54e15ac95f1e2924e366f06e10"], 0x0, 0x0, 0x0}) 22:57:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x400000, 0x0) ioctl$RTC_UIE_OFF(r1, 0x7004) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x20000, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000600)) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r5, 0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f00000001c0)=ANY=[@ANYPTR=&(0x7f0000000500)=ANY=[@ANYRES32=r5, @ANYBLOB="9a9e5abaf8f0dcd6df4384f3fbbcf5f34e36b52c9205030a3535960901a6d7a78ab83a8ed3b3dd691d7f903e16892ca078f4a892e86ca0a8f468c374c92d03e662fd281254029459c7cbea4489f5bc0306e8b906f27ca53b0d386674b6f1f1a6ee44243dcb9086433ba87635822945dabd", @ANYRESOCT, @ANYRES32, @ANYRESOCT, @ANYRES32=r2]], 0x1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x4d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000007800e50000000000180000000000000096a881d2ea246c4b0f", @ANYPTR=&(0x7f0000000580)=ANY=[], @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="000000000c19ffff270000000016000000000001000000006268da15a2b36e858686e00e5544"]], 0x0, 0x0, 0x0}) 22:57:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x400008) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000000)=""/184, &(0x7f0000000100)=0xb8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x218, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) [ 774.266011] binder: undelivered TRANSACTION_ERROR: 29201 [ 774.266789] binder: BINDER_SET_CONTEXT_MGR already set [ 774.266796] binder: 4409:4415 ioctl 40046207 0 returned -16 [ 774.268309] binder_alloc: 4409: binder_alloc_buf, no vma [ 774.268349] binder: 4409:4468 transaction failed 29189/-3, size 72-24 line 3137 [ 774.297470] binder_alloc: 4469: binder_alloc_buf, no vma [ 774.311824] binder: 4470:4477 BC_FREE_BUFFER u0000000020ffe000 no match [ 774.319767] binder: 4469:4471 transaction failed 29189/-3, size 3786-0 line 3137 [ 774.320375] binder_alloc: 4474: binder_alloc_buf, no vma [ 774.320411] binder: 4474:4478 transaction failed 29189/-3, size 0-0 line 3137 [ 774.326114] binder: 4470:4477 unknown command 0 [ 774.326122] binder: 4470:4477 ioctl c0306201 20000200 returned -22 [ 774.338328] binder: BINDER_SET_CONTEXT_MGR already set [ 774.338337] binder: 4470:4477 ioctl 40046207 0 returned -16 22:57:48 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r0, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getpeername(r0, &(0x7f0000000000)=@nfc, &(0x7f0000000080)=0x80) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x8a, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="6aedfbdc54d630f2c71f4793116348400000000000000000000000000000000000000000100000000000000061000000000000000000000000000000000000000000000000000008000000000000000000b224cbc23a42597661f06759b6a73bd7757856e687409b04ea49edaa2613c9b5815abf2a792509c9884dc855d9cd26d4b1b27ce70889ec307f"], 0x0, 0x0, 0x0}) 22:57:48 executing program 2: link(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='./file0\x00') r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x100) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0}, &(0x7f0000000300)=0xc) readv(0xffffffffffffffff, 0x0, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) pipe(&(0x7f0000000000)) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000011c0)='tasks\x00', 0x2, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340)="4e0e25b561211d9ea321054aef46997621e931832c4a843b36b24460f63ea76cfa85ec5244809b9d1f88a1a1cf9cd4cdf660ff949a2df49e20430d8f35c65f4cc2bb107941757f52ba0842604a00", 0x4e) read(r5, &(0x7f0000000200)=""/250, 0x50c7e5e2) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r7, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r7, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') ptrace(0x537cb90df83a7d4c, 0x0) getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000440)={0x78, 0xffffffffffffffda, 0x8, {0x2, 0x10001, 0x0, {0x2, 0x8, 0x7fff, 0x10000, 0x746, 0x254, 0xfff, 0x6, 0x3, 0xeeb, 0x1, r4, r8, 0x2, 0xaf0c47d7}}}, 0x78) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x5e, 0x0, &(0x7f0000000240)="b98a8609356293104d91edf85f614c83a12e657ada3b5946aea015fab43d9dff151d2faa85f7f02c31aa1a77403ec87a1b4aad5fc7ad4d74d2f94ed0006eeb4d6345812b57d7e795821a8e5d93a2b7459f61915c0756cd214c6f72678907"}) r9 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000007f700"/64], 0x0, 0x0, 0x0}) 22:57:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xffffffffffffff51, 0x0, &(0x7f0000000140)=[@register_looper], 0x0, 0x0, 0x0}) [ 774.352549] binder: undelivered TRANSACTION_ERROR: 29189 [ 774.352624] binder: undelivered TRANSACTION_ERROR: 29189 [ 774.363498] binder: 4476:4480 got transaction with invalid data ptr [ 774.363556] binder: 4476:4480 transaction failed 29201/-14, size 4096-0 line 3155 [ 774.363777] binder: undelivered TRANSACTION_ERROR: 29201 22:57:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 774.415397] binder: undelivered TRANSACTION_ERROR: 29189 22:57:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='\xcd\x00', 0x0, 0x0) r1 = socket$packet(0x11, 0x6, 0x300) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f0000000000)=@buf={0x16f, &(0x7f0000000240)="1c88001b537218e33a78aaeec9e501b34a4daa86f46394717d1a34323166abf32c8834b0982717f7b77287ae67d88429fe48c42da2f6c812196705b340f95a841fc8c93bf265b68f51a2f2505e057becc3bad58c379bdfc4d0cc69f85df347349bf06f6c433dcc8072af230c8dcd901c70f8c7e7e53260c2227beed54ea049df23aebe1ed5453b1365594e2a45b366d16f07e9995aca08f5840d7f91401bfb632e234fcfc06d02976c24749ef03a058d09b83e1136e3d638aceb4d7c9c76e68435abdfab5954d48322387559a5ef2f210da10209cfdce1467701969c48dc819e51e6b3eb0482e7649d137729870c1007c3a3d5e1eb9e"}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000057b577cc41674a7a8a5c6002ede54bc2f25334af1b4fb913be9aee1ff1c0447da288b37681c48948290d07f007d0dee24a3ad7c2c3f863da70222a1fe9d3e103"], 0x0, 0x0, 0x0}) 22:57:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r1, 0x406, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:48 executing program 1: mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x1, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000180)={0x7, 0x5, 0x1000}, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) r2 = syz_open_dev$mice(&(0x7f0000000300)='/dev/input/mice\x00', 0x0, 0x101000) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000380)={0x3, &(0x7f0000000340)=[{}, {}, {}]}) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f00000001c0)=0x32, 0x118) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @multicast2}, 0x2b6f3402) r3 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) ioctl$sock_SIOCINQ(r3, 0x541b, &(0x7f0000000040)) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) r4 = openat$keychord(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord\x00', 0xc0000, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0xfffffffffffffe8e, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163484000000000000000ffffffffffffffdf003c00000001000000000000000000000000f23700000000000000000000000000000000000000000000000000000000000000000000000000d7f444237a28e5e3a96e13fc53854be2109a099b189a1d2ba0f58ecc9b4aced02f2480042acdb640ad6f419b46eaf818a81e6d4709179eb28c4503d9b9900fe5"], 0x0, 0x0, 0x0}) [ 774.461299] binder_alloc: 4472: binder_alloc_buf size 120259084528 failed, no address space [ 774.463619] binder: 4499:4501 transaction failed 29189/-22, size 3786-0 line 3014 [ 774.464062] binder: undelivered TRANSACTION_ERROR: 29189 22:57:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000010000000080000000000000000ea"], 0x0, 0x0, 0x0}) [ 774.520178] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 774.529753] binder: 4509:4511 ioctl 8912 400200 returned -22 [ 774.538487] binder: 4509:4511 got transaction with invalid data ptr [ 774.541864] binder: 4472:4481 transaction failed 29201/-28, size 0-234 line 3137 [ 774.552518] binder: undelivered TRANSACTION_ERROR: 29201 22:57:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$TUNGETVNETHDRSZ(r3, 0x800454d7, &(0x7f0000000040)) r4 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 774.573854] binder: 4514:4515 got transaction with invalid offsets ptr [ 774.580771] binder: 4509:4511 transaction failed 29201/-14, size 3786-0 line 3155 [ 774.589482] binder: 4514:4515 transaction failed 29201/-14, size 0-234 line 3164 [ 774.599486] binder: undelivered TRANSACTION_ERROR: 29201 [ 774.608331] binder: undelivered TRANSACTION_ERROR: 29201 [ 774.614845] binder: 4509:4517 ioctl 8912 400200 returned -22 [ 774.643039] binder: 4518:4519 got transaction with invalid data ptr [ 774.656243] binder: 4518:4519 transaction failed 29201/-14, size 3786-0 line 3155 [ 774.683718] binder: undelivered TRANSACTION_ERROR: 29201 22:57:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000000)) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) exit_group(0x3c) 22:57:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b9b8aedca8a1708c700a0de361e7ef6bcc46f4752886180b07552b19bca73b868d9d0e763e06c4524237f1be7e0f3b469d4ea9a2930dfefccd2fe9a4095fa16f6fb2b20295b1f46310c0b73aec38b8124cb0ddd1de2f490dd71a5c26133360"], 0x0, 0x0, 0x0}) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) [ 775.135790] binder: undelivered TRANSACTION_COMPLETE [ 775.143282] binder: 4530:4531 got transaction with too large buffer [ 775.145413] binder: 4526:4529 got transaction with invalid data ptr [ 775.145476] binder: 4526:4529 transaction failed 29201/-14, size 3786-0 line 3155 [ 775.164534] binder: undelivered transaction 3045, process died. [ 775.172773] binder: undelivered TRANSACTION_ERROR: 29201 [ 775.178397] binder: undelivered TRANSACTION_COMPLETE 22:57:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/111, 0x6f) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:49 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r1, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat(r2, &(0x7f0000000140)='./file0\x00', 0x400000, 0x285) getsockopt$SO_COOKIE(r3, 0x1, 0x39, &(0x7f0000000180), &(0x7f00000002c0)=0x8) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0xc) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000240)=ANY=[], 0xffffff43, 0x0, 0x0}) 22:57:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x1000000000}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x2b}, @fda={0x66646185, 0x1, 0x2, 0x24}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000040)=@req3={0x3, 0xffff, 0x3, 0x6a9152bf, 0x2, 0xe702, 0x2}, 0x1c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e5bee37032e9d052e035c7c934acc0a383630eb29e13e8eb4481e678c451baa848b48ee47b309ab3b0d7b1a170605df23bb516dad26f2f05267f2e24bf0af84a13900ea18acd2e29ae1c7e5f52aa700865998cb5bcd866aeba19b755b0ea602f97b7cabfe97b666bb56b98d6dac0dd2a136d63c0821adc15a26fb442305af361e7726510ebaab4df4b29677234d025637748d65f0883ae6746faf74a1b7148ba6c8c80c412e63844860f2303b87a3672558af160786f39b230dfcfc8c3304d4e3ca154fd08e7c156c96899ae0d0a6b4c9670ac218763310a8fed8a8ec88766cb7d64e32d671203a538d6cd4fb17f027fcdb39ec"], 0x0, 0x0, 0x0}) 22:57:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000080)={0x20, 0x0, 0x3, {0x2, 0x0, 0xffff, 0x80}}, 0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x40000, 0x0) ioctl$KDDISABIO(r3, 0x4b37) 22:57:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@broadcast, @local, [], {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @empty, @remote, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x4bf3292140c8f27d}, @local}}}}, &(0x7f0000000040)={0x0, 0x4, [0x595, 0xb7a, 0x832, 0x13b]}) [ 775.188519] binder: 4530:4531 transaction failed 29201/-22, size 120-24 line 3295 [ 775.196382] binder: undelivered transaction 3051, process died. [ 775.205137] binder: BINDER_SET_CONTEXT_MGR already set [ 775.210546] binder: 4530:4535 ioctl 40046207 0 returned -16 [ 775.210559] binder: undelivered TRANSACTION_ERROR: 29201 22:57:49 executing program 1: pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r0, 0x0, r1, 0x0, 0x1003, 0x0) recvmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000000000)=""/21, 0x15}], 0x2, &(0x7f0000001240)=""/136, 0x88}, 0x2000) r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="116348400000000000000000000004000000f2fc00000000010000000000000000000000000020000000007901c67e9f47d78400"/76], 0x0, 0x0, 0x0}) [ 775.248344] binder: undelivered TRANSACTION_COMPLETE [ 775.254420] binder: undelivered transaction 3053, process died. [ 775.272986] binder: undelivered TRANSACTION_COMPLETE [ 775.280068] binder: 4538:4547 got transaction with too large buffer [ 775.286629] binder: 4542:4549 got transaction with invalid parent offset or type 22:57:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='cpuacct.stat\x00', 0x0, 0x0) linkat(r1, &(0x7f0000000180)='./file1\x00', r2, &(0x7f0000000480)='./file0\x00', 0x400) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) unlink(&(0x7f0000000000)='./file0\x00') r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x800, 0x0) r5 = getpgrp(0x0) write$FUSE_LK(r4, &(0x7f0000000140)={0x28, 0x0, 0x3, {{0xfb9, 0x8000, 0x1, r5}}}, 0x28) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000c1ba1bb966340de6d31d6d1118bc20f4155e027e39baf6b07896841762d8fc0909769cf71e5e0dc9d16dc533cdaf1f45d5af5a16530000000000000004cd397e7fdbbb328865029f1dd9c67cfb4bb3d539fb2eb7ad75", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000040000000a67cbd563329c5b3d72e6e5fcd6586255f2ef5d5d341fabe7d084c2644a66993407d3de131ee6bfe52b059b68a5a38c1ef0e95e4ebf6ec465926f722660813ba3d846d1a44706035039757d5e557a896bf1b4f083fb98c75672e662f56e080f8ce763fa415ef59444a5103b9cbfd56a2dbcbda517c8f147beee59a87fa24cb0dbffad00f73d62f1ef50412a9a0024a"], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r6 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r6, 0x40046208, 0x0) [ 775.297181] binder: 4545:4548 transaction failed 29201/-22, size -7120750422069145910--3726003579366724091 line 3137 [ 775.302819] binder: 4538:4547 transaction failed 29201/-22, size 120-24 line 3295 [ 775.303342] binder: undelivered TRANSACTION_ERROR: 29201 [ 775.303404] binder: undelivered transaction 3055, process died. [ 775.316524] binder: 4538:4553 got transaction with too large buffer [ 775.316581] binder: 4538:4553 transaction failed 29201/-22, size 120-24 line 3295 [ 775.329652] binder: undelivered TRANSACTION_ERROR: 29201 [ 775.354997] binder: 4542:4549 transaction failed 29201/-22, size 112-24 line 3259 [ 775.373733] binder: 4559:4561 got transaction with too large buffer 22:57:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x1000000000}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x2b}, @fda={0x66646185, 0x1, 0x2, 0x24}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 775.399139] binder: undelivered TRANSACTION_ERROR: 29201 [ 775.401428] binder: 4552:4560 transaction failed 29201/-28, size 8718968878591377408-37391399544342017 line 3137 [ 775.432735] binder: BINDER_SET_CONTEXT_MGR already set [ 775.433044] binder: 4559:4561 transaction failed 29201/-22, size 120-24 line 3295 22:57:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16, 0x2}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 775.438642] binder: BINDER_SET_CONTEXT_MGR already set [ 775.438650] binder: 4559:4567 ioctl 40046207 0 returned -16 [ 775.440882] binder_alloc: 4559: binder_alloc_buf, no vma [ 775.440926] binder: 4559:4567 transaction failed 29189/-3, size 120-24 line 3137 [ 775.484560] binder: undelivered TRANSACTION_ERROR: 29189 [ 775.487598] binder: BINDER_SET_CONTEXT_MGR already set 22:57:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 775.487606] binder: 4570:4573 ioctl 40046207 0 returned -16 [ 775.488760] binder_alloc: 4542: binder_alloc_buf, no vma [ 775.488797] binder: 4570:4573 transaction failed 29189/-3, size 112-24 line 3137 [ 775.520968] binder: BINDER_SET_CONTEXT_MGR already set [ 775.526718] binder: 4572:4574 ioctl 40046207 0 returned -16 [ 775.533228] binder: 4552:4565 ioctl 40046207 0 returned -16 [ 775.539323] binder_alloc: 4559: binder_alloc_buf, no vma 22:57:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000010000000080000000000000000ea"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f0000000240)={'nat\x00', 0x0, 0x0, 0x0, [], 0x1, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}], 0x0, [{}]}, 0x88) ioctl$RTC_PLL_SET(r3, 0x40207012, &(0x7f0000000000)={0x5, 0x80, 0xd7, 0xffffff38, 0x10000, 0x1, 0x1000}) 22:57:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x10) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000080)={0x180d7, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 775.545175] binder: 4572:4574 transaction failed 29189/-3, size 120-24 line 3137 [ 775.548982] binder: BINDER_SET_CONTEXT_MGR already set [ 775.548990] binder: 4575:4576 ioctl 40046207 0 returned -16 [ 775.558560] binder_alloc: 4542: binder_alloc_buf, no vma [ 775.558599] binder: 4575:4576 transaction failed 29189/-3, size 120-24 line 3137 [ 775.586866] binder: undelivered TRANSACTION_ERROR: 29201 [ 775.593459] binder: undelivered TRANSACTION_ERROR: 29189 [ 775.610045] binder: undelivered TRANSACTION_ERROR: 29189 [ 775.627169] binder: undelivered TRANSACTION_ERROR: 29201 [ 775.641219] binder: BINDER_SET_CONTEXT_MGR already set [ 775.648050] binder: undelivered TRANSACTION_ERROR: 29201 [ 775.651040] binder_alloc: 4581: binder_alloc_buf size 2554215420696031488 failed, no address space [ 775.651046] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 775.651084] binder: 4581:4582 transaction failed 29201/-28, size 3786-0 line 3137 [ 775.679772] binder: 4580:4583 ioctl 40046207 0 returned -16 [ 775.689048] binder: 4572:4585 got transaction with too large buffer [ 775.696789] binder_alloc: 4542: binder_alloc_buf, no vma [ 775.702644] binder: 4572:4585 transaction failed 29201/-22, size 120-24 line 3295 [ 775.710374] binder: 4580:4583 transaction failed 29189/-3, size 0-234 line 3137 [ 775.730479] binder: undelivered TRANSACTION_ERROR: 29201 [ 775.756600] binder: undelivered TRANSACTION_ERROR: 29189 [ 775.774395] binder: undelivered TRANSACTION_ERROR: 29189 [ 775.786258] binder: undelivered TRANSACTION_ERROR: 29201 22:57:50 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x8000000000000) getgid() ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000040)="9a0c", 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/member\x00', 0x2, 0x0) fcntl$addseals(r4, 0x409, 0x6) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e0a3b9fe832f1ca5c71cfd159d6bd88c22b49923084efea8f40454b42fb41171a5d1b6d102814b087a33886099044419b2f718927d97295e6c5fe97cbfa1e092938d94646e18e381d279bf902081d62d0931da1cc20461900000000000000000000000000001cb7f95f79d43cb6b26985cf38cf480af897bd44f32c372aa5f3320c46564edc926b1c03a99000822cef287c51be3e345c9a8b16b6c155e17c2e72de5e72395fd2837a40e0b14c1e4c066533f94775d52ad04427261d41274b29fc4a424dd3fcb5b8a28f135a9cac00ee5df772c7111df64bddfdbb775eef47ec52def3883d47826d9ec0db9a497c390e25680fcdcd201ae8759e2c312fe0c3bbd69768b800fd1aaf1d997e9c19fe0a96a84313150665e27c9a8da9a6f47f8cd6b454450ee393e0b15b86e15b45d638cbdbae1a3b1a99dee5dc0d52b28c74b46d8a255bb75a25e4dbe200925fed680770a77c5d4606f27a6ba8fe5eb5d3d3d894f20261f840d9f6e75b00"/414], 0x0, 0x0, 0x0}) 22:57:50 executing program 1: syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x80) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IP\x01\x00') pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x84080000}, 0xc, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYPTR, @ANYPTR, @ANYBLOB="040226bd7000fbdbdf250500000008000400cc910000"], 0x3}, 0x1, 0x0, 0x0, 0x2000c002}, 0x8014) mknodat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x80, 0x1e03) write$P9_RLOPEN(r2, &(0x7f0000000040)={0x269, 0xd, 0xfffe, {{0x40, 0x1, 0x9}, 0x3}}, 0x18) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x19b, 0x0, 0x0}) 22:57:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r3, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r4 = dup(r3) r5 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r6 = epoll_create1(0x80000) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r7, 0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0xac, 0x0, &(0x7f0000000300)=[@request_death={0x400c630e, 0x1}, @free_buffer={0x40086303, r5}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000040)={@fda={0x66646185, 0x20, 0x1, 0x3d}, @fd={0x66642a85, 0x0, r6}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/154, 0x9a, 0x2, 0x40}}, &(0x7f00000001c0)={0x0, 0x20, 0x38}}}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000240)={@fd={0x66642a85, 0x0, r7}, @fda={0x66646185, 0x0, 0x0, 0x22}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f00000002c0)={0x0, 0x18, 0x38}}}], 0xd6, 0x0, &(0x7f00000003c0)="4007c2c4c3270fe69f8dc84de22a710797cffdfa1507d654830471ad3d7de79797ee1bdd5385f66a8cd3a19d26f330d8687d43954ccb8a1462c5d2655c375cb338277773585fac8c0816a3f85fd9896836a977b09b677bf674df2025b8f9358e847b48d00e4ec7f1fa39e150199300b97812bc1f799a71d8de9a2649749f54024db0ad85ad2655dd8d79562317696a5f9253a07ed0d5251b33cfe95cf027560db13d4895bcba482e945d3a0c8abb2112208a00a1a957fd454d85f1c83ac0ec502df431f532489afd7ec3f8a77c150d2139b2c1e16248"}) r8 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163030000000000000000000000000000000000000000000000faffffffff68d59da249d30e"], 0x0, 0x0, 0x0}) 22:57:50 executing program 4: pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/bi\x94\xcc\xa2%#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000001000000000000000007800000000000000180000000000000055d5b83b6d93e21a6f6ffb8a0b38a87958425db6bdd9a64d6df531f270959d6831c58fc7dee74efa335228ebebb920086268c7569b8feea82ff816f87219999a7bddb8b3a45318d46153dd0e704d15b928f11e7c8939be6a75a86e42f31a34c32eebfd4ec7822454f7d8e02920eba23c965e53ca1038bad3a9f91515e90d653b3bbd0831b99c8483ec0b71e143963f2e5d4e8b866af5b39200958659aa26e1ab0addd2677037662439c227", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 22:57:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r2, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, r2) ioctl$KDGETKEYCODE(r3, 0x4b4c, &(0x7f0000000040)={0x0, 0x2}) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r4, 0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(r4, 0x1, 0x5, &(0x7f0000000000)=0x7, 0x4) r5 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r5, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) splice(r5, &(0x7f0000000080)=0x80000000, 0xffffffffffffffff, &(0x7f0000000100)=0x1f, 0x9, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000001000000000000000000000000f82368cc000000000000000000000000000000000000009a000000000000000300000000000000eee4c567c06f6edf8b1125ad62894389ad176bf34065683fefac7d1bdbf923730e89e30893c59940f79ad75a34fe3c8f981118750c5bf7c404db7653946770204ad96a5f39a642380a0ef64b53ba6fcfd594191c888b784ef56cdf90408c42450c23dd804e4b6d56292c741a2ec4ae449a5bcf2591eab97791f7fa02865f6f035dbad23f89d9bd787bf4ae75447974380e995b32a6be81b4f85ac7481b4037b55d6254ce31ceb291f6bfc851d754c788db909624be02e4fd4f849ab4ca215fa98c37fa35777519f5450dbb0b0bd3d13ddfdca800ed6d18f4263ec1fce2776851f191d9a44ccb20"], 0x0, 0x0, 0x0}) 22:57:50 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x1) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)='rdma.max\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000300)={{0x2, 0x4e21, @loopback}, {0x1, @random="7182ca2d91c4"}, 0x52, {0x2, 0x4e23, @rand_addr=0x4}, 'ifb0\x00'}) sync_file_range(r2, 0x0, 0x8, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) write$P9_RATTACH(0xffffffffffffffff, &(0x7f0000000100)={0x14, 0x69, 0x1, {0x40, 0x4, 0x4}}, 0x14) write$UHID_INPUT2(r3, &(0x7f0000000380)={0xc, 0x69, "c30afebb02aa046247f6610e1bace6841eaa2197cd1e1c8953d0fdd3a7a58b3926c06de7ed093b924bff81d5049138b1322919c63d422147ffa459ad1e1984f08a442c662665b5e7d72d9dea3eea175637023b355a595dfcde14feb58e61132c947607cd97bf507427"}, 0x6f) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff}) read(r6, &(0x7f0000000200)=""/250, 0x50c7e3e3) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000440)='devlink\x00') sendmsg$DEVLINK_CMD_PORT_SET(r6, &(0x7f00000005c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x88010}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xcc, r7, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [{{@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8}}, {{@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x5}}, {0x8, 0x4, 0x2}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x1}}, {0x8, 0x4, 0x3}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x4010}, 0x20000010) sendmsg$DEVLINK_CMD_PORT_SET(r2, &(0x7f0000000540)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x58002000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)={0xa4, r7, 0x1, 0x70bd28, 0x25dfdbfb, {}, [{{@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x4, 0x1}}, {{@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8}}, {{@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0x4, 0x1}}]}, 0xa4}}, 0x11) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x8000000000000) getgid() ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000040)="9a0c", 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/member\x00', 0x2, 0x0) fcntl$addseals(r4, 0x409, 0x6) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e0a3b9fe832f1ca5c71cfd159d6bd88c22b49923084efea8f40454b42fb41171a5d1b6d102814b087a33886099044419b2f718927d97295e6c5fe97cbfa1e092938d94646e18e381d279bf902081d62d0931da1cc20461900000000000000000000000000001cb7f95f79d43cb6b26985cf38cf480af897bd44f32c372aa5f3320c46564edc926b1c03a99000822cef287c51be3e345c9a8b16b6c155e17c2e72de5e72395fd2837a40e0b14c1e4c066533f94775d52ad04427261d41274b29fc4a424dd3fcb5b8a28f135a9cac00ee5df772c7111df64bddfdbb775eef47ec52def3883d47826d9ec0db9a497c390e25680fcdcd201ae8759e2c312fe0c3bbd69768b800fd1aaf1d997e9c19fe0a96a84313150665e27c9a8da9a6f47f8cd6b454450ee393e0b15b86e15b45d638cbdbae1a3b1a99dee5dc0d52b28c74b46d8a255bb75a25e4dbe200925fed680770a77c5d4606f27a6ba8fe5eb5d3d3d894f20261f840d9f6e75b00"/414], 0x0, 0x0, 0x0}) 22:57:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 776.110285] binder_alloc: binder_alloc_mmap_handler: 4591 20ffd000-21000000 already mapped failed -16 [ 776.124395] binder: 4594:4597 transaction failed 29201/-28, size 877920516096-0 line 3137 [ 776.135454] binder: 4591:4593 unknown command 221969 [ 776.142562] binder: undelivered TRANSACTION_ERROR: 29201 [ 776.147812] binder: 4591:4593 ioctl c0306201 20000200 returned -22 22:57:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x401, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16, 0x0, 0x39}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 776.173339] binder: 4600:4602 transaction failed 29201/-22, size -1066534391145427254--4767524397861741366 line 3137 [ 776.203269] binder: BINDER_SET_CONTEXT_MGR already set [ 776.214002] binder: 4589:4615 Acquire 1 refcount change on invalid ref 0 ret -22 22:57:50 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x8000000000000) getgid() ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000040)="9a0c", 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/member\x00', 0x2, 0x0) fcntl$addseals(r4, 0x409, 0x6) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e0a3b9fe832f1ca5c71cfd159d6bd88c22b49923084efea8f40454b42fb41171a5d1b6d102814b087a33886099044419b2f718927d97295e6c5fe97cbfa1e092938d94646e18e381d279bf902081d62d0931da1cc20461900000000000000000000000000001cb7f95f79d43cb6b26985cf38cf480af897bd44f32c372aa5f3320c46564edc926b1c03a99000822cef287c51be3e345c9a8b16b6c155e17c2e72de5e72395fd2837a40e0b14c1e4c066533f94775d52ad04427261d41274b29fc4a424dd3fcb5b8a28f135a9cac00ee5df772c7111df64bddfdbb775eef47ec52def3883d47826d9ec0db9a497c390e25680fcdcd201ae8759e2c312fe0c3bbd69768b800fd1aaf1d997e9c19fe0a96a84313150665e27c9a8da9a6f47f8cd6b454450ee393e0b15b86e15b45d638cbdbae1a3b1a99dee5dc0d52b28c74b46d8a255bb75a25e4dbe200925fed680770a77c5d4606f27a6ba8fe5eb5d3d3d894f20261f840d9f6e75b00"/414], 0x0, 0x0, 0x0}) 22:57:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'security.', '/dev/binder#\x00'}, &(0x7f0000000240)=""/241, 0xf1) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 776.223061] binder_alloc: 4607: binder_alloc_buf, no vma [ 776.227250] binder: 4589:4615 ioctl c0306201 20000200 returned -14 [ 776.236054] binder: 4607:4613 transaction failed 29189/-3, size 3786-0 line 3137 [ 776.240841] binder: 4609:4610 ioctl 40046207 0 returned -16 [ 776.244092] binder_alloc: 4594: binder_alloc_buf, no vma [ 776.244131] binder: 4609:4610 transaction failed 29189/-3, size -1066534391145427254--4767524397861741366 line 3137 [ 776.272413] binder: undelivered TRANSACTION_ERROR: 29189 [ 776.274176] binder: 4612:4614 got transaction with too large buffer [ 776.274234] binder: 4612:4614 transaction failed 29201/-22, size 120-24 line 3295 [ 776.287500] binder: BINDER_SET_CONTEXT_MGR already set [ 776.287509] binder: 4612:4619 ioctl 40046207 0 returned -16 [ 776.287994] binder_alloc: 4612: binder_alloc_buf, no vma [ 776.288031] binder: 4612:4614 transaction failed 29189/-3, size 120-24 line 3137 [ 776.291202] binder_alloc: 4590: binder_alloc_buf, no vma 22:57:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) 22:57:50 executing program 5: clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimes(&(0x7f0000000040)='./file0\x00', &(0x7f0000000200)={{r0, r1/1000+10000}}) r2 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0xa000, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 776.291241] binder: 4590:4621 transaction failed 29189/-3, size 4096-0 line 3137 [ 776.314321] binder: BINDER_SET_CONTEXT_MGR already set [ 776.314329] binder: 4622:4624 ioctl 40046207 0 returned -16 [ 776.319853] binder: 4623:4625 got transaction with invalid data ptr [ 776.319911] binder: 4623:4625 transaction failed 29201/-14, size 4096-0 line 3155 [ 776.320925] binder_alloc: 4600: binder_alloc_buf, no vma [ 776.320963] binder: 4622:4624 transaction failed 29189/-3, size -1066534391145427254--4767524397861741366 line 3137 [ 776.378028] binder: BINDER_SET_CONTEXT_MGR already set [ 776.383797] binder: 4626:4628 ioctl 40046207 0 returned -16 [ 776.390230] binder_alloc: 4612: binder_alloc_buf, no vma [ 776.396170] binder: 4626:4628 transaction failed 29189/-3, size 120-24 line 3137 [ 776.405122] binder: BINDER_SET_CONTEXT_MGR already set [ 776.412093] binder: 4626:4632 ioctl 40046207 0 returned -16 [ 776.427378] binder_alloc: 4612: binder_alloc_buf, no vma [ 776.437730] binder: 4626:4632 transaction failed 29189/-3, size 120-24 line 3137 [ 776.440737] binder: BINDER_SET_CONTEXT_MGR already set [ 776.440744] binder: 4631:4633 ioctl 40046207 0 returned -16 [ 776.441522] binder_alloc: 4600: binder_alloc_buf, no vma [ 776.441559] binder: 4631:4633 transaction failed 29189/-3, size 120-24 line 3137 [ 776.475660] binder: undelivered TRANSACTION_ERROR: 29189 [ 776.481446] binder: undelivered TRANSACTION_ERROR: 29189 [ 776.495214] binder: undelivered TRANSACTION_ERROR: 29189 [ 776.501841] binder: undelivered TRANSACTION_ERROR: 29189 [ 776.508973] binder: undelivered TRANSACTION_ERROR: 29189 [ 776.514997] binder: undelivered TRANSACTION_ERROR: 29201 [ 776.520747] binder: undelivered TRANSACTION_ERROR: 29189 [ 776.527397] binder: undelivered TRANSACTION_ERROR: 29201 [ 776.533589] binder: undelivered TRANSACTION_ERROR: 29201 22:57:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x256, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x531800, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$HDIO_GETGEO(r2, 0x301, &(0x7f0000000040)) 22:57:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:57:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) getxattr(&(0x7f0000000300)='./file0\x00', &(0x7f0000000080)=@known='t\x84usted.ovi\x00'/22, &(0x7f0000000100)=""/113, 0xff1f) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000240)="fa176973bd07a86d9abcfc4188041bf470223fb1f3ada41bb5d2a209979d18c67fed7e089620d7f990b49ddb2ba3d270bbe83674b886cc9b6e500270eae67272d20d6aefc25ea3102cc1158cc9c3be664796ec079ed70a07be906e328f46b4b3e333a77b15d826e89d83d001566e44e7f18ab3e827f0d40cd2f2b0f94ca980685c8e19f514fd2d344c779b94c99c4fd668c27f2a8b3ad089eafc838329901ae178e474ace9cc5cb275cabfc7803d0218", 0xb0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f0000000180)='nlmon0\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:50 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = getpid() ptrace$setopts(0x4206, r1, 0xfffffffffffffffd, 0x57) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b2c08e8adb916a221119fc2591277a0c914e366bca94beb229747ebab6248788037cb", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFBR(r3, 0x8941, &(0x7f0000000040)=@generic={0x0, 0x1, 0x10001}) [ 776.905460] binder: 4589:4639 Acquire 1 refcount change on invalid ref 0 ret -22 [ 776.913149] binder: 4589:4639 ioctl c0306201 20000200 returned -14 [ 776.916971] binder: undelivered TRANSACTION_ERROR: 29189 [ 776.941003] binder: 4641:4644 got transaction with invalid offset (4294966837, min 80 max 120) or object. 22:57:50 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x400, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000340)=0x5) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x35a, 0x3, 0x0, 0x3, 0xa, 0x9, "c42721866d0d388fbef9bd1721062c9fbd2b885aa9408b9080a146edecc1ceb77afff4dff71b7259d3a4daa543f542ad8974c00c4c1d337b2d25ab93de21058c", "0144bb7a90385d451cdf0e8545865e789553f5e00cf5f3f90876fe991c7be511479e48abb4fef94676a6b5cab1745e15c83b4b01bd77b792ea75343f13c661a8", "b4f106a099040ae1ac617b0c896feb664c9caad6323134251688c001962635fb", [0x7fffffff, 0x8a]}) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) 22:57:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) ioctl$KDDISABIO(r1, 0x4b37) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 776.954121] binder: 4640:4647 got transaction with invalid offset (80, min 80 max 120) or object. [ 776.955350] binder: 4641:4644 transaction failed 29201/-22, size 120-24 line 3199 [ 776.960934] binder: undelivered TRANSACTION_ERROR: 29201 [ 777.002459] binder: 4646:4648 got transaction with invalid data ptr [ 777.011851] binder: 4643:4657 got transaction with invalid data ptr [ 777.020866] binder: 4653:4658 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 777.023881] binder: 4646:4648 transaction failed 29201/-14, size 598-0 line 3155 [ 777.024042] binder: 4646:4648 ioctl c0306201 20000200 returned -14 [ 777.031161] binder: BINDER_SET_CONTEXT_MGR already set 22:57:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000480)={{{@in, @in6=@ipv4={[], [], @multicast1}}}, {{@in=@loopback}, 0x0, @in=@broadcast}}, &(0x7f0000000000)=0xfffffeca) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r3 = openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/current\x00', 0x2, 0x0) sendfile(r1, r3, &(0x7f0000000080)=0x1800000000, 0x1f) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000100000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000002"], 0x0, 0x0, 0x0}) 22:57:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3b) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x35, 0x7, 0x0, 0x5, 0x0, 0x60, 0x41000, 0x1c, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x4, 0x4, @perf_config_ext={0x100000001, 0x10000}, 0x6a72f1b7e0ffd344, 0x80000001, 0x1, 0x1, 0x4, 0x6, 0x8}, r4, 0x2, r3, 0x18) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000100)={0x0, 0x0}) sched_getaffinity(r5, 0x8, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 777.031170] binder: 4646:4662 ioctl 40046207 0 returned -16 [ 777.031663] binder_alloc: 4646: binder_alloc_buf, no vma [ 777.031704] binder: 4646:4662 transaction failed 29189/-3, size 598-0 line 3137 [ 777.031721] binder: 4646:4662 ioctl c0306201 20000200 returned -14 [ 777.038500] binder: undelivered TRANSACTION_ERROR: 29189 [ 777.038540] binder: undelivered TRANSACTION_ERROR: 29201 [ 777.070635] binder: 4640:4647 transaction failed 29201/-22, size 120-24 line 3199 [ 777.076623] binder: undelivered TRANSACTION_ERROR: 29201 [ 777.105515] binder_alloc: 4656: binder_alloc_buf, no vma [ 777.112375] binder: 4643:4657 transaction failed 29201/-14, size 3786-0 line 3155 [ 777.122920] binder: undelivered TRANSACTION_ERROR: 29201 [ 777.123434] binder: 4656:4661 transaction failed 29189/-3, size 4096-0 line 3137 [ 777.126946] binder: BINDER_SET_CONTEXT_MGR already set [ 777.126955] binder: 4656:4668 ioctl 40046207 0 returned -16 22:57:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TIOCLINUX4(r1, 0x541c, &(0x7f0000000040)) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$IPT_SO_GET_ENTRIES(r3, 0x0, 0x41, &(0x7f0000000240)={'nat\x00', 0x78, "70e256ccdc5e9938a5d564dd4bc5e50fe930dd0e736886058a6434e9f0e00ab6348970ac2698ee2e853a2a93ff90f61f9a6bb84152333d19ddf9e902bb6d1c9ed4d9bad1716bd7f4491cc2b3b4f21846d1ec8a48f1f218b4d16554527f0dbe1cab156c696a9a0f9c3fa5e1314c04394cd0b96f579f22bf19"}, &(0x7f0000000080)=0x9c) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000100)=ANY=[@ANYRESDEC=r5], 0x0, 0x0, 0x0}) 22:57:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x800) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r4, 0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r4, 0xc0406619, &(0x7f0000000040)={{0x1, 0x0, @reserved="cb695c8e7cc9dcf8533b6b689bb1931a6f245932ebfd8bfa9ddfcdd5a31dcc17"}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="116348400000000000006a94d456c56254cebd0000000000000000000000000069d5aba057a5fa00000000000000000000000000ac853cbd1c80aaefb899a8de377af40c5ec53bc952138d8371003a12af6c2f091fed390a82959d38cc6730aa32494ec3391f50fe12df1f4d7914e050585dfaa130f56f33f768d7642c5614f2a4b423d357785591dee2615e53e6fce48ee53edef467c9d9ff487dcc11b8ab8ff5a45ed1977ec41be06349dbb434b7b9f742048fa4df48afe5"], 0x0, 0x0, 0x0}) [ 777.153301] binder: undelivered TRANSACTION_ERROR: 29189 [ 777.159217] binder: 4653:4658 transaction failed 29201/-22, size 120-24 line 3199 22:57:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000100002000000000000072bc8a8cd5f449000"/70], 0x0, 0x0, 0x0}) 22:57:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) ioctl$ION_IOC_HEAP_QUERY(r3, 0xc0184908, &(0x7f0000000040)={0x34}) r4 = fcntl$dupfd(r2, 0x0, r2) prctl$PR_SET_THP_DISABLE(0x29, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000010000000000000e3020000000000000000000000000000000000000000000000000000000000008c2b2c24c073dd2840431a2b8a33f21b3799fbcdc9ca15d03399bb3f4af6514528e325666ff8d796eac365e3a9983f52cd75b9f982ed7166c2581d4524ca09704db2e4b23d4567c119c7dda8074cb8465a544dab06768e9847c10abaf500ddfd0db3b0b82a5f732f2e422bde7d78682ed8352e9263ac2e8b655fef6dd58d323bab33ba3fe1da6877c23f3f762fed8765bb8fa72c02a2150791cf773e9dabb37429a6fddd372dc69daf71139645bdf770906c0862f5dc3d2346c83b6cd091e752e99aa627bb6c795c5b468f54a150b6191f63b12864381f14be7967fb2ab0b720fb767e2822f5dd82b1ded3de9bbab3a7a75d9d8ff6b0b03a0a468f3ff6d3dc3bdc12da54962619f0df7390ad35135dfcde2722fff03b00113944dc79e4cffa6edaffa0e7e4d07599819fbaf1078a8ae6ac1b1c7f9c25883df16dfe390bf5f76a6abc8d4e185597ee098e1a0cc800442ebd81a4f8fc387618c62cfb430be940084502fa437468c5ccab01b1c2e3edd59314dd804d2131425fbf92bfc0fa8e83beda59e759aa409a2ff9f8dccde6530be8fa0bd7994bb0330b703b5710418f9295b6ffa61812f769546fe887938c3182380320ed610cc72e39255c135fcc3c431b01f50548c8060a"], 0x0, 0x0, 0x0}) 22:57:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 777.210197] binder: undelivered TRANSACTION_ERROR: 29201 [ 777.215145] binder_alloc: 4678: binder_alloc_buf size -8967490036723979592 failed, no address space [ 777.215152] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 777.215189] binder: 4678:4680 transaction failed 29201/-28, size 16426327-0 line 3137 [ 777.232384] binder: BINDER_SET_CONTEXT_MGR already set [ 777.232392] binder: 4681:4682 ioctl 40046207 0 returned -16 [ 777.233697] binder_alloc: 4678: binder_alloc_buf, no vma 22:57:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r2, 0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) r4 = fcntl$dupfd(r0, 0x406, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) clone(0x10802102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x38) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r6, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r6, 0x8004745a, &(0x7f0000000600)) write$FUSE_LK(r6, &(0x7f0000000080)={0x28, 0x0, 0x5, {{0x8, 0xbb, 0x0, r5}}}, 0x28) ptrace$cont(0x18, r5, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001dc0)={0x0, 0x0, &(0x7f00000000c0)=[{0x0, 0xfffffffffffffce2}, {0x0, 0x15e}, {0x0, 0x3ff}, {&(0x7f0000000100)=ANY=[], 0x9c}], 0x169, 0x0, 0x92cda30ce5e033f3}, 0x0) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$peekuser(0x3, r5, 0x9) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000100)={0x0, 0xfffffffe, 0x5}) ptrace$cont(0x20, r5, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="11634840000054040681244d8c00000000000000000000a022ce9e76de1a160069d5ab4d30f3e49b7c79e2288fd32b881b14d2d9858b9e756597df2b48e7138e7c7d45263e448215300ef744760649813f2dfdc0ac946e74ac7fa505c0441b942cf36c403a16a341b7255bb7eb3e84338280d1c522524c0e02739f56ea41110c80ef69c0cbaaff5ac95a6eacefae5ce381f36007a7c93f3d9e1e81bb5b3b694795091d8b3d79db91050d0b2228627feb26"], 0x0, 0x0, 0x0}) [ 777.233736] binder: 4681:4682 transaction failed 29189/-3, size 33558528-6903359381497643008 line 3137 [ 777.266392] binder: BINDER_SET_CONTEXT_MGR already set [ 777.266401] binder: 4683:4684 ioctl 40046207 0 returned -16 [ 777.299803] binder: BINDER_SET_CONTEXT_MGR already set 22:57:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$KDGKBMODE(r3, 0x4b44, &(0x7f0000000040)) r4 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000efffffffffffffff0000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 777.303332] binder: release 4676:4686 transaction 3120 out, still active [ 777.303336] binder: undelivered TRANSACTION_COMPLETE [ 777.303408] binder: send failed reply for transaction 3120, target dead [ 777.305247] binder: undelivered TRANSACTION_ERROR: 29189 [ 777.305408] binder: undelivered TRANSACTION_ERROR: 29201 [ 777.327093] binder: 4683:4691 transaction failed 29189/-22, size 4096-739 line 3014 [ 777.338544] binder: 4677:4692 unknown command 875837489 [ 777.338552] binder: 4677:4692 ioctl c0306201 20000200 returned -22 [ 777.359970] binder: 4687:4688 ioctl 40046207 0 returned -16 [ 777.380346] binder: 4698:4699 got transaction with invalid data ptr [ 777.387395] binder: 4698:4699 transaction failed 29201/-14, size 3786-0 line 3155 [ 777.396227] binder: undelivered TRANSACTION_ERROR: 29201 22:57:51 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r0, 0x0, r1, 0x0, 0x1003, 0x0) r2 = dup2(r0, 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) timerfd_settime(r2, 0x0, &(0x7f0000000040)={{}, {r3, r4+30000000}}, &(0x7f0000000140)) r5 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, 0x0, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$KDGETLED(r6, 0x4b31, &(0x7f0000000180)) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 777.849553] binder: 4705:4707 got transaction with too large buffer [ 777.856553] binder: 4705:4707 transaction failed 29201/-22, size 120-24 line 3295 [ 777.865345] binder: undelivered TRANSACTION_ERROR: 29201 22:57:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484400000000000000000000000000000000000000ae6cb5e3762192000100"/83], 0x0, 0x0, 0x0}) 22:57:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) ioctl$RTC_PIE_OFF(r1, 0x7006) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$SNDRV_TIMER_IOCTL_STATUS(r5, 0x80605414, &(0x7f0000000240)=""/173) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r7, 0x0, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$BLKFRASET(r7, 0x1264, &(0x7f0000000100)=0x6) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) write$binfmt_aout(r6, &(0x7f0000000040)={{0x107, 0x1f, 0x5, 0x1c7, 0x272, 0x2, 0x39f, 0x800}, "25b35074664e5e4b0bba445127639196d2f1eb14d016a979a3280a54b7489323efc50b218fd393bc8289ac92c380ed61"}, 0x50) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 777.948609] binder_alloc: 4715: binder_alloc_buf size 2688649531544 failed, no address space [ 777.961144] binder: 4721:4722 unknown command 1145594641 [ 777.967947] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 777.976712] binder: 4721:4722 ioctl c0306201 20000200 returned -22 [ 777.983356] binder: 4715:4716 transaction failed 29201/-28, size 3786-0 line 3137 [ 777.991478] binder: BINDER_SET_CONTEXT_MGR already set 22:57:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xfffffffffffffffe) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f0000000040)) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f0000000080)={0x3, 0x5}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000000)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 778.003088] binder: 4721:4723 ioctl 40046207 0 returned -16 [ 778.007499] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.043188] binder: 4727:4730 got transaction with too large buffer 22:57:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) preadv(r1, &(0x7f0000000480)=[{&(0x7f0000000280)=""/106, 0x6a}, {&(0x7f0000000300)=""/83, 0x53}, {&(0x7f0000000380)=""/229, 0xe5}], 0x3, 0x20) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xc810020}, 0xc, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB='V\x00\x00o\x00', @ANYRES16=r4, @ANYBLOB="f31c2cbd7000fbdbdf250d000000380002000800080080000000080005009906000014000100317a23f10a22fa36eba8393d8b528bdf46f91448d92e8688da770cb00124336608000d0000000000080002004e23000024000200080007000300000008000e004e24000008000d000000e0ff07000d00020000000800760000f8fffffea7b633d4b56fbad808530c947923"], 0x78}, 0x1, 0x0, 0x0, 0x4002014}, 0x1000) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xb4, r4, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x42}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_TUN_TYPE={0x8, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2c}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x10}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@remote}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x200}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6_vti0\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x400}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}]}, 0xb4}, 0x1, 0x0, 0x0, 0x40}, 0x40) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000020000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 778.053233] binder: undelivered TRANSACTION_ERROR: 29189 22:57:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 778.074002] binder: 4727:4730 transaction failed 29201/-22, size 120-24 line 3295 [ 778.083989] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.102019] binder: undelivered TRANSACTION_COMPLETE [ 778.102758] binder: BINDER_SET_CONTEXT_MGR already set [ 778.102766] binder: 4735:4741 ioctl 40046207 0 returned -16 [ 778.103117] binder_alloc: 4735: binder_alloc_buf, no vma 22:57:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x9c, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="01634040020000000000000000000000000000000000000001000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="852a747000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00'/79], @ANYBLOB="4f0000000000000000000000000000001a0000000000000085616466000000000900000000000000000000000000000024000000000000008561646600000000020000000000000001000000000000004000000000000000"], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0e630c400200000000000000000000000463044003000000056304400300001063084000000000000000000e630c40000000000000000000000000066304400000000008631040030000000000000000000000000000001def062147c12dcf9442776cb082d1f52568a89074f9c895b1939dce878516c44acee49312fe57cac9c2bfc044c0abf4d06e9eb89d06d6b208327d64ed2ca817bea0cf4752f0f58263e18a02a8688c3f445a70f7e76ce4e535ceea8dea6eb163b14160a736773c49829b99bb31b7c5a8bbd256da9ced8070303e5972a088a6609834e227000767c3f57742ed799192052ca93bf77ccf178976b034d7b2e12aee97b15a0c422103319f316d936c654c065e55754584768604db0fbbd243f525a0"], 0x1f, 0x0, &(0x7f0000000100)="ea6b2aa60b2decb6b99f92c58e1303cfa90ee72ba1dbec11a1e748be74434c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:52 executing program 5: r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@isdn, 0xfffffffffffffffd, 0x100000) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket(0x1, 0x2, 0x0) getsockname$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r1, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r3}, 0x80, 0x0}}], 0x300, 0x0) ioctl$sock_SIOCADDRT(r0, 0x890b, &(0x7f0000000240)={0x0, @hci={0x1f, r3}, @vsock={0x28, 0x0, 0x0, @host}, @rc={0x1f, {0x81, 0x3, 0x98, 0x6, 0x5, 0x20}, 0x40}, 0x0, 0x0, 0x0, 0x0, 0x7d28, &(0x7f0000000080)='bridge_slave_0\x00', 0x2, 0x9, 0x3}) r4 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r5 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x4400) fcntl$F_SET_FILE_RW_HINT(r5, 0x40e, &(0x7f00000002c0)=0x3) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r8, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r8, 0x8004745a, &(0x7f0000000600)) getsockopt$netlink(r8, 0x10e, 0x1, &(0x7f0000000300)=""/141, &(0x7f00000003c0)=0x8d) r9 = fcntl$dupfd(r7, 0x0, r7) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000010000000000000e302000000000000000000000000000000000000000000000002000000000000"], 0x0, 0x0, 0x0}) [ 778.103156] binder: 4735:4741 transaction failed 29189/-3, size 0-0 line 3137 [ 778.125811] binder_alloc: 4731: binder_alloc_buf, no vma [ 778.125849] binder: 4731:4733 transaction failed 29189/-3, size 4096-0 line 3137 [ 778.135727] binder: BINDER_SET_CONTEXT_MGR already set [ 778.135740] binder: 4731:4733 ioctl 40046207 0 returned -16 [ 778.141057] binder: 4727:4745 transaction failed 29189/-22, size 120-24 line 3014 [ 778.169296] binder: BINDER_SET_CONTEXT_MGR already set 22:57:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 778.189122] binder: 4746:4749 ioctl 40046207 0 returned -16 [ 778.196025] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.203157] binder_alloc: 4734: binder_alloc_buf size 7022364366699068736 failed, no address space [ 778.216440] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.224614] binder: 4746:4756 got reply transaction with no transaction stack 22:57:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x80, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 778.234256] binder: 4753:4757 transaction failed 29189/-22, size 120-24 line 3014 [ 778.238814] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 778.238857] binder: 4734:4736 transaction failed 29201/-28, size 3786-0 line 3137 [ 778.253085] binder: 4755:4758 got transaction with too large buffer [ 778.253144] binder: 4755:4758 transaction failed 29201/-22, size 120-24 line 3295 [ 778.260696] binder: BINDER_SET_CONTEXT_MGR already set [ 778.260705] binder: 4755:4759 ioctl 40046207 0 returned -16 [ 778.261088] binder_alloc: 4755: binder_alloc_buf, no vma 22:57:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x80c, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 778.261127] binder: 4755:4759 transaction failed 29189/-3, size 120-24 line 3137 [ 778.293586] binder: BINDER_SET_CONTEXT_MGR already set [ 778.293594] binder: 4760:4762 ioctl 40046207 0 returned -16 [ 778.296588] binder_alloc: 4734: binder_alloc_buf, no vma [ 778.296628] binder: 4760:4762 transaction failed 29189/-3, size 3786-0 line 3137 [ 778.334595] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.341286] binder: BINDER_SET_CONTEXT_MGR already set [ 778.346622] binder: 4746:4756 transaction failed 29201/-71, size 104-24 line 2922 [ 778.354564] binder: 4763:4765 ioctl 40046207 0 returned -16 [ 778.358044] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.358178] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.363155] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.363559] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.363752] binder: undelivered transaction 3141, process died. 22:57:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'trusted.', 'selinux{\x00'}, &(0x7f0000000080)='/dev/binder#\x00', 0xd, 0x1) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) r3 = socket(0x1, 0x3, 0x0) ioctl$sock_ifreq(r3, 0x8932, &(0x7f0000000100)={'syz_tun\x00', @ifru_settings={0x1, 0x0, @fr_pvc=0x0}}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000780)={0xdc, r4, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x88, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x8, @local, 0x5}}}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb9a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8}]}]}, @TIPC_NLA_NET={0x40, 0x7, [@TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x101}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6825}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40004110}, 0x20008010) sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x114, r4, 0x0, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0xb8, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xef}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x79c1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5aed9e58}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x62}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}]}, @TIPC_NLA_SOCK={0x48, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80000001}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfdc}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x880}, 0x22008001) 22:57:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x203, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x104800) ioctl$BLKBSZSET(r4, 0x40081271, &(0x7f0000000140)=0x49) write(r3, &(0x7f0000000040)="31cdfffc1c70de0b70b9678134c68a6bee7908af237b2589abe3300464731fbb919ac2e0a58b9770ba6a432c9a838a337ff47e5f7f0808a58d3595ff1932de3812d2a6fb458225f56958193ce8", 0x4d) [ 778.394525] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.401394] binder: 4746:4756 got reply transaction with no transaction stack [ 778.410117] binder: 4746:4756 transaction failed 29201/-71, size 104-24 line 2922 [ 778.435716] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.441573] binder: 4768:4769 got transaction with invalid data ptr [ 778.468048] binder: 4768:4769 transaction failed 29201/-14, size 4096-0 line 3155 [ 778.473235] binder: 4771:4773 got transaction with invalid data ptr 22:57:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000240)={{{@in6=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@dev}}, &(0x7f0000000040)=0xe8) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) r9 = getuid() pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r11, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r10, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r12, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r14, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r13, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r15, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r17, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r16, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r18, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) r19 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r19, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r20) r21 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r21, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r22) getgroups(0x4, &(0x7f0000000080)=[0xffffffffffffffff, r20, 0xee01, r22]) r24 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r24, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r25) fsetxattr$system_posix_acl(r1, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000340)={{}, {0x1, 0x4}, [{0x2, 0x2, r2}, {0x2, 0x2, r5}, {0x2, 0x1, r8}, {0x2, 0xe, r9}, {0x2, 0x0, r12}, {0x2, 0xd4bf67f7cf918962, r15}, {0x2, 0xf, r18}], {0x4, 0x2}, [{0x8, 0x6, r23}, {0x8, 0x3, r25}], {}, {0x20, 0x6}}, 0x6c, 0xd9c0d685d32c1314) r26 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r26, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000015394f55815298aae8c01200000000000000000100000000000000000000000000000000000000260300"/76], 0x0, 0x0, 0x0}) 22:57:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 778.473294] binder: 4771:4773 transaction failed 29201/-14, size 3786-0 line 3155 [ 778.473533] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.476715] binder_alloc: 4771: binder_alloc_buf size -9122118629329043728 failed, no address space [ 778.476722] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 778.476758] binder: 4771:4773 transaction failed 29201/-28, size 3786-0 line 3137 [ 778.477090] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.521796] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.569091] binder: 4781:4782 transaction failed 29189/-22, size 120-24 line 3014 [ 778.579833] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.598058] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.599200] binder: BINDER_SET_CONTEXT_MGR already set [ 778.599208] binder: 4768:4775 ioctl 40046207 0 returned -16 22:57:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:57:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x5, 0x80, 0x0, 0x2, 0x5, 0x0, "87ee048d64fbb0927b968fc50d8d75ef36a743d42aad8db4a85df2b938c9973ac134f09aac3e06e66b05dacecf6e3a04859bf3f9b805acef1cb0d596dc5acb50", "ddbfcbbb98601a7c472492fa35e21082074b9af89ce56cd3d6f5ea75465b4da9a628ae93f1e35123718eb48704cb3061e706a0d21c0c67acc76488c51ce16c15", "079fcebe51d71bdc0a799e0d81ad77d582f3415943f772a5b750aabf9aeff102", [0x8, 0x4]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 778.686731] binder: 4787:4788 transaction failed 29189/-22, size 120-24 line 3014 [ 778.703484] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.726868] binder: 4789:4790 got transaction with invalid data ptr 22:57:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 778.741110] binder: 4789:4790 transaction failed 29201/-14, size 4096-0 line 3155 [ 778.760579] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.770425] binder_alloc: 4792: binder_alloc_buf, no vma [ 778.781379] binder: 4789:4794 got transaction with invalid data ptr 22:57:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 778.790358] binder: 4792:4793 transaction failed 29189/-3, size 120-24 line 3137 [ 778.803035] binder: 4789:4794 transaction failed 29201/-14, size 4096-0 line 3155 [ 778.810717] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.824955] binder: undelivered TRANSACTION_ERROR: 29201 [ 778.856874] binder_alloc: 4796: binder_alloc_buf, no vma [ 778.867116] binder: 4796:4797 transaction failed 29189/-3, size 120-24 line 3137 [ 778.884752] binder: undelivered TRANSACTION_ERROR: 29189 22:57:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f00000001c0)) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) r5 = socket(0x1, 0x3, 0x0) ioctl$sock_ifreq(r5, 0x8932, &(0x7f0000000100)={'syz_tun\x00', @ifru_settings={0x1, 0x0, @fr_pvc=0x0}}) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r5, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000780)={0xdc, r6, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x88, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x8, @local, 0x5}}}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb9a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8}]}]}, @TIPC_NLA_NET={0x40, 0x7, [@TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x101}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6825}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40004110}, 0x20008010) sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="10010000", @ANYRES16=r6, @ANYBLOB="800126bd7000ffdbdf25090000003400020008000200e0ffffff080001009bffffff08000200400000000400040004000400080001000700001508001400d4000000c800010038000400200001000a004e2300007fff00000000000000000000000000000000090000001400020002004e23e000000100000000000000000800030000000000100001007564703a73797a3200000000380004001400010002004e24000000070000000000000000200002000a004e2300000001fe800000000000000000000000000029ffffff7f2c00020008000300070000000800020000040000080003000114000008000300070000000800040001000000100001007564703a73797a3100000000"], 0x110}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = fcntl$dupfd(r7, 0x0, r7) syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x1000) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x17, 0x0, &(0x7f0000000000)=ANY=[@ANYRESOCT=r3], 0x0, 0x0, 0x0}) 22:57:53 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$KDGKBMODE(r3, 0x4b44, &(0x7f0000000040)) r4 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000efffffffffffffff0000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 779.174094] binder_alloc: 4804: binder_alloc_buf, no vma [ 779.182933] binder: 4803:4805 got transaction with invalid data ptr [ 779.193145] binder: 4804:4807 transaction failed 29189/-3, size 120-24 line 3137 [ 779.203446] binder: 4803:4805 transaction failed 29201/-14, size 3786-0 line 3155 [ 779.219089] binder: undelivered TRANSACTION_ERROR: 29189 22:57:53 executing program 2: mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:57:53 executing program 0: r0 = socket$inet6(0xa, 0x3, 0xce) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/dev_mcast\x00') sendfile(r0, r1, 0x0, 0x80000002) [ 779.229032] binder: undelivered TRANSACTION_ERROR: 29201 22:57:53 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r1 = gettid() ptrace$setopts(0x2103, r1, 0x1000001, 0x0) tkill(r1, 0x17) socket$netlink(0x10, 0x3, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) socket(0x11, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000640)={{0xa, 0x0, 0x7, @loopback, 0x8}, {0xa, 0x4e21, 0x0, @remote, 0x3}, 0x0, [0x0, 0x8, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x3]}, 0x5c) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0)={@local}, &(0x7f0000000300)=0x14) pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfb120eb7) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e24, 0x6, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x1d2, 0x0) mmap$perf(&(0x7f000000a000/0x4000)=nil, 0x4000, 0x4, 0x4000010, r2, 0x4) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setxattr$security_evm(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='security.evm\x00', &(0x7f0000000400)=@md5={0x1, "d8f1006d625a79f600"}, 0x11, 0x2) bind$inet(0xffffffffffffffff, 0x0, 0x0) r4 = open(0x0, 0x14102e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x180000f, 0x11, r4, 0x0) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000100)="39000000130003006900000000000000ab008048060000004600010707000014190001401000000800005068000000000000ef38bf461e59d7", 0x39}], 0x1) [ 779.375269] binder: BINDER_SET_CONTEXT_MGR already set [ 779.381000] binder: 4778:4785 ioctl 40046207 0 returned -16 22:57:53 executing program 2: mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:57:53 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket(0x1, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r0, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r2}, 0x80, 0x0}}], 0x300, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000240)={{{@in6=@local, @in=@dev={0xac, 0x14, 0x14, 0x24}, 0x4e24, 0x0, 0x4e20, 0x9, 0x2, 0x20, 0x0, 0x73, r2, r5}, {0x200, 0x1, 0x42, 0xffffffff, 0x7, 0x3, 0x8000, 0x100000001}, {0x10fdbba0, 0x7f, 0xff, 0x10ed}, 0xfffffff7, 0x0, 0x1, 0x0, 0x6, 0xce80b42ff15cd831}, {{@in=@broadcast, 0x4d6, 0x32}, 0x0, @in6=@rand_addr="24f9abffaa758e6e8f51f3580007c1e6", 0x3500, 0x0, 0x3, 0x7, 0x4, 0x3, 0x305}}, 0xe8) r6 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:53 executing program 2: mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 779.542905] binder: undelivered TRANSACTION_COMPLETE [ 779.566972] binder: BINDER_SET_CONTEXT_MGR already set [ 779.575814] binder: 4825:4826 ioctl 40046207 0 returned -16 22:57:53 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 779.613908] binder: undelivered transaction 3180, process died. 22:57:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0xb) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) statfs(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)=""/207) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r3, 0x0, r4, 0x0, 0x1003, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x12, 0x0, &(0x7f0000000140)=ANY=[@ANYRESHEX=r3], 0x0, 0x0, 0x0}) 22:57:53 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 779.737962] binder: 4838:4840 unknown command 808482864 [ 779.743407] binder: 4838:4840 ioctl c0306201 20000200 returned -22 22:57:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) r4 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r5, &(0x7f0000000640)=ANY=[], 0xffffff9c) ioctl$GIO_UNIMAP(r3, 0x4b66, &(0x7f0000000100)={0x3, &(0x7f0000000080)=[{}, {}, {}]}) recvmsg(r5, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) r6 = fcntl$dupfd(r4, 0x406, r5) ioctl$ASHMEM_GET_PROT_MASK(r6, 0x7706, &(0x7f0000000040)) 22:57:53 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r1 = gettid() ptrace$setopts(0x2103, r1, 0x1000001, 0x0) tkill(r1, 0x17) socket$netlink(0x10, 0x3, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) socket(0x11, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000640)={{0xa, 0x0, 0x7, @loopback, 0x8}, {0xa, 0x4e21, 0x0, @remote, 0x3}, 0x0, [0x0, 0x8, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x3]}, 0x5c) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0)={@local}, &(0x7f0000000300)=0x14) pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfb120eb7) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e24, 0x6, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x1d2, 0x0) mmap$perf(&(0x7f000000a000/0x4000)=nil, 0x4000, 0x4, 0x4000010, r2, 0x4) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setxattr$security_evm(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='security.evm\x00', &(0x7f0000000400)=@md5={0x1, "d8f1006d625a79f600"}, 0x11, 0x2) bind$inet(0xffffffffffffffff, 0x0, 0x0) r4 = open(0x0, 0x14102e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x180000f, 0x11, r4, 0x0) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000100)="39000000130003006900000000000000ab008048060000004600010707000014190001401000000800005068000000000000ef38bf461e59d7", 0x39}], 0x1) 22:57:53 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:57:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) timer_create(0x4, &(0x7f0000000100)={0x0, 0x36, 0x4, @thr={&(0x7f0000000000)="dab9cebbbce1e2ce5c8f4abde6083f4313bcd48016e29c051d9064c35e9df260ffaf44deb852049705c25472327a722d3be937f0563f088734d1738cf0c7ddd099e0886ed6065e4ac6cdc785e593330d740ac6986b256ffe109b85dbc5d6fb9f9ae32ee951ce1fec24103addb39cdb", &(0x7f0000000080)="0bfa31da5d61493803499c2ffdfd545b423f18f26ee726679cec1f512d525a6ac6"}}, &(0x7f00000001c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000140), &(0x7f0000000380)=0xfffffffffffffe1e) write$eventfd(r2, &(0x7f0000000300)=0x80000000, 0x8) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000001000000000000000000000024be5e8f000000000000000000000000000000000000000003000000000000000000000000000000d9235e771b26342d9c5c8c1780b33917cd67adaf61f9cc9c6685f73f2ea06df827ff"], 0x0, 0x0, 0x0}) 22:57:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r3 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) r4 = syz_open_dev$loop(&(0x7f00000007c0)='\x86\x00\x81\x00\x00\x00\x00\xe3\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r5 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r6 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r6}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x88, 0x0, &(0x7f0000000680)=[@dead_binder_done, @exit_looper, @acquire, @free_buffer={0x40086303, r3}, @increfs_done={0x40106308, 0x1}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/76, 0x4c, 0x2, 0x2f}, @fd={0x66642a85, 0x0, r4}, @fda={0x66646185, 0x9, 0x2, 0x15}}, &(0x7f0000000200)={0x0, 0x28, 0x40}}}, @free_buffer={0x40086303, r6}], 0x9b, 0x0, &(0x7f0000000300)="750d3c883d1a223604e9a5c636e19bd7e807ddf07f47411f77d8d7ca7b84b38415738c8322492e8059728d001d81d6218fedead86f462a13ae529143f880cfda75b8a299ece6068b85c46c19de8c4d54c6361b1b591acd311428ab996b215494001cc33ee7b08751691056b927c1b896bf955481960904a84a2baa74e2558a135f787108da1150ccecfe6747a7e2e90541ab6bb431d2021b27f9e0"}) r7 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r7, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) getsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@mcast2, @in6=@dev}}, {{@in=@multicast2}, 0x0, @in6=@empty}}, &(0x7f0000000640)=0xe8) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r8, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r8, 0x8004745a, &(0x7f0000000600)) write$selinux_context(r8, &(0x7f0000000780)='system_u:object_r:tun_tap_device_t:s0\x00', 0x26) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r9, 0x0, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$RNDZAPENTCNT(r9, 0x5204, &(0x7f0000000740)=0xf01) r10 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 780.011664] binder: 4849:4850 got transaction with invalid data ptr [ 780.025010] binder: 4849:4850 transaction failed 29201/-14, size 3786-0 line 3155 [ 780.049702] binder: undelivered TRANSACTION_ERROR: 29201 22:57:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634881000000330047662bfab3000000000000000000000000000000002880ef2a959ab6a961d5"], 0x0, 0x0, 0x0}) 22:57:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:57:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r4, 0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000300)=ANY=[@ANYBLOB="040000000000000000100000000000000500000000000000", @ANYRES32=r4, @ANYBLOB="000000000200"/28, @ANYRES32=r5, @ANYBLOB="000000000200"/28, @ANYRES32=r2, @ANYBLOB="00000000010400"/28, @ANYRES32=r6, @ANYBLOB="00000000fcffffffffffffff00"/28, @ANYRES32=r2, @ANYBLOB="000200000300"/28]) r7 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r7, 0x6, 0x16, &(0x7f0000000080)=[@timestamp, @window={0x3, 0x5, 0x4}, @timestamp, @timestamp, @mss={0x2, 0x787}, @timestamp], 0x6) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="116348bc4d1e6940952cc057bafe962e630b40000000000088889eba00000000000000000000000000000000a13144b16800000000000069d5"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r8, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r8, 0x8004745a, &(0x7f0000000600)) r9 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000140)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r8, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xa9140304}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x177, r9, 0x400, 0x70bd25, 0x25dfdbfb, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4020}, 0x2000000) [ 780.061392] binder_alloc: 4859: binder_alloc_buf, no vma [ 780.069820] binder: 4859:4860 transaction failed 29189/-3, size 120-24 line 3137 [ 780.087871] binder: undelivered TRANSACTION_ERROR: 29189 [ 780.092563] binder: 4862:4865 unknown command -2125962479 [ 780.092570] binder: 4862:4865 ioctl c0306201 20000200 returned -22 [ 780.122993] binder: 4857:4867 BC_FREE_BUFFER u0000000020ffc000 no match [ 780.146334] binder: BINDER_SET_CONTEXT_MGR already set [ 780.151329] binder: BINDER_SET_CONTEXT_MGR already set [ 780.151337] binder: 4869:4872 ioctl 40046207 0 returned -16 [ 780.154829] binder: BINDER_SET_CONTEXT_MGR already set [ 780.154836] binder: 4857:4867 ioctl 40046207 0 returned -16 [ 780.155019] binder: 4857:4867 BC_FREE_BUFFER u0000000020ffc000 no match [ 780.157683] binder: BINDER_SET_CONTEXT_MGR already set [ 780.157690] binder: 4857:4867 ioctl 40046207 0 returned -16 [ 780.204956] binder: 4869:4874 ioctl c0189436 20000300 returned -22 22:57:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 780.219625] binder: 4869:4874 unknown command -1136106735 [ 780.230728] binder: 4869:4874 ioctl c0306201 20000200 returned -22 [ 780.262098] binder: 4868:4871 ioctl 40046207 0 returned -16 22:57:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 780.325756] binder_alloc: 4879: binder_alloc_buf, no vma [ 780.340045] binder: 4879:4880 transaction failed 29189/-3, size 120-24 line 3137 [ 780.361058] binder: undelivered TRANSACTION_ERROR: 29189 22:57:54 executing program 0: r0 = socket$inet6(0xa, 0x100800000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @ipv4={[], [], @local}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='maps\x00') sendfile(r0, r1, 0x0, 0x88201) sendmmsg(r0, &(0x7f0000001f00), 0x3fffffffffffee5, 0x0) 22:57:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 780.411826] binder: 4882:4884 transaction failed 29189/-22, size 120-24 line 3014 [ 780.432985] binder: undelivered TRANSACTION_ERROR: 29189 22:57:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 780.489717] binder: 4888:4889 transaction failed 29189/-22, size 120-24 line 3014 [ 780.515473] binder: undelivered TRANSACTION_ERROR: 29189 22:57:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 780.583699] binder: 4891:4892 transaction failed 29189/-22, size 120-24 line 3014 [ 780.603777] binder: undelivered TRANSACTION_ERROR: 29189 22:57:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x4800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) [ 780.859806] binder: 4857:4858 BC_FREE_BUFFER u0000000020ffc000 no match [ 780.874610] binder: BINDER_SET_CONTEXT_MGR already set [ 780.882869] binder: 4857:4899 ioctl 40046207 0 returned -16 [ 780.888739] binder: undelivered TRANSACTION_COMPLETE [ 780.896952] binder: undelivered transaction 3199, process died. 22:57:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xd9255ade9b3e1969, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:57:54 executing program 0: r0 = socket$inet6(0xa, 0x100800000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @ipv4={[], [], @local}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='maps\x00') sendfile(r0, r1, 0x0, 0x88201) sendmmsg(r0, &(0x7f0000001f00), 0x3fffffffffffee5, 0x0) 22:57:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="116348400000000000060000000000000000000000000000010000000000000000000010517da96e51ddaa6712253b000000000000262300"/65], 0x0, 0x0, 0x0}) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0xa2be0b9d757b0196, 0x0) ioctl$KDSKBMETA(r2, 0x4b63, &(0x7f0000000040)=0x9) 22:57:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair(0x5, 0x1, 0x3, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8982, &(0x7f0000000100)={0x7, 'ip6erspan0\x00'}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000100c032480069d5aba0"], 0x0, 0x0, 0x0}) 22:57:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) socketpair(0x5, 0x6, 0x1, &(0x7f0000000000)={0xffffffffffffffff}) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x3a) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$packet(0x11, 0x3, 0x300) r8 = fcntl$dupfd(r6, 0x0, r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000340)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r8, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8c0060}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x68, r9, 0xf6b98f7d4236dc16, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x5}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_TIMEOUT={0xc}]}, 0x68}, 0x1, 0x0, 0x0, 0x40414}, 0x4000000) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r11, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r10, 0x0, r11, 0x0, 0x1003, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x42c00302}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x74, r9, 0x20, 0x70bd25, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x121}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x81}, @NBD_ATTR_SOCKETS={0xc, 0x7, [{0x8, 0x1, r11}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ptrace$cont(0x7, r5, 0x0, 0x0) fcntl$setownex(r4, 0xf, &(0x7f0000000040)={0x1, r5}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x79d) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) ioctl$BLKTRACESETUP(r12, 0xc0481273, &(0x7f0000000240)={[], 0x60, 0xfffff73b, 0x6, 0x3f, 0x4, r5}) r13 = gettid() ptrace$setopts(0x4206, r13, 0x0, 0x0) tkill(r13, 0x3b) ptrace$setregs(0xd, r13, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r13, 0x0, 0x0) getpgrp(r13) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x8, 0x0, &(0x7f0000000140), 0xfffffffffffffe6c, 0x0, 0x0}) [ 780.903646] binder: 4857:4858 BC_FREE_BUFFER u0000000020ffc000 no match [ 780.910977] binder: BINDER_SET_CONTEXT_MGR already set [ 780.916532] binder: 4857:4867 ioctl 40046207 0 returned -16 [ 780.924270] binder: undelivered TRANSACTION_COMPLETE [ 780.936425] binder: undelivered transaction 3201, process died. 22:57:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 780.984927] binder: 4908:4911 transaction failed 29201/-28, size 7470026273766079825-3876114 line 3137 [ 781.017264] binder: 4913:4920 transaction failed 29201/-28, size -2799731681207117463-24 line 3137 22:57:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000010000000000000e302000000ffff00"/76], 0x0, 0x0, 0x0}) 22:57:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 781.043399] binder_alloc: 4915: binder_alloc_buf size 41136 failed, no address space [ 781.049991] binder: undelivered TRANSACTION_ERROR: 29201 [ 781.067462] binder: 4908:4927 ioctl 4b63 20000040 returned -22 [ 781.082051] binder: undelivered TRANSACTION_ERROR: 29201 22:57:55 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000010000000000000e30200000000000000000000000000000000000000000000000000000000000021ceb136118b6150f8ad0a1e86fdb6dd14c69e419d180706a927ffe9e78feab8ea647cd64e43546b0c868cd8b05fde958b917f1fbba23f2013688a15a7768ddc6c97c2197f9c658560eecad3d637b721ec5cd79487d6a287091a0832e4970e6abfee3558212731a6fd9518eb3704e4b5f07b3060ef6f1d11960b517dd33435c812e0d1770de78c254c02447460896c767e3818c339e31da2acebea936f68dc356b37c52310822651a50fd39e43e429546f009d87201574dd475b0281dcd79817b036f224a3c7e11c6680b73994a89f82026032e1b6b52a90ac"], 0x0, 0x0, 0x0}) 22:57:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r5, 0x0, r6, 0x0, 0x1003, 0x0) fsetxattr$trusted_overlay_upper(r6, &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f0000000480)=ANY=[@ANYBLOB="00fbdb021b828d29e33c625fe3f3894dc40934bf5330736a2beeee4a1f3ae74024f0997f1de8055304000000b552b57cda2bf94194753da0a63ac95de219ed563c216c111459832583ceed154a4196f62c76642cc66a999f45f31acefca209684b0f87a2250104000000000000fef09ad67ad8f3d02f442f58831aaa10db2bacfffffffffffffffc80de924d064788c0f86d8e3b48cd021fde78a45e306c093fc5dabf9c7f3810dbda22d34490a9a59d00440ea49039e73e17264654d7ddb367e181a7a9e3caf875752eaf697bf9db0b230000000000a87bac7a000000000000000000"], 0xdb, 0x2) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000280)) r7 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) r8 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r8, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000240)={0x0, 0xf5cd44bb65385845, 0x101, 0x8}) [ 781.084975] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 781.085020] binder: 4915:4918 transaction failed 29201/-28, size 41131-0 line 3137 [ 781.096984] binder_alloc: 4929: binder_alloc_buf size 72056494526305000 failed, no address space [ 781.096992] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 781.097030] binder: 4929:4930 transaction failed 29201/-28, size 4096-72056494526300899 line 3137 22:57:55 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) write$FUSE_NOTIFY_DELETE(r1, &(0x7f0000000000)={0x36, 0x6, 0x0, {0x3, 0x6, 0xd, 0x0, '/dev/binder#\x00'}}, 0x36) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 781.155026] binder_alloc: 4913: binder_alloc_buf, no vma [ 781.160446] binder: BINDER_SET_CONTEXT_MGR already set [ 781.160454] binder: 4933:4935 ioctl 40046207 0 returned -16 [ 781.163853] binder_alloc: 4929: binder_alloc_buf, no vma [ 781.163892] binder: 4933:4935 transaction failed 29189/-3, size 4096-739 line 3137 [ 781.216872] binder: BINDER_SET_CONTEXT_MGR already set [ 781.220298] binder: BINDER_SET_CONTEXT_MGR already set [ 781.220306] binder: 4940:4942 ioctl 40046207 0 returned -16 [ 781.221444] binder_alloc: 4908: binder_alloc_buf, no vma [ 781.221481] binder: 4940:4942 transaction failed 29189/-3, size 0-0 line 3137 [ 781.224150] binder: BINDER_SET_CONTEXT_MGR already set [ 781.224157] binder: 4940:4945 ioctl 40046207 0 returned -16 [ 781.224559] binder_alloc: 4908: binder_alloc_buf, no vma 22:57:55 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$RTC_VL_CLR(r2, 0x7014) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:55 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) ioctl$TIOCEXCL(r3, 0x540c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 781.224598] binder: 4940:4945 transaction failed 29189/-3, size 0-0 line 3137 [ 781.228510] binder: undelivered TRANSACTION_ERROR: 29189 [ 781.228613] binder: undelivered TRANSACTION_ERROR: 29189 [ 781.228798] binder: undelivered TRANSACTION_ERROR: 29189 [ 781.229165] binder: undelivered TRANSACTION_ERROR: 29201 [ 781.294873] binder: 4913:4931 transaction failed 29189/-3, size -2799731681207117463-24 line 3137 [ 781.346247] binder: BINDER_SET_CONTEXT_MGR already set [ 781.357479] binder: 4953:4954 ioctl 40046207 0 returned -16 [ 781.364364] binder_alloc: 4913: binder_alloc_buf, no vma [ 781.370102] binder: 4953:4954 transaction failed 29189/-3, size 120-24 line 3137 [ 781.379600] binder: BINDER_SET_CONTEXT_MGR already set [ 781.380597] binder: 4939:4944 ioctl 40046207 0 returned -16 [ 781.390798] binder: undelivered TRANSACTION_ERROR: 29201 [ 781.404068] binder_alloc: 4950: binder_alloc_buf, no vma [ 781.408833] binder: 4953:4955 ioctl 40046207 0 returned -16 [ 781.409326] binder_alloc: 4913: binder_alloc_buf, no vma [ 781.409365] binder: 4953:4955 transaction failed 29189/-3, size 120-24 line 3137 [ 781.410904] binder: undelivered TRANSACTION_ERROR: 29189 [ 781.410969] binder: undelivered TRANSACTION_ERROR: 29189 [ 781.411245] binder: undelivered TRANSACTION_ERROR: 29189 [ 781.453831] binder: 4950:4956 transaction failed 29189/-3, size 4096-739 line 3137 22:57:55 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) socketpair(0x5, 0x6, 0x1, &(0x7f0000000000)={0xffffffffffffffff}) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x3a) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$packet(0x11, 0x3, 0x300) r8 = fcntl$dupfd(r6, 0x0, r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000340)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r8, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8c0060}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x68, r9, 0xf6b98f7d4236dc16, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x5}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_TIMEOUT={0xc}]}, 0x68}, 0x1, 0x0, 0x0, 0x40414}, 0x4000000) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r11, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r10, 0x0, r11, 0x0, 0x1003, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x42c00302}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x74, r9, 0x20, 0x70bd25, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x121}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x81}, @NBD_ATTR_SOCKETS={0xc, 0x7, [{0x8, 0x1, r11}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ptrace$cont(0x7, r5, 0x0, 0x0) fcntl$setownex(r4, 0xf, &(0x7f0000000040)={0x1, r5}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x79d) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) ioctl$BLKTRACESETUP(r12, 0xc0481273, &(0x7f0000000240)={[], 0x60, 0xfffff73b, 0x6, 0x3f, 0x4, r5}) r13 = gettid() ptrace$setopts(0x4206, r13, 0x0, 0x0) tkill(r13, 0x3b) ptrace$setregs(0xd, r13, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r13, 0x0, 0x0) getpgrp(r13) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x8, 0x0, &(0x7f0000000140), 0xfffffffffffffe6c, 0x0, 0x0}) 22:57:55 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 22:57:55 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) timer_create(0x0, &(0x7f0000000040)={0x0, 0x25, 0x2, @tid=r1}, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0xffffffffffffffee, 0x0, &(0x7f0000000140), 0xffffffffffffffcc, 0x0, 0x0}) 22:57:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f0000000040)={{0xa, 0x4e21, 0x3, @dev={0xfe, 0x80, [], 0xe}, 0xfff}, {0xa, 0x4e22, 0x5, @local, 0x101}, 0xa98, [0x1, 0x9, 0x0, 0x0, 0x1, 0x1, 0x7, 0x7]}, 0x5c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:55 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) io_setup(0x1, &(0x7f0000000000)=0x0) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0xc000) io_cancel(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x7, 0x7f, r2, &(0x7f0000000200)="1c7e9fdb72c14f86c9db0fc92f87f024fe36fb66764cae42c084b5c3e7fd87962773f928cb734af23cf49371d15cec8abed3ac5e6e030395bf88cc83d56806876ac3ee207452a2b24880e87a0798d546489b1e35274ac2ad79ab6060c61b4cd387ba478596ac5dd391fc5fc531e8e984e684f903178d387b71374d15c7e813dca4be734680597ab2a84110c67da3d9daed4cc6fc11574367ab0b1fc7cd07a85d8ce2229c634a1e7cee450cc55d3bdb00774dff70", 0xb4, 0x0, 0x0, 0x3, r3}, &(0x7f0000000180)) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x3e, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@fda={0x66646185, 0x3, 0x2, 0x9}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/6, 0x6, 0x2, 0x1}}, &(0x7f00000001c0)={0x0, 0x20, 0x42}}}], 0x0, 0x0, 0x0}) 22:57:55 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x8) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 781.545971] binder: 4959:4964 ioctl c0306201 0 returned -14 [ 781.560839] binder_alloc: 4962: binder_alloc_buf size 141828460383952 failed, no address space [ 781.582070] binder: 4966:4967 got transaction with invalid parent offset or type 22:57:55 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 22:57:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = geteuid() socket$inet(0x2, 0x4000000000000001, 0x0) setresgid(0x0, 0x0, 0x0) chown(&(0x7f0000000040)='./file0\x00', r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000080), &(0x7f0000000100)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) [ 781.586785] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 781.586828] binder: 4962:4965 transaction failed 29201/-28, size 3786-0 line 3137 [ 781.606961] binder: undelivered TRANSACTION_ERROR: 29201 [ 781.627964] binder: BINDER_SET_CONTEXT_MGR already set [ 781.633753] binder: undelivered TRANSACTION_COMPLETE [ 781.639048] binder: 4968:4971 ioctl 40046207 0 returned -16 [ 781.648406] binder: undelivered transaction 3228, process died. [ 781.655536] binder: 4973:4977 ioctl c0306201 0 returned -14 [ 781.657766] binder_alloc: 4976: binder_alloc_buf size 3175488 failed, no address space [ 781.657773] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 781.657809] binder: 4976:4978 transaction failed 29201/-28, size 3786-0 line 3137 [ 781.669719] binder: undelivered TRANSACTION_ERROR: 29201 22:57:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) write$binfmt_elf32(r0, &(0x7f0000000240)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0xc5, 0x1, 0x3c, 0x8, 0x3, 0x5a57d45290911404, 0x7e, 0x3dc, 0x38, 0x94, 0x5, 0x1, 0x20, 0x2, 0x800, 0x8, 0x100}, [{0x2, 0x1, 0x0, 0x8, 0x7, 0x1, 0x6, 0x3}, {0x3, 0x6, 0x5, 0x400, 0x1, 0x8, 0x200, 0x1}], "e1d9f60ec42224b7ba587a09e25156e9f640a4fb980c27574cad1b4d7be5bf560ff68f3bf463be45a9d5", [[], [], [], [], []]}, 0x5a2) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000001e0000000000000000000000000016e40b0000000000009f80d7000800000000"], 0x0, 0x0, 0x0}) 22:57:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_CHANGE_FD(r3, 0x4c06, r2) ioctl$LOOP_SET_STATUS64(r3, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) [ 781.669971] binder: 4966:4967 transaction failed 29201/-22, size 112-24 line 3259 [ 781.671645] binder: undelivered TRANSACTION_ERROR: 29201 [ 781.701648] binder: 4983:4984 got transaction to invalid handle [ 781.701656] binder: 4983:4984 transaction failed 29201/-22, size 0-0 line 3014 [ 781.701893] binder: undelivered TRANSACTION_ERROR: 29201 [ 781.706837] binder: 4968:4985 transaction failed 29189/-22, size 0-0 line 3014 [ 781.707179] binder: undelivered TRANSACTION_ERROR: 29189 [ 781.721135] binder: 4986:4987 got transaction with invalid data ptr [ 781.721192] binder: 4986:4987 transaction failed 29201/-14, size 3786-0 line 3155 [ 781.721447] binder: undelivered TRANSACTION_ERROR: 29201 22:57:56 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000000)) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x80004) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x8000000400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a576c7b14aa200000000000000"], 0x0, 0x0, 0x0}) 22:57:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='rose0\x00', 0x10) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) write$binfmt_elf64(r1, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0xfffffffffffffe63, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x100000000000036f, &(0x7f0000000200)=""/14, 0xff09}, 0x100) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000000, 0x20010, r1, 0x64e30000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:56 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) write$binfmt_elf32(r0, &(0x7f0000000240)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0xc5, 0x1, 0x3c, 0x8, 0x3, 0x5a57d45290911404, 0x7e, 0x3dc, 0x38, 0x94, 0x5, 0x1, 0x20, 0x2, 0x800, 0x8, 0x100}, [{0x2, 0x1, 0x0, 0x8, 0x7, 0x1, 0x6, 0x3}, {0x3, 0x6, 0x5, 0x400, 0x1, 0x8, 0x200, 0x1}], "e1d9f60ec42224b7ba587a09e25156e9f640a4fb980c27574cad1b4d7be5bf560ff68f3bf463be45a9d5", [[], [], [], [], []]}, 0x5a2) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000001e0000000000000000000000000016e40b0000000000009f80d7000800000000"], 0x0, 0x0, 0x0}) 22:57:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:57:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$KDDELIO(r4, 0x4b35, 0x302e) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x100000000) pipe(&(0x7f0000000080)) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') r6 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/load\x00', 0x2, 0x0) splice(r6, 0x0, r5, 0x0, 0x1003, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket(0x1, 0x2, 0x0) rt_sigreturn() getsockname$packet(r8, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r7, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r9}, 0x80, 0x0}}], 0x300, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x44, r9}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="116348400000001000000000000000000000000000000001000000b51c000069d5aba057ca0e2cf0e443e84fef52b84f0ce69be656c558b6988b488b35140777dc5404ff63457d6cca2c1328daa65b668b3c465c61cb8bef08d0129e0f372fead7020000000000000049b5f8e31f94dac846815cd4abb1db2bba6d2a008c77eb82b19039f1c272cd03ff13f8e312cca60bc1fb5cf7de21ba443f7516e9000000000000003619ddbba1cf19bc41d7a41cac06aaaec3dccf54c411630e34aeca811a00"/215], 0x0, 0x0, 0x0}) getsockopt$IP_VS_SO_GET_SERVICES(r7, 0x0, 0x482, &(0x7f0000000140)=""/2, &(0x7f0000000240)=0x2) 22:57:56 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x6, 0x81) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000240), &(0x7f0000000280)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000822a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) timer_create(0x4, &(0x7f0000000180)={0x0, 0x32, 0x4, @thr={&(0x7f0000000000)="df1cae8e28f566480f91b67426559b8843c00484edd3fd52ed6930a76580754b50e4f99a05accf82038de329e713cdf52f1f37a923f6d4473bdb727fb94be74dd29a7fa644365d259b087aaa5f881ef20f01eebe", &(0x7f0000000140)="2b0324686018bbd02f7f3a4b7fd3a875866399ca51d4f925"}}, &(0x7f0000000200)) 22:57:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000002d0000000000000000000000000100"/76], 0x0, 0x0, 0x0}) [ 782.133145] binder: undelivered TRANSACTION_ERROR: 29189 [ 782.161169] binder: 4996:5003 got transaction to invalid handle 22:57:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 782.192465] binder_alloc: 5008: binder_alloc_buf, no vma [ 782.203402] binder: 4996:5003 transaction failed 29201/-22, size 0-0 line 3014 [ 782.225515] binder: 5001:5015 got transaction with invalid offset (80, min 80 max 120) or object. [ 782.228404] binder: 5008:5011 transaction failed 29189/-3, size 0-0 line 3137 22:57:56 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)=@getspdinfo={0x54, 0x25, 0x1, 0x70bd27, 0x25dfdbfb, 0x80, [@coaddr={0x14, 0xe, @in6=@rand_addr="3c8cd38bcc940ecbb8d0cf4fbff8770f"}, @extra_flags={0x8, 0x18, 0x1000}, @lifetime_val={0x24, 0x9, {0x6, 0x9, 0x8, 0x9}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000040) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0xff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:57:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket(0x3, 0x14, 0xf6) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000100)={{{@in6=@mcast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@initdev}}, &(0x7f0000000040)=0xe8) bind$packet(r2, &(0x7f0000000080)={0x11, 0xf6, r4, 0x1, 0x1, 0x6, @local}, 0x14) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:56 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 782.228966] binder: undelivered TRANSACTION_ERROR: 29189 [ 782.240057] binder: release 5012:5018 transaction 3249 out, still active [ 782.240061] binder: undelivered TRANSACTION_COMPLETE [ 782.242318] binder: send failed reply for transaction 3249, target dead [ 782.269644] binder: release 5012:5021 transaction 3252 out, still active 22:57:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/der#\x00', 0x0, 0x2) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) ftruncate(r0, 0x4) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0xfffffffffffffff7) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz1\x00', 0x200002, 0x0) write(r2, &(0x7f0000000080)="f405b8ad27b6fd630ae2363f75ef336ebc3f7a0a5892941fc253cceffe4000466498673b613c87ed01a66b060164db68d6ab29dccb687b4179fa3d6cae55bfef4033", 0x42) r3 = socket$inet(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r3, &(0x7f0000000700)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000000040)=0x1a, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r3, &(0x7f0000000500)="00abe6d29e6101cb8b41eea5cf2e67fea541e9b7b65fe42e517d5f81d2919e1b2f4cf7f77a16fc3e961a0847916c7c2d9b77cd3160567341263cf19b3b2c6177e7065dda850c756c06aede12e9da8118bb5464ad07fa6146f6903ee57345cbd7551f547bdbe947b4f9a0b28cf29a28eda534fc6e2c9bf2c36c87da9ad79e6e7090", 0x4202692d7f740df1, 0x4000801, 0x0, 0xfffffffffffffeda) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) getpgid(0xffffffffffffffff) syz_open_procfs(0x0, 0x0) fchdir(0xffffffffffffffff) open(0x0, 0x0, 0x0) syz_genetlink_get_family_id$nbd(0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0) creat(0x0, 0x0) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000040)={'bcsh0\x00', @ifru_ivalue}) mmap(&(0x7f0000be4000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 782.325987] binder: undelivered TRANSACTION_COMPLETE [ 782.336499] binder_alloc: 5022: binder_alloc_buf size 4840 failed, no address space [ 782.351537] binder: BINDER_SET_CONTEXT_MGR already set [ 782.356287] binder: BINDER_SET_CONTEXT_MGR already set [ 782.356296] binder: 5028:5036 ioctl 40046207 0 returned -16 [ 782.361156] binder: BINDER_SET_CONTEXT_MGR already set 22:57:56 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r3 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) r4 = syz_open_dev$loop(&(0x7f00000007c0)='\x86\x00\x81\x00\x00\x00\x00\xe3\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r5 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r6 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r6}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x88, 0x0, &(0x7f0000000680)=[@dead_binder_done, @exit_looper, @acquire, @free_buffer={0x40086303, r3}, @increfs_done={0x40106308, 0x1}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/76, 0x4c, 0x2, 0x2f}, @fd={0x66642a85, 0x0, r4}, @fda={0x66646185, 0x9, 0x2, 0x15}}, &(0x7f0000000200)={0x0, 0x28, 0x40}}}, @free_buffer={0x40086303, r6}], 0x9b, 0x0, &(0x7f0000000300)="750d3c883d1a223604e9a5c636e19bd7e807ddf07f47411f77d8d7ca7b84b38415738c8322492e8059728d001d81d6218fedead86f462a13ae529143f880cfda75b8a299ece6068b85c46c19de8c4d54c6361b1b591acd311428ab996b215494001cc33ee7b08751691056b927c1b896bf955481960904a84a2baa74e2558a135f787108da1150ccecfe6747a7e2e90541ab6bb431d2021b27f9e0"}) r7 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r7, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) getsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@mcast2, @in6=@dev}}, {{@in=@multicast2}, 0x0, @in6=@empty}}, &(0x7f0000000640)=0xe8) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r8, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r8, 0x8004745a, &(0x7f0000000600)) write$selinux_context(r8, &(0x7f0000000780)='system_u:object_r:tun_tap_device_t:s0\x00', 0x26) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r9, 0x0, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$RNDZAPENTCNT(r9, 0x5204, &(0x7f0000000740)=0xf01) r10 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 782.361163] binder: 5035:5037 ioctl 40046207 0 returned -16 [ 782.385137] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 782.394472] binder: 5022:5031 transaction failed 29201/-28, size 4096-739 line 3137 [ 782.404688] binder_alloc: 5016: binder_alloc_buf, no vma [ 782.410729] binder: undelivered TRANSACTION_ERROR: 29201 [ 782.417264] binder: send failed reply for transaction 3252, target dead [ 782.424683] binder: 5027:5034 ioctl 40046207 0 returned -16 [ 782.427751] binder: 5001:5015 transaction failed 29201/-22, size 120-24 line 3199 [ 782.432779] binder: BINDER_SET_CONTEXT_MGR already set [ 782.432786] binder: 5001:5015 ioctl 40046207 0 returned -16 [ 782.434098] binder: undelivered TRANSACTION_ERROR: 29201 [ 782.439954] binder: 5038:5044 BC_FREE_BUFFER u0000000020ffc000 no match [ 782.441019] binder: BINDER_SET_CONTEXT_MGR already set [ 782.441026] binder: 5038:5044 ioctl 40046207 0 returned -16 22:57:56 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000480)=""/219, 0xdb}, {&(0x7f0000000340)=""/88, 0x58}, {&(0x7f00000003c0)=""/36, 0x24}, {&(0x7f0000000600)=""/220, 0xdc}], 0x4) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @fd, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16, 0x0, 0x1}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}}], 0x0, 0x0, 0x0}) r3 = fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) ioctl$LOOP_CHANGE_FD(r3, 0x4c06, 0xffffffffffffffff) syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r4, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x48, r5, 0x800, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x20}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x20004800}, 0x800) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/enforce\x00', 0x40, 0x0) [ 782.441129] binder: 5038:5044 BC_FREE_BUFFER u0000000020ffc000 no match [ 782.442479] binder: BINDER_SET_CONTEXT_MGR already set [ 782.442486] binder: 5038:5044 ioctl 40046207 0 returned -16 [ 782.456278] binder: 5001:5015 transaction failed 29189/-22, size 120-24 line 3014 [ 782.456795] binder: undelivered TRANSACTION_ERROR: 29189 [ 782.484689] binder: 5049:5050 got transaction with fd, -1, but target does not allow fds [ 782.485063] binder: 5049:5050 transaction failed 29201/-1, size 104-24 line 3241 [ 782.497530] binder: undelivered TRANSACTION_ERROR: 29201 22:57:56 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x1, 0x0, 0x91, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/access\x00', 0x2, 0x0) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r3, 0x0, r4, 0x0, 0x1003, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000140)={@ipv4={[], [], @broadcast}, 0x80, 0x1, 0x3, 0x8, 0x1, 0x800}, 0x20) getsockopt$packet_int(r1, 0x107, 0x10, &(0x7f0000000000), &(0x7f0000000040)=0x4) r5 = syz_open_dev$binderN(0x0, 0x0, 0x802) r6 = getpgid(0xffffffffffffffff) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f0000000740)=r6) pipe(&(0x7f0000000080)={0xffffffffffffffff}) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0xb7e) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf32(r0, &(0x7f00000001c0)={{0x7f, 0x45, 0x4c, 0x46, 0x7, 0x8, 0x0, 0xb7, 0x3, 0x3, 0x6, 0xffff0001, 0x11d, 0x38, 0x117, 0xffffffff, 0x1, 0x20, 0x1, 0x0, 0x9, 0x64c}, [{0x5, 0x1, 0x40, 0x7dcb, 0x5, 0x4, 0x4, 0xb3}], "12dec41aa7d28163"}, 0x60) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0xffffffffffffffc1) splice(r7, 0x0, r8, 0x0, 0x1003, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYRES64], 0x0, 0x0, 0x0}) 22:57:56 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x6c, 0x0, &(0x7f0000000380)=[@clear_death={0x400c630f, 0x2}, @enter_looper, @request_death, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@flat=@handle={0x73682a85, 0x101}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/117, 0x75, 0x2, 0x37}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/176, 0xb0, 0x0, 0x6}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}}, @register_looper], 0x7c, 0x0, &(0x7f0000000400)="534c8911e636f8f899278ab31001e3b1d53aaef54bc4a9216081220ab8e1c7754e90e4bc90231f762b5dd5842dc1ba4bc6970069c57bd63d892774a56192491b79f52a9e6ed309ddb2e70df1cf6a19373bdaeb6903decca6ed5d8447ace682f728c324d53d84ede7a9ed692f2276e55a14510ef0a8036d25ef535200"}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f00000001c0)={0xff00, 0x9, 0x5, 0x7, 0x8001, 0x6}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) [ 782.521676] binder: 5049:5053 got transaction with fd, -1, but target does not allow fds [ 782.521735] binder: 5049:5053 transaction failed 29201/-1, size 104-24 line 3241 [ 782.525465] binder: undelivered TRANSACTION_ERROR: 29201 [ 782.550594] binder: 5028:5043 transaction failed 29189/-3, size 3786-0 line 3137 [ 782.554174] binder: undelivered TRANSACTION_ERROR: 29201 22:57:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) [ 782.601244] binder_alloc: 5061: binder_alloc_buf size 4840 failed, no address space [ 782.613372] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 782.635684] binder: 5061:5062 transaction failed 29201/-28, size 4096-739 line 3137 22:57:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) 22:57:56 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x7d}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r4, 0xffffffffffffffff, 0x0, 0x0) r5 = fcntl$dupfd(r4, 0x406, r1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, 0x0, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0xfffffffffffffd05, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$EXT4_IOC_SWAP_BOOT(r7, 0x6611) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x421, 0x0) [ 782.649151] binder: undelivered TRANSACTION_ERROR: 29201 22:57:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000001c0)}}], 0x0, 0x0, 0x0}) [ 782.696596] binder: 5059:5064 unknown command -1 [ 782.701903] binder: 5059:5064 ioctl c0306201 20000080 returned -22 [ 782.744199] binder: 5080:5082 got transaction with invalid offset (0, min 0 max 0) or object. [ 782.765377] binder: 5080:5082 transaction failed 29201/-22, size 0-24 line 3199 [ 782.782944] binder: undelivered TRANSACTION_ERROR: 29201 22:57:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000080)={0x1, 0x1f, 0x4, 0x1ff, 0x6, 0x40, 0x1, 0x7f, 0x1, 0x1f}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='pids.current\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000140)={{0x8, 0x100, 0x7f, 0x7c00}, 'syz0\x00', 0x6}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 783.150606] binder: undelivered TRANSACTION_ERROR: 29189 [ 783.181390] binder_alloc: 5097: binder_alloc_buf size 7022364366699068736 failed, no address space 22:57:57 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:57:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000001c0)}}], 0x0, 0x0, 0x0}) 22:57:57 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) write$P9_RXATTRCREATE(r4, &(0x7f0000000040)={0x3ba}, 0x7) r5 = socket(0x11, 0x3, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000280)="a933fb23", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r6 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r7, &(0x7f0000000200)=""/250, 0x50c7e3e3) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) ioctl$PPPIOCGFLAGS1(r7, 0x8004745a, &(0x7f0000000600)) ioctl$RTC_IRQP_READ(r7, 0x8008700b, &(0x7f0000000080)) r8 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r8, 0x0) read(r8, &(0x7f0000000180)=""/19, 0xfffffe47) sendfile(r5, r6, 0x0, 0x4e68d5f8) getuid() ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000680a137e99aa26c3dd8f599afe92ef960000000000000000000000000000000000100000000000000200000000000000000000000000000000000300"/83], 0x0, 0x0, 0x0}) 22:57:57 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket(0x3, 0x14, 0xf6) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000100)={{{@in6=@mcast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@initdev}}, &(0x7f0000000040)=0xe8) bind$packet(r2, &(0x7f0000000080)={0x11, 0xf6, r4, 0x1, 0x1, 0x6, @local}, 0x14) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) 22:57:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000069d5aba057ca0e"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, &(0x7f0000000040)=0x6) [ 783.195436] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 783.207622] binder: 5097:5098 transaction failed 29201/-28, size 3786-0 line 3137 [ 783.219474] binder: undelivered TRANSACTION_ERROR: 29201 22:57:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x7d}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r4, 0xffffffffffffffff, 0x0, 0x0) r5 = fcntl$dupfd(r4, 0x406, r1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, 0x0, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0xfffffffffffffd05, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$EXT4_IOC_SWAP_BOOT(r7, 0x6611) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x421, 0x0) 22:57:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000001c0)}}], 0x0, 0x0, 0x0}) [ 783.259948] binder: 5106:5109 got transaction with invalid data ptr [ 783.270845] binder: 5105:5112 got transaction with invalid offset (0, min 0 max 0) or object. [ 783.280179] binder: 5106:5109 transaction failed 29201/-14, size 3786-0 line 3155 [ 783.290062] binder: undelivered TRANSACTION_COMPLETE [ 783.291072] binder: 5105:5112 transaction failed 29201/-22, size 0-24 line 3199 22:57:57 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000003a40)={{{@in6=@loopback, @in=@multicast2}}, {{@in6=@initdev}, 0x0, @in6=@local}}, &(0x7f0000003b40)=0xfffffffffffffe50) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000004bf9316f9e39d4ff00000000000000000000000100"/84], 0x0, 0x0, 0x0}) accept$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) [ 783.317095] binder: BINDER_SET_CONTEXT_MGR already set [ 783.324104] binder: 5104:5115 got transaction with invalid data ptr [ 783.334460] binder: undelivered TRANSACTION_ERROR: 29201 [ 783.337559] binder: 5111:5116 ioctl 40046207 0 returned -16 [ 783.350898] binder: BINDER_SET_CONTEXT_MGR already set [ 783.360562] binder: 5104:5115 transaction failed 29201/-14, size 3786-0 line 3155 [ 783.371538] binder: BINDER_SET_CONTEXT_MGR already set [ 783.377649] binder: 5119:5122 ioctl 40046207 0 returned -16 [ 783.384041] binder: 5120:5124 ioctl 40046207 0 returned -16 [ 783.393181] binder: undelivered TRANSACTION_ERROR: 29201 [ 783.394338] binder: BINDER_SET_CONTEXT_MGR already set [ 783.394345] binder: 5125:5126 ioctl 40046207 0 returned -16 [ 783.395586] binder_alloc: 5111: binder_alloc_buf, no vma 22:57:57 executing program 1: mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x202000, 0x8) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000040)=0x1) [ 783.395624] binder: 5125:5126 transaction failed 29189/-3, size 0-0 line 3137 [ 783.403749] binder: BINDER_SET_CONTEXT_MGR already set [ 783.403757] binder: 5125:5128 ioctl 40046207 0 returned -16 [ 783.404608] binder_alloc: 5111: binder_alloc_buf, no vma [ 783.404919] binder: 5125:5128 transaction failed 29189/-3, size 0-0 line 3137 [ 783.449745] binder: 5107:5131 got transaction to invalid handle [ 783.449830] binder: undelivered TRANSACTION_ERROR: 29189 [ 783.449946] binder: undelivered TRANSACTION_ERROR: 29189 22:57:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:57 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="40543e75f5bb03000000e075148c0f34"], 0x10}}, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x40020000000c) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8982, &(0x7f0000000140)={0x6, 'sit0\x00', {0x8}, 0x2}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) ioctl$sock_inet6_udp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000001000000000000000000d0c5906800000000000000000000000000000000000000000000000000000000080000000000000000e9ffffff00e3f3b902788b3ff4d91d261ce7c095d86f68f939c8ecdb9e79a40617d481f90717eceef2368ce2c0d8b1fb0d8b719acd2527fe8fe76245cfb850f006d3e70b5eaee3b7d98661a2882e78fb"], 0x0, 0x0, 0x0}) [ 783.456913] binder: undelivered transaction 3285, process died. [ 783.504910] binder: release 5138:5139 transaction 3291 out, still active [ 783.526169] binder: undelivered TRANSACTION_COMPLETE [ 783.538355] binder: send failed reply for transaction 3291, target dead [ 783.542943] binder: 5107:5131 transaction failed 29201/-22, size 268435456-131072 line 3014 [ 783.570213] binder_alloc: 5142: binder_alloc_buf size 2151018850806137536 failed, no address space [ 783.583901] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) [ 783.594826] binder: 5144:5144 transaction failed 29201/-28, size 0-0 line 3137 [ 783.604848] binder: undelivered TRANSACTION_ERROR: 29201 22:57:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) pipe2(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0)='devlink\x00') sendmsg$DEVLINK_CMD_GET(r1, &(0x7f00000004c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000300)={0xf8, r2, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, @nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x40450}, 0x10020800) r3 = open(&(0x7f0000000000)='./file0\x00', 0x21c101, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r3, &(0x7f0000000040)={0x28, 0x2, 0x0, {0x5, 0x400, 0xffff}}, 0x28) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r5, 0x0, r6, 0x0, 0x1003, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r5, 0xc018620c, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:57:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 784.027198] binder: release 5152:5154 transaction 3296 out, still active [ 784.041193] binder: undelivered TRANSACTION_COMPLETE [ 784.053015] binder: send failed reply for transaction 3296, target dead [ 784.073608] binder: release 5153:5158 transaction 3298 out, still active [ 784.086540] binder: undelivered TRANSACTION_COMPLETE [ 784.097878] binder: send failed reply for transaction 3298, target dead [ 784.105106] binder: undelivered TRANSACTION_ERROR: 29201 [ 784.111085] binder: 5157:5159 got transaction with too large buffer [ 784.116750] binder: undelivered TRANSACTION_ERROR: 29201 22:57:58 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000280)={0x0, 0xfb, 0x9b, 0xc, 0x5, "4d548eff1d8e6396ada99107259c04e8", "0d327a4a38587faca4b3812dd125726c07304b44163f1f90a0be7bb563241b536a21f137f084c177cfddb66ddb53ea837222ffce59610ac19ad9604034b2a6e02695b01d3909c73e3baf0cf6cb640ee0734dc7289acb0f05dc1b1a14340e4c4e176d8b1a35a94f6eadf3b5067e3dc4fe990a5a55097b9029738b850ecd860ae8d1408e5a6994"}, 0x9b, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) r4 = dup3(r1, r3, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="11634840000000000000000000000000a3000000000000000000000000000000000000000010000000000000e30200"/76], 0x0, 0x0, 0x0}) 22:57:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000100000200"/70], 0x0, 0x0, 0x0}) 22:57:58 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="40543e75f5bb03000000e075148c0f34"], 0x10}}, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x40020000000c) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8982, &(0x7f0000000140)={0x6, 'sit0\x00', {0x8}, 0x2}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) ioctl$sock_inet6_udp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000001000000000000000000d0c5906800000000000000000000000000000000000000000000000000000000080000000000000000e9ffffff00e3f3b902788b3ff4d91d261ce7c095d86f68f939c8ecdb9e79a40617d481f90717eceef2368ce2c0d8b1fb0d8b719acd2527fe8fe76245cfb850f006d3e70b5eaee3b7d98661a2882e78fb"], 0x0, 0x0, 0x0}) 22:57:58 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000001c0)}}], 0x0, 0x0, 0x0}) 22:57:58 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 784.127449] binder: 5157:5159 transaction failed 29201/-22, size 120-24 line 3295 [ 784.148649] binder: undelivered TRANSACTION_ERROR: 29201 [ 784.155539] binder: BINDER_SET_CONTEXT_MGR already set [ 784.165715] binder: release 5164:5170 transaction 3302 out, still active 22:57:58 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x0, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, 0x0}}], 0x0, 0x0, 0x0}) 22:57:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xffffffffffffff69, 0x0, &(0x7f0000000140)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/46, 0x0, 0x2, 0x19}, @fda={0x66646185, 0xa, 0x1, 0x16}, @flat=@binder={0x73622a85, 0x900, 0x1}}, &(0x7f0000000080)}, 0x400}], 0x0, 0x0, 0x0}) [ 784.171347] binder: BINDER_SET_CONTEXT_MGR already set [ 784.171357] binder: 5164:5179 ioctl 40046207 0 returned -16 [ 784.174746] binder: 5157:5168 ioctl 40046207 0 returned -16 [ 784.199076] binder: 5165:5176 got transaction with invalid offset (0, min 0 max 0) or object. 22:57:58 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000140)=""/151, &(0x7f0000000000)=0x97) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) sendmsg$key(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000480)={0x2, 0x2, 0x1, 0x8, 0xc, 0x0, 0x70bd2b, 0x25dfdbfd, [@sadb_x_nat_t_type={0x1, 0x14, 0x8}, @sadb_ident={0x2, 0xb, 0x3, 0x0, 0x3ff}, @sadb_x_filter={0x5, 0x1a, @in=@multicast1, @in6=@empty, 0xc, 0x4, 0x95d669ca77d1e03c}, @sadb_sa={0x2, 0x1, 0x4d6, 0x3, 0x3f, 0x69, 0x1, 0x120000000}]}, 0x60}}, 0x1) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000200)={0x0, '\x00', {}, 0xff80}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r5 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r5) add_key$keyring(0x0, 0x0, 0x0, 0x0, r5) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r5) keyctl$get_security(0x11, r5, &(0x7f0000000500)=""/83, 0x53) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r6, 0x0, 0x1003, 0x0) ioctl$EVIOCSKEYCODE(r4, 0x40084504, &(0x7f0000000040)=[0x1, 0x3]) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f00000007c0)=ANY=[@ANYBLOB="03000000000000000a004e2200000004fe8000000000000000000000000000bb030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000020000000a004e2400000006ff020000000000000000000000000001370b00000000000000000000000000000000000000000000000000000000b4c9975a146635ba00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e200000000672d0d2825fa52238c8bef39ae5aa008356770b790000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000046da52a5789b7dddb9fad4a300"/420], 0x190) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="48342060b3f6c1b1535f0ff7502194aa104bf5"], @ANYBLOB="160000000000000000000000000000000000020000000000"], @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000002800000000000000500000000000000029b37f3b4e3b958ef8476656118a6c84dfa225117e686f49b2f012d01a2924c06c55995a8e267723e7054ab9dec2cf2c5ac8c7063fa61841cf6c97ca002dcd72e62db021ff3db7d5a1fc7b13a0b831767c54db7841cb0825bbf7431fbc7e79c5eb71aef325a37f9e4a13aa694bc010d43b95560801faa19abc859f959f6740dd68426282fcb76b16f8293af25d59f7dff8ae"]], 0x0, 0x0, 0x0}) [ 784.232045] binder: 5165:5176 transaction failed 29201/-22, size 0-24 line 3199 [ 784.251076] binder: BINDER_SET_CONTEXT_MGR already set [ 784.258101] binder: BINDER_SET_CONTEXT_MGR already set 22:57:58 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) write$P9_RXATTRCREATE(r4, &(0x7f0000000040)={0x3ba}, 0x7) r5 = socket(0x11, 0x3, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000280)="a933fb23", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r6 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r7, &(0x7f0000000200)=""/250, 0x50c7e3e3) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) ioctl$PPPIOCGFLAGS1(r7, 0x8004745a, &(0x7f0000000600)) ioctl$RTC_IRQP_READ(r7, 0x8008700b, &(0x7f0000000080)) r8 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r8, 0x0) read(r8, &(0x7f0000000180)=""/19, 0xfffffe47) sendfile(r5, r6, 0x0, 0x4e68d5f8) getuid() ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000680a137e99aa26c3dd8f599afe92ef960000000000000000000000000000000000100000000000000200000000000000000000000000000000000300"/83], 0x0, 0x0, 0x0}) 22:57:58 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x0, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, 0x0}}], 0x0, 0x0, 0x0}) [ 784.279584] binder: 5181:5189 ioctl 40046207 0 returned -16 [ 784.287717] binder: BINDER_SET_CONTEXT_MGR already set [ 784.290218] binder: 5188:5191 ioctl 40046207 0 returned -16 [ 784.292513] binder: undelivered TRANSACTION_COMPLETE [ 784.292666] binder: undelivered TRANSACTION_ERROR: 29201 [ 784.316519] binder: 5174:5196 ioctl 8912 400200 returned -22 [ 784.323459] binder: BINDER_SET_CONTEXT_MGR already set [ 784.340294] binder: 5188:5194 ioctl 40046207 0 returned -16 [ 784.352398] binder_alloc: 5174: binder_alloc_buf size 4840 failed, no address space [ 784.353769] binder: BINDER_SET_CONTEXT_MGR already set [ 784.353776] binder: 5199:5202 ioctl 40046207 0 returned -16 [ 784.365800] binder: release 5167:5172 transaction 3304 out, still active [ 784.365803] binder: undelivered TRANSACTION_COMPLETE [ 784.365913] binder: send failed reply for transaction 3304, target dead 22:57:58 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x0, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, 0x0}}], 0x0, 0x0, 0x0}) [ 784.371558] binder: send failed reply for transaction 3302, target dead [ 784.395960] binder: 5190:5193 ioctl 40046207 0 returned -16 [ 784.428370] binder: 5199:5205 got transaction to invalid handle [ 784.439664] binder: BINDER_SET_CONTEXT_MGR already set [ 784.451606] binder: 5199:5205 transaction failed 29201/-22, size 268435456-131072 line 3014 [ 784.466830] binder: 5207:5208 ioctl 40046207 0 returned -16 [ 784.469307] binder: release 5203:5204 transaction 3311 out, still active [ 784.469311] binder: undelivered TRANSACTION_COMPLETE [ 784.469498] binder: send failed reply for transaction 3311, target dead 22:57:58 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x0, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, 0x0}}], 0x0, 0x0, 0x0}) [ 784.539198] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 784.578566] binder: 5174:5196 transaction failed 29201/-28, size 4096-739 line 3137 [ 784.598314] binder: undelivered TRANSACTION_ERROR: 29201 [ 784.605077] binder: BINDER_SET_CONTEXT_MGR already set [ 784.611299] binder: 5174:5177 ioctl 40046207 0 returned -16 [ 784.619896] binder: release 5213:5214 transaction 3314 out, still active [ 784.631154] binder: undelivered TRANSACTION_COMPLETE 22:57:58 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) write$P9_RXATTRCREATE(r4, &(0x7f0000000040)={0x3ba}, 0x7) r5 = socket(0x11, 0x3, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000280)="a933fb23", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r6 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r7, &(0x7f0000000200)=""/250, 0x50c7e3e3) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) ioctl$PPPIOCGFLAGS1(r7, 0x8004745a, &(0x7f0000000600)) ioctl$RTC_IRQP_READ(r7, 0x8008700b, &(0x7f0000000080)) r8 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r8, 0x0) read(r8, &(0x7f0000000180)=""/19, 0xfffffe47) sendfile(r5, r6, 0x0, 0x4e68d5f8) getuid() ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000680a137e99aa26c3dd8f599afe92ef960000000000000000000000000000000000100000000000000200000000000000000000000000000000000300"/83], 0x0, 0x0, 0x0}) 22:57:58 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r3, 0x0, r4, 0x0, 0x1003, 0x0) getdents(r3, &(0x7f0000000000)=""/25, 0x19) r5 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) [ 784.643282] binder: send failed reply for transaction 3314, target dead [ 784.753268] binder: 5217:5223 got transaction to invalid handle [ 784.759390] binder: 5217:5223 transaction failed 29201/-22, size 268435456-131072 line 3014 [ 785.149369] binder: undelivered TRANSACTION_ERROR: 29201 [ 785.499591] binder: undelivered TRANSACTION_ERROR: 29201 22:58:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="40543e75f5bb03000000e075148c0f34"], 0x10}}, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x40020000000c) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8982, &(0x7f0000000140)={0x6, 'sit0\x00', {0x8}, 0x2}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) ioctl$sock_inet6_udp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000001000000000000000000d0c5906800000000000000000000000000000000000000000000000000000000080000000000000000e9ffffff00e3f3b902788b3ff4d91d261ce7c095d86f68f939c8ecdb9e79a40617d481f90717eceef2368ce2c0d8b1fb0d8b719acd2527fe8fe76245cfb850f006d3e70b5eaee3b7d98661a2882e78fb"], 0x0, 0x0, 0x0}) 22:58:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcb472f53fb73c375, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$RTC_PIE_ON(r3, 0x7005) 22:58:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) setxattr$security_evm(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='security.evm\x00', &(0x7f0000000240)=@v2={0x5, 0x3, 0xf, 0x2045, 0x6, "0b6f9ad57966"}, 0x10, 0x1) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x100, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) r4 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r5}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1c, 0x0, &(0x7f00000002c0)=[@decrefs={0x40046307, 0x3}, @acquire, @free_buffer={0x40086303, r5}], 0xf7, 0x0, &(0x7f0000000300)="b4c21f93bc0bb50b7c04e0a05fc1e27c6de635bf0e36512c6b22d53064ee9ab9918d37e6c95b6b08334e82344cd1f321b7cced47fddec2370ff2305a05665092c17018746ec85766abda62e88fcecceff521db32d1f0650cf1f786045947839c14a348ea16e2178fab102c897571b991a93e47ce9c7d9a011610ddc33f5f65fff8bc930b1c0e318942962a29ab5e169571019591b49927fb3563935882c8653f8f5408b5aad8a01e3cad74fb36219511f9ee43c3be77546e1ebf4371a78022ecca4c08601450ce1b28f9003fd2bb53db44acc7a1e12d018cc350323d569c4998215c559e8772a4c5dbb268f112394bc536bf8f9c5462a0"}) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000280)={0x1, 0x1000, 0x101, 0xfffffffffffffffb, 0x0, 0xff}) ioctl(r2, 0x5, &(0x7f0000000040)="15667f7a4fb1e66d18559976e8ff2b71008802c53044ebc8db987c9d525f50ce7ea594088c3cfcedafeef60105b11610322d9efcbd08b03f06f7a7a32cb53850ba27055961eeb482efdc") 22:58:01 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r1, 0xffffffffffffffff, 0x0, 0x0) ftruncate(r1, 0x10000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0xe, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600000000000000000000000000000000000000000000005aa6879b37e2ea5d7113037dd4f5c000080000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000000)={0x1}) 22:58:01 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) write$P9_RXATTRCREATE(r4, &(0x7f0000000040)={0x3ba}, 0x7) r5 = socket(0x11, 0x3, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000280)="a933fb23", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r6 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r7, &(0x7f0000000200)=""/250, 0x50c7e3e3) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) ioctl$PPPIOCGFLAGS1(r7, 0x8004745a, &(0x7f0000000600)) ioctl$RTC_IRQP_READ(r7, 0x8008700b, &(0x7f0000000080)) r8 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r8, 0x0) read(r8, &(0x7f0000000180)=""/19, 0xfffffe47) sendfile(r5, r6, 0x0, 0x4e68d5f8) getuid() ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000680a137e99aa26c3dd8f599afe92ef960000000000000000000000000000000000100000000000000200000000000000000000000000000000000300"/83], 0x0, 0x0, 0x0}) 22:58:01 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000280)={0x0, 0xfb, 0x9b, 0xc, 0x5, "4d548eff1d8e6396ada99107259c04e8", "0d327a4a38587faca4b3812dd125726c07304b44163f1f90a0be7bb563241b536a21f137f084c177cfddb66ddb53ea837222ffce59610ac19ad9604034b2a6e02695b01d3909c73e3baf0cf6cb640ee0734dc7289acb0f05dc1b1a14340e4c4e176d8b1a35a94f6eadf3b5067e3dc4fe990a5a55097b9029738b850ecd860ae8d1408e5a6994"}, 0x9b, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) r4 = dup3(r1, r3, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="11634840000000000000000000000000a3000000000000000000000000000000000000000010000000000000e30200"/76], 0x0, 0x0, 0x0}) [ 787.157697] binder_alloc: 5228: binder_alloc_buf size -3799015722916264352 failed, no address space [ 787.175605] binder: 5232:5233 got transaction with too large buffer [ 787.184969] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 787.196844] binder: 5232:5233 transaction failed 29201/-22, size 120-24 line 3295 22:58:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$TIOCCBRK(r4, 0x5428) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) 22:58:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="116348400000000000000000000000000000009e974897000000000000deff0000000000000000000010000000000000e3020000000001000000000000000000000000000000fd00000000000b1859546d2b59bb548872e74990faec5e7e0379b70257cc38adcaa03994ac6a5065a295a8d6ab88fc1d093cb5a472b50fbebd7918c41b4083ea6bbf37eb7d1acdff0ed0b5a3d58126c9eb975fb9d419b561bf0948ff875eca3f85f49b4754b6134ab15649050bb738f022b3d9b18ab15a7b02b6cef303895da85cfcabad04814befbc56eedd4d50db49b8b9fc43ceb026997616f4fd37fcc73d299476e9cb6320bffbead59a81a216a858600e742915d44b5189e8fa46565c276163a835db742192b96ee0b71956a8b915552d80f55fa255c59313a6e2a7f128da4bb47213"], 0x0, 0x0, 0x0}) [ 787.203432] binder_alloc: 5238: binder_alloc_buf size 2151018850806137536 failed, no address space [ 787.203438] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) [ 787.203475] binder: 5241:5241 transaction failed 29201/-28, size 0-0 line 3137 [ 787.204072] binder: undelivered TRANSACTION_ERROR: 29201 [ 787.204460] binder: 5228:5231 transaction failed 29201/-28, size -3799015722916265099-739 line 3137 [ 787.205460] binder: undelivered TRANSACTION_ERROR: 29201 [ 787.229001] binder: 5234:5243 got transaction to invalid handle [ 787.229010] binder: 5234:5243 transaction failed 29201/-22, size 268435456-131072 line 3014 [ 787.255228] binder: BINDER_SET_CONTEXT_MGR already set [ 787.255252] binder: 5229:5247 ioctl 40046207 0 returned -16 [ 787.255449] binder: 5229:5247 BC_FREE_BUFFER u0000000020ffc000 no match [ 787.255523] binder: 5229:5247 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 787.255559] binder: 5229:5247 BC_FREE_BUFFER u0000000020ffc000 no match [ 787.260421] binder_alloc: 5248: binder_alloc_buf size 20766183456768 failed, no address space [ 787.260427] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 787.260466] binder: 5248:5249 transaction failed 29201/-28, size 17592186044416-3173980831744 line 3137 [ 787.260670] binder: undelivered TRANSACTION_ERROR: 29201 [ 787.286392] binder: 5230:5250 ioctl 8912 400200 returned -22 [ 787.286776] binder_alloc: 5230: binder_alloc_buf size 4840 failed, no address space [ 787.286782] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) 22:58:01 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0xfffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16, 0x0, 0x1}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 787.286823] binder: 5230:5250 transaction failed 29201/-28, size 4096-739 line 3137 [ 787.367341] binder: 5232:5253 ioctl c018620c 20000000 returned -1 [ 787.384765] binder: undelivered TRANSACTION_ERROR: 29201 [ 787.389653] binder: BINDER_SET_CONTEXT_MGR already set [ 787.389662] binder: 5232:5233 ioctl 40046207 0 returned -16 [ 787.436199] binder: 5256:5257 got transaction with too large buffer [ 787.448582] binder: 5256:5257 transaction failed 29201/-22, size 120-24 line 3295 [ 787.458054] binder: undelivered TRANSACTION_ERROR: 29201 [ 787.458956] binder: BINDER_SET_CONTEXT_MGR already set [ 787.458964] binder: 5256:5259 ioctl 40046207 0 returned -16 [ 787.459647] binder_alloc: 5256: binder_alloc_buf, no vma [ 787.459691] binder: 5256:5259 transaction failed 29189/-3, size 120-24 line 3137 [ 787.522048] binder: undelivered TRANSACTION_ERROR: 29189 22:58:01 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@vsock={0x28, 0x0, 0x0, @my}, &(0x7f0000000140)=0x80, 0x800) r3 = syz_open_pts(0xffffffffffffffff, 0x18500) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/checkreqprot\x00', 0x10000, 0x0) r5 = socket$inet(0x2, 0x800, 0x8) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r6, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r6, 0x8004745a, &(0x7f0000000600)) r7 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000340)='/dev/bsg\x00', 0x40, 0x0) r8 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/checkreqprot\x00', 0x20000, 0x0) r9 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r9, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) r10 = eventfd2(0x401, 0x80000) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r12, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r11, 0x0, r12, 0x0, 0x1003, 0x0) r13 = fcntl$dupfd(r12, 0x406, r1) r14 = openat$random(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/urandom\x00', 0xc0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001100)={0x0, 0x0}, &(0x7f0000001140)=0xc) r16 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r16, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r17) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r18, 0x0, 0x0) getsockopt$sock_cred(r18, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r19 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r19, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r20, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r20, 0x8004745a, &(0x7f0000000600)) r21 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r21, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$TIOCGPGRP(r21, 0x540f, &(0x7f0000001500)=0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000001540)=0x0) r24 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r24, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r25) r26 = gettid() ptrace$setopts(0x4206, r26, 0x0, 0x0) tkill(r26, 0x3b) ptrace$setregs(0xd, r26, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r26, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r28, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r27, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r29, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) r30 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r30, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r31) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r33, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r32, 0x0, r33, 0x0, 0x1003, 0x0) r34 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r34, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r36, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r35, 0x0, r36, 0x0, 0x1003, 0x0) r37 = accept(0xffffffffffffffff, &(0x7f0000001800)=@nl=@proc, &(0x7f0000001880)=0x80) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r38, 0x0, 0x0) getsockopt$sock_cred(r38, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r39 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r39, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r39, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r39, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r39, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) r40 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r40, 0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r42, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r41, 0x0, r42, 0x0, 0x1003, 0x0) r43 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r43, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r44 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r45 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000002bc0)='/dev/loop-control\x00', 0x242000, 0x0) r46 = gettid() ptrace$setopts(0x4206, r46, 0x0, 0x0) tkill(r46, 0x3b) ptrace$setregs(0xd, r46, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r46, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r48, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r47, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r49, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) getresgid(&(0x7f0000002c00), &(0x7f0000002c40), &(0x7f0000002c80)=0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000002cc0)=0x0) r52 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r52, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r53) r54 = gettid() ptrace$setopts(0x4206, r54, 0x0, 0x0) tkill(r54, 0x3b) ptrace$setregs(0xd, r54, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r54, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r56, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r55, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r57, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) getresgid(&(0x7f0000002d00), &(0x7f0000002d40)=0x0, &(0x7f0000002d80)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000002dc0)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000002e00)={{{@in6=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@multicast1}}, &(0x7f0000002f00)=0xe8) r61 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r61, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r62) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002f40)={0x0}, &(0x7f0000002f80)=0xc) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r65, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r64, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r66, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) stat(&(0x7f0000002fc0)='./file0\x00', &(0x7f0000003000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r68 = getpgid(0xffffffffffffffff) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r70, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r69, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r71, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) r72 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r72, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r73) r74 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000003880)='tasks\x00', 0x2, 0x0) r75 = socket$nl_netfilter(0x10, 0x3, 0xc) r76 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r76, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r76, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r76, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r76, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) r77 = getpgrp(0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000038c0)={{{@in6=@ipv4={[], [], @dev}, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@dev}}, &(0x7f00000039c0)=0xe8) r79 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r79, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r80) r81 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r81, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r82 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r82, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r82, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r82, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r82, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) r83 = socket$inet6_udplite(0xa, 0x2, 0x88) r84 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r84, 0xc020660b, &(0x7f0000000740)=ANY=[@ANYBLOB="000000644c032c36"]) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r86, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r85, 0x0, r86, 0x0, 0x1003, 0x0) r87 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r87, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r88 = gettid() ptrace$setopts(0x4206, r88, 0x0, 0x0) tkill(r88, 0x3b) ptrace$setregs(0xd, r88, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r88, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r90, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r89, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r91, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) getresgid(&(0x7f0000003dc0)=0x0, &(0x7f0000003e00), &(0x7f0000003e40)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000003e80)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000003ec0)={{{@in=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f0000003fc0)=0xe8) r95 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r95, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r96) r97 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000004000)='/proc/self/attr/sockcreate\x00', 0x2, 0x0) r98 = socket$inet_icmp_raw(0x2, 0x3, 0x1) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r100, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r99, 0x0, r100, 0x0, 0x1003, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r101, 0x0, 0x0) getsockopt$sock_cred(r101, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r103, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r102, 0x0, r103, 0x0, 0x1003, 0x0) r104 = gettid() ptrace$setopts(0x4206, r104, 0x0, 0x0) tkill(r104, 0x3b) ptrace$setregs(0xd, r104, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r104, 0x0, 0x0) r105 = getuid() r106 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r106, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r107) r108 = openat$urandom(0xffffffffffffff9c, &(0x7f0000004040)='/dev/urandom\x00', 0x80, 0x0) r109 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r109, 0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000004300)=[{&(0x7f0000000200)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000180)=[{&(0x7f0000000280)="87d537b55bd64bce7642e1010de90d17a9e867cf93141ab6ace13742cb35dcbf2ccbc28e0d97d585192a3c4ee9ea177888a4212488e2fc05783c9db793c93563ff54b630e2623ae6d8219d68f77c150510532dea45f702c7e9b76f352d9694016238c62986bda977", 0x68}], 0x1, &(0x7f0000000480)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32=r3, @ANYRES32=r1, @ANYRES32=r4, @ANYRES32, @ANYBLOB="34000000000000000100000001000000", @ANYRES32=r5, @ANYRES32=r1, @ANYRES32=r6, @ANYRES32=r7, @ANYRES32=r8, @ANYRES32=r9, @ANYRES32=r10, @ANYRES32, @ANYRES32=r13, @ANYBLOB="00000000202a0000000000000100000001000000", @ANYRES32, @ANYRES32=r0, @ANYRES32, @ANYRES32=r1], 0x78, 0x40005}, {&(0x7f0000000500)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000c40)=[{&(0x7f0000000600)="24a2fa789d26ac5970abafcb20fd0934dd2f9eae5e4032b81279a0952753f3f07c523a228376c2d24b164cf185cbedb7b1ef2ee3cc805ece98a3c7a7ae3e7b71e1b8973cc8b9446482d0b4d406a45ed98f68fe13f3ac0016761757cd4fe6cd5ae0cde1b5aa9af765c79a3ece48378af530121ba4bb7f981320bec9c73519c2452a0c9ade81c2b69cda799da8d4596c06ec16993423965b79b324b6c9a3b547eaeff90eb06b96205c8c61a8cfc5c98ac7306c054ca1b975014b398401f63978753cd55e14a181a00ac1b844116e", 0xcd}, {&(0x7f0000000700)="2302a086f38ad041c13dbf030835ddaa8718f691e1496f248ef44c9f0cb8cf2430e34f308098fb11a4fa8f1686abc28e1374c61cf64941f4685a9ef201f8921bc96d04877882c6dbf933196c242de700133c88d593622ca9109eec68bd6902b456b6b6285f1207ab7975d1db5e44ba62e4c13f0b227bb2fb6608e918d4e17009f793ca6586ddf30d79f28065b4f3f3cfe5b941919a16e78147ff2e3f9bf2239458d4d2b9b2362208144ccc6756c0d043e647b3e65728400f698f9f9633b3f54f1dcc2f4fc13c8a3c34ab250366090912f7159cd98fe8448e46f558200ed7d4baca9a162c83f636329c21d7d9833e6a7d450fd1286ab3", 0xf6}, {&(0x7f0000000800)="573fb4c9bfa8d3abac31b7df5c448283ae297f176a26e7e52e8204c71eec31e91a6aea5b21fc948570ea1f71944d028f14b2e058996b94639bfd685a1228d1417e9ac514d2afed0566e150cc42785f3d44e4dff755c65f27f10e680e917b5800a86b24c51d969ecbd25a225b67634ffe825c5d0d3988f3389b28a3348d777046a31092ed54e5baab9c4a264c94243f9d", 0x90}, {&(0x7f00000008c0)="6ed7af94acf10c678c333664b928bea063bd28d0fe8467a0d1cccef9fae79456928ee3a0e793f7552f74086e1f613e523343788133142a8066b5f6d9b231374dd5af25d708b509f70805a10d0ce97f2ca7c4e3997bf5288f8590ffbaa59dc3a807db31b588ab50c1c67a5cfdcddaef20110d339b8f61b48ca802c7fbd15a1f74cd", 0x81}, {&(0x7f0000000980)="e0458bb27a96f81efb2156fed8847112fe7e62a59b22979f56a0e30ea0a20cec8d942156b591f0da6438e377aae2619c0169e79f22cf14740ac58090ff8c48ecc3637a82d26c4d3a18825552dfcb4cea61c87802f3dfd33d95c0ac745aa3c81db7c2633c6bca8cf1444a216816dd5db8d687cca83c2f9f1c6bd5b9973dafe2f92e72b941708e888d993c53317a00f37802b07984ea520f3097d395e2ce4abd3b0d875afa02fe76de98e75051c0954339569ebb5668372082e3f03c9d96eda65d43721f4dfb19b15de19c490c2e45b81c6ad2", 0xd2}, {&(0x7f0000000a80)="fc131aff8c4e341f9a94c952bc87c2a56c1146b9d3dc5e9a2b708a8a5a6402f7e9827149994246e0e15019e243470bb4e811308b70f15327c2db229f0f954cef04d32dc92124bd07e29668289a57f28edfb0dd95afc0f1e5755dd686a4c0a44debc48dfb3b1167b61460a6acd2915153fde3a5cb49794950a760f398f41b5adf16efd0e841016cbc06b23219e3cc3f20e011bc5700ab079656374e8ea2e2d4d0b9cc1b05f62b7a028171c154d4f026bb6501e09b059bcd6aed9de85f10c38683e9edc5d17d1b4b87415f1a691119871666aa10d902", 0xd5}, {&(0x7f00000003c0)}, {&(0x7f0000000b80)="0d67a9b562664e7461f4455e8a48887cd47f41f0e4dfa76625f48229f17ca852fa8d996ce11f584ebe111eb7e3ddda640d773aa7c40b60cd43bd2db2f1486b924dba5c598f74660c2e4d296fed7dcb571e81b09377ff58a1d287ec76895863832e0dc3adc1abc1c461c3bec6024c9ae3d8a8079e519011e016494dcc81ea7b115e502add828d9a567b", 0x89}], 0x8, &(0x7f0000000cc0), 0x0, 0x4000000}, {&(0x7f0000000d00)=@abs={0x5d8491e91dc80a3a, 0x0, 0x4e22}, 0x6e, &(0x7f0000000e00)=[{&(0x7f0000000d80)="1af9b4ffeabe46d55579413923a795f0d834ebf23f3fdaf02e19b1b07b896762b77f675c3a0e4ba9a343c5e2b0f89766c0933153e96ed55d641e722a3c7413f6cfd90ba51b969a5ab3da614cd99295f3d0230547", 0x54}], 0x1, 0x0, 0x0, 0x20000000}, {&(0x7f0000000e40)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000001080)=[{&(0x7f0000000ec0)="92bf835d5b3ce8005f04a0277e1f83fc123bdf8cc0d9d475d7c4b3ce09fb69adf18a124398b8d656dd1486fb25fad33cf7a0d9a0fbfcaf84781aa8b55f570553fff37f9fea0431b722f5d9d818ca97813b910e24826330", 0x57}, {&(0x7f0000000f40)="4e5abec67209a360abcfec0cba6905b6f439dc9a65ab116d657d6d6715b4cecee512d04a94d4532957b8f1f33da1b440e6d95c70a11a322baa313c05c50391334f6c1422664a8425f13de609b0771950ce6f969ac305fd0c16fc47bd8796414b086e1747139515161d2cf4c10779ca69a35445832a4d8f6c655024eabe0aca45bb8dc711d975a5551f64e641bba67255673472abe2a10b4749938d02c90545a5af2133ec77a6fb407b8c0da8351812422f4673ce4d0a5c88ebfe60ddada95433f5c7e3e320649718d7acf7ae77bcd4e7883a52f3e82f7e6fa65dcada18f1c0ee2d0e128ca5e416fa9834a161e53992e0c35d17c5a67a", 0xf6}, {&(0x7f0000001040)="de29328cae8ba237c9bcf872fda730143816fe0c83af338fbb3bde1fc0c8b47e63b2cae71e767cf09cfde8fb33eecf9a176fb5d2a802882a", 0x38}], 0x3, &(0x7f0000001180)=[@rights={{0x14, 0x1, 0x1, [r14]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r15, r17}}}], 0x38, 0x20000080}, {&(0x7f00000011c0)=@abs={0xae78c47541508bd2, 0x0, 0x4e20}, 0x6e, &(0x7f00000014c0)=[{&(0x7f0000001240)="625a3f95a3cd33ec1d8e79c1e86fcc4f8fd900f15f7770e1ec4c65c66c2a1b1ea773aa14a05022befe3ede024946db745da2b77ef89fc65be96b90da0a6ac6872149c3e685dc036b02df023eb0d99a4cbfc18f3da502a3cc145e1b0051bbd2ed12f303466be7e6a6c40cbce2bbe88e5547da6f3aabebdfbcf039490e74e1ed38b3c3a911010eaf81837a396e5f35260cf9b418480deeb630e1a182d588c0e2cb4fe8d0fbfa86c3b09e3bde611503ef282efbbdb6e0074992d5c323db16bf400d72d1c633117b187e5f488dd4071200", 0xcf}, {&(0x7f0000001340)="846095063a21dfa3270646923b00e2c988f8d06b7894194cf9caaeb397332bf645cf4a53ca6993c1c8a67b31eb49eace7a9feb72a635ded9e255b0e52c1b0f6c1b85f1aa427960e94830c3898df7639a4398e95a41a65e401333cd11935b77fd425d39ec29c2e7fe31c50f934c036b48c070eaec5a012f11d920d52ca2797a0ffa96d4591a44cd437fae1ae5a8f516445ee0d5bf602bab60864e8c5bfffc77812fffe54e233d018e14cb819996b2d4ddcdc88679bfeff205479f82533bdfc4468558", 0xc2}, {&(0x7f0000001440)="23b26e8c02373222d75407382c9f34d53b6837b9a747df3158b47c966181bca22fe736be5b3e0dc08fa37095e89a83a9a2e1279dc55eb7b437250e7656b836d4dc1a62fcb6609b5bdfd23b7f3981", 0x4e}], 0x3, &(0x7f0000001580)=[@rights={{0x2c, 0x1, 0x1, [r1, r1, r0, r18, r19, r1, r20]}}, @rights={{0x18, 0x1, 0x1, [r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r25}}}], 0x68, 0x43}, {&(0x7f0000001600)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000017c0)=[{&(0x7f0000001680)="160f9e448ee61d2bf5a74ca40829f4711a526975bc999ba822240e8052436ff40f8f529e5e245504f3840275b11eecdcbda2281fed649c9ad5f324a6de6d4cee7e00720b3b9728a435e46103c4ad24c915423e74745fdd436c7c246e358a43c1519a502f9f4304a758dc3789fbc7467af22b64c24870c58bad4616d96d15872b38cee7efa87d1b81660737d31ad3ebefb058fb3a4069e74796e068f16a606a54afbd08d85bea7207f574cc162b2b79d329391e682b862f7c238e300f602afc08be3915d9", 0xc4}, {&(0x7f0000001780)="790785e1c5f8a966f96dcfda8b2a91dc3bbc33e77896", 0x16}], 0x2, &(0x7f00000018c0)=[@cred={{0x1c, 0x1, 0x2, {r26, r29, r31}}}, @rights={{0x14, 0x1, 0x1, [r32]}}, @rights={{0x20, 0x1, 0x1, [r0, r34, r36, r37]}}], 0x58, 0xf212234dc9af7fe1}, {&(0x7f0000001940)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000002b80)=[{&(0x7f00000019c0)="c034fb89070cb83d0917a54b000fedc00888848fe8c3c04d735f83f7ca54edf15a0b96b772b51f86202dccdb4a763cf865a720b5f79dad72185d4fb870156287a97b1e01bb3efd42df5183e9b6e0ee2c04188e7c598e79e9f5a4e472728032960bee2e95865e23ff358093b645835c711b22fd74e6dfa88379ff25824578aa636e2f59c30b692dadb0b6394f758e73f868dc4a12ae468a6321bb9b2175f0ba829da2411f23cec7be8e43beec7d4fe7b5a338d9ca91994fc7f8a36417e72ef447daf903ce0fe037f3fd595c9cac13d2c8860d084026d8514f9bbd5a7f5533c8945be3f4b6fdb608cf6faeba1ae8e43adb9c840d3dbc0ca5a5e1dee74774d7e1f06da17235367cbc042f673706cd34cb43fd8e92ff0d249ae2fd8c0589810b24447b5a5112753008df579a49109a8d566456cde6ee8c8d22c47352a98210248717756187a0a5ee7eb5942338701cd860b8461e84d36a9f9ecc142179f5aeb422cf80ac5451a39621b1265f3c4788dd632b0197380b1c56c42fdb814327d2d2c847f1cdc3a277addc9f28357eb216e115deae15666647337dc8bfcd342d80720a5f93c3047bab294a02488eb7f19a165123f058a3213db44efb7113f5ddb8e9f0ca41f834ea965be70d0a62b83ac8e39f50d47aaa3f26d3f4acbbb165a10d1ab2474f7d5e079572d72c47bc25712e65ff4ad2c53b84e142fd1d5d2c938d174d6e5e3cb84b550fe05b973d5bc3aef31993611cb820425e2353ec83c99241fb6339366f562d41d306c9c249023d09704db881c10067ac6a7b62adff522fc9c69a9d6010eb68e384635d7966aa69f7480067ff95351915f058ab06cf1cb47dcf476a20ec41a88cdf23dda8e4ba6c79059c752b58043c3c1563e49411aa57079c76cfbe36974eaac03cdce55ca75c8d9d0eca2eee1182ba40251ff4fc77edefc77868be59cc1622a544755d1a43b7eb0d6f9e0e77223f5d0a241240a72c002971cdad5c121fed2a8060b3847b05ca3b60155a0bed3e6c1aca3fdf610d30e5feb273470d7f2e3eb6a85480a462f400da3080131a239a900d4d20d6f9e8e3de9a62e9e89dec13e45e53a9008c611c1811dcfe0211971582ddee5ea8533aa172aadde8616e5b2087302296165046e0663e55cd2bc044789754192555647fa482923c39e11464b6b66463724bd15bb96c18ae00763ae51e2825f029083f584ef2ddce2af1d5a1076b4f92ac5cdb6d072282b19a8a67af7e41b5b17a05da34e943ee8529e0f085a916b16d1e433b2f5abbf194f2da268b1d85db38e3015037062a6db22426409076b228a9bfdab41835e80ac72731afddde9f81c243108a7e9339659f303f1fbbcb74e3f42bd6399fe4738907d5f9aef34a2a0a8045908f05be2c9c0d295c4cd9b1e1e4c8a6de07968be2fbdfc751f523e59586ea251d40729721814c3adfa6de28153b3798231e889fd579b0b30cd8f690352212a1a4729f57fad1facdc94309cb001938d56cb2b6f3db3b8e7c3835e8065fad031642d101ab82735908157a3ea37f2dc6f1529d21a515b1f83c83b3d9a03b98a66190a9fdef4684651c5fb3f3307338054bc1459a1bfde6f7628c0d8ec149c973e599e0a5ff491de5ead1f9beddc015bc7a3c4fdc71f2b33b3eaaa2f1ec56812dcfcb428d5e24818c3252eb11f401093e965c67faa1fd726d1a24bc76a98ca38154c5aad1ccb2b75132481df0856b7fa49febf444eb0d3e01155b9723f7088946d8bfe7e4f6ec0fffd7942f4542f4eb465c2aed37614cc9abd8574b5e5c6c2109e89adb7f837baa744886abc23a073aca5f8337832a832ff0eb4957c91d851f6049d8ca4a88c947475e0f1ef8e4bab582c625207769935be655d9b78176e6ca59173679e39cf18eaed589b86427bd070284bba5c50286b2f46c223914ceb0cd4d9ceb3a81003f779ae0d970c7beff8e41a7edf2c616002383672ef7c9760e6197ae9ffce70dc6dace58d0e72d15f26c608936e0c10b3e9eeb11ab15715631da3a12dfbcf35e042fed1c520f59a751baf478a027fcfa76d281036d38093a19f13347d5b4b5ec7fcc9d5eefc5c3e1f91f50de3032b1f34f6452dc9af89c323b1dfaaa7920de88d99268e205e0413aa975a78a14ef419fe78002dafd1f4dcb1d2dce47ac61f361ceffeed219e7c2108415e1e49db211678e42d1a5f7648a62bbc97ddbea01cbbd8f235f300a05233d007a4a368377aebe12d01c400c036922ee3afa13552adfa306a18443a1b268625aae70371fcd05c597d15500cbac9df9ada72c1fc42e3de783d3edd41200612a0ae76570ba73da5779f02ba6b9d000fce01130e6198d4ac0e7fbf04daa38c2ca904636036056efc3485456078eb9ee8cc3f583a35a378b437f97a6008be9b8f183f7cb8db001610910fd6b70d02cb09440f71b84219e16437fdceee1b660697c721f3cf58c70d0b2d3762e296c7d870dab6c05eabed532fa11344f23d658d55c47f89836f95592d13c14d01385f6cd97bbd64573cda24d652074b355c50f134ed55bc32bafa703f1d43c19128e8f914fb3066aa78e6e7fc31fe0751ac3e8e9f6e15f6969d02fecd9fc9138bac72efd2bc747520a1e676d9bce12a8b07051455d0e359724008c8c2c6db279dc8fff0ed58464970b139e51806f0c19dcab8ee6a5337807af574858c01674be362bdc1ee74a6a313e3b05fca39ec14e3bc5b1b4bbb263d8550790f7dd1bce50c9052caea994e95e6d7d43f2e151f72ae0bff3e0ab93c5793f48203a12f67303c939a0b869bfd194b7c83101a181aade45e197ebaf23819e0977e7b5176602431dd880d777dd09cddbf1747e968ca1cffe11999379790bf53bca80e17099fc45fa3948af0736810a77f3edb4970029302323de9e1e51af4fe69ac99cc438a277208dce492d3f09a299e0649482be719b09d852708a6f03e49ada4062ce2772bc0f125f1a2513dc0ae28aaeb7c56b64733e9b0968a6a16ed267f95f07551bd0eca5d0be1d628bdd7d4486f4ee5b2b5b8493c4521093ea664834be2406dfc341b2114036f0a26fb153f1b12205e8e375a4c93c4f191f6195a1b5b6eac40f74bb025a3e2ed4a3f5ac772d80e634fe7e9f11f17b6e8f095805217e3a820989b2a7f8f68c5dec8e52c0e53e6d8607bee5e44716ca9acac25124424f2ba2897b91ac519715e293ccc15367b796c1a89c135650ee559b4a67be140d2e31e137c7eae3a85eb80025566ffdae507355c460083ffdd1e4f23932ff020fba7854f6c4956b9a0150d372de166d347184b10c1ca027832e81f64bbb4d7cfe2f09b11767f9ed9b0786605f1bf675eda3700c3b730376959267e7bb611eab1203371d7ff3da3c77f83469a0247de6e29f0947c528cacf25b2b4e40df3be4e082ceb8ae6c297456e132255a1c399550dd7a23de825bf385b75f92a2cd202d81b23209dfb01791b306cf7397be067b49fbf1d238592211c6b73ac838ce3d88dd177ba0c13a1b0f87ca0f18a43136def11341c8b027996cc83a3847303200659703c86c6471e32a41b73f2e881142d82637e552745273ce0e71649c99d453099a86e488d9fc36b631f551b0344df501c818a7223c288be15c3685198abb91ce93cf770ae67bbd30b0837719c5bf80493b9d7ec79f6776f73b07b983b829560b476ac593ac9721fe4445caf586d28c51a57f0a48747a309c9ecaca019d9d927ebb0b723517dd4704971cfdb16eff2e3282206f1ecb5801c0b609ad7d388f2d4cccc7d69a60cfdca41f0b281fd114cfc61e7e9917f0ca433334e466593df11c77df0e717050c0f977c476dd514503fae0cbba6d2d8636766ed5acb755fe01c4f391b991f2479a1630ec13c31cae617c055d1586ca8683efc348b40f2011d2e79b623cf58226bc6ba48ddc3da751672d25a4b215e8bae2a94d66d57c20c08e3aace3719681937b9e23f3b25451e6d92f2a7c729557d8b1e637c559bc3aa0c9ce5719bbc0c7cad752fb60b50c53e27fd790127aa7e786c4d9f1a22d2d23c5fac1d46e2e57975f58824c00bc65d2c0843e9c86c0c6e01d7ddc96fd399f7fabf2b3cd24989d1db4e3287b127a4acc67049d7d63b240de8b285146e1b55c11449eef4f2e39b5ae7b14aebb70cb06d4ab29e60083e512e75c2ac254e7071a9ccb95ec8fa91f19aa8e70692ce3ad4a6c5afd686b42160f4527810862d0faf5591756eebc110f2c352cb3da4dde68e3516845d0332d924e1e44c437088c076203ebda566c982bce2526bff836a47ae9694c5b683878dc60d40482afe16bed7ed0648184bee7e6bbf5a8d2846c44264903ded6f97498e543deeac58d64eb2e8a9d101451fc41f8135681e3c16df1d472507bd7a8cf6a5b7470ff54441b35a90c4c85f2e57ea3ead70c5979ef1ba8d14bb54518d2f81c4370dbf9c32680cd75490fa7238dd9136b59a0dc44240e9c5ee9d3bda1048be5dbcad93640d474a19793d587f8d3213cdacd375a385911ca58cf21d0d4d82aec9cf15515f20bd9c32a4ecf0e01253d6b4978bf8e8e19169aa1fca17f57f7920eb3579e24cf0cf7e7bdbee809fd6c2376c45b27127e95af8fceac5448359960ec701df79d2e8480477bd62bd09582ad0af42caede21785603b4274318bb9064eb2133ceff79e32d1b1ad4176a68c34736ea4cb1a50e0a7458394eb3d46f7240694514323c1f316a090b8c4705a3da9b2e3ad79b78f0f66988ae4b28fe9c19bf11c8b2a9da71b70a220104843353730b0c6fedab2d6b08d1f763505da3b3188a20c9c391ef02b755f125021c437fb5c679a2d5144797f71a4321c73fd8d64dfa4ba8c32262b27be96848898a9d8bf82e37a6a385b0994c4539bdfb86455f98e59bd4b253fc243a0b3ef77c952ca2b94649343450ad984e0c86390d0f534c9dac0e3229863d5b1506403a11989423151c2aabc11c814d3a2f72228a15fc976adfe5c7a2d64f63b57754ebeff0f33784c79a922e890c3be9f54b5e508155c69606822deb78d990865f6d2e40e2d9054b4983f4dbc23f6896d6da65872f04c2c4156d462f7442ad70db6f5d92561ab32b834f958a30f6165d1fc2fc5ce48ce5d6f82d7c491c5fa0097270eaa226f34508a1eadffde959d2b86b850b6a40df9b8bebe76d33e22ddd4c64bf6643c4ef2861f070ecbf7c64736efb7c3a28d0e34ce45eabcd81bfd9d4fcd248cdbee7442ad29fe26f0f451624207dbdeaa90552464b6289bc17a2d9f4a471fe35fa71793ade3cc062d11bcddb4fe2ec8abcb1ae0faac599ca102e23d4290b71df38a432d115a11767e305ca5169a1552a0ddf49a8befaf7f575076d55b1ebc715f8021ecfc897aaa2fefd0ea8757fc0241dc0c5db5271549bf7348b1805ad2f9a1d5e827b03f15ffaed6a06e2b7110169cfb04ac09749fcdb92f0814c607e84895d911c70e64ad9b87d31e2d85cf0aa0bb1ea9ba42408035d9d176f8a96a48ba9283d7a0f82e1fc4a2b174dd8061d36a83dcad283b9e3d32eaefd534d0fc3765912d4b9a2e2c2d6342ed8f03841a4adfe2a28245178db45851efb9ba5dd77f708813e74bdd812897368fab0c03e758083e6bd836de9e468a508e9c6cd3e427ec26edc58d55147c26767450de2c6abe54e93ae2491b4ff0693f4c01e75214107ee96f03163c614786ede57b61aee6c2d390f018a70db6159ea8a55c8464ad1f9eeb4ab6b31c6f6a19b7b2590a9aaeb99b29c4d61a7b5547c6d06eb2148b3a4773cb93a638f119bb598fca4dcc9149bd62ca9709b1027023389811ac51bf8f74b230263e", 0x1000}, {&(0x7f00000029c0)="1f5bdf8143dcb6be2a11e9f4a288740cc027c8ebca5984fa1ec9a0ca512106bceaa31e69943497fe1f2dc2a7df41016150fd7c2f4b7c427633b778b16d02ddd3de8bee0ee55ea13da390d8817978db84008f5a871866103b0f2305434eb4fe4c860cfb61501f8b5907453ed0e145bb6058ed29fb8aaba42bf6022aada028c1fc4c4568e62cc7f28c35de9134e77d4b138b4f65985124a478612290372d6968235dbb61069338d70ad8b20cf7a3d15b261e1fa2ea82cb2fd2729ec20433c5d10cdc0692fa089f8c3f8bc92e40", 0xcc}, {&(0x7f0000002ac0)="440b2b93e552a452b9921943415783fe485b75d78c4c6712ba03f23fe673a0e44ab65c5b71078f5d4966b1ed0dc41b0c14e6a169f5b6c2ecd5e2158f24c0ca25ad4b76ac55579ffa722f8a910be19f12efb7f01799d652b181fd5fa5ac2706481c05a917661b158f6a", 0x69}, {&(0x7f0000002b40)="aacf8f", 0x3}], 0x4, &(0x7f0000003080)=[@rights={{0x24, 0x1, 0x1, [r38, r39, r1, r40, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, r41, r0, r43, r44, r45, r1, r1]}}, @cred={{0x1c, 0x1, 0x2, {r46, r49, r50}}}, @cred={{0x1c, 0x1, 0x2, {r51, 0x0, r53}}}, @rights={{0x18, 0x1, 0x1, [r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r54, r57, r58}}}, @cred={{0x1c, 0x1, 0x2, {r59, r60, r62}}}, @cred={{0x1c, 0x1, 0x2, {r63, r66, r67}}}], 0x110, 0x4008044}, {&(0x7f00000031c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f00000037c0)=[{&(0x7f0000003240)="fa32d3aade53bf4486fdb426edced77dcbea5df7fdb399d0965c7000a8686078edd5574a4a37574ddd424a3a44f9f797a02f250ea8c54e4959222a2e71f4f7aac17f8fb6dae6c1d5b7aa07ada348b892067e15e7ce6b5e8f2a10cfb7ee", 0x5d}, {&(0x7f00000032c0)="88104babe8cf3f5865bd2b0503b4d1fd74fdfa1f913e012acec947714b2c399e78ed3590d74679d90e3cbfd373afc91a6317b4fbd58d42e447bb558015480a155a8fd3bd6d3e32f7310216745fcf9447f217fa96d71e19281ddbb4b4bf31a230b162f7d965750a4a", 0x68}, {&(0x7f0000003340)="d5611e060a6e947459bf8ed3a12233fd84f9e7", 0x13}, {&(0x7f0000003380)="4a4f94e83e10870f3767009f1f898b5fb28b38ea953df45bbf76482a9bdcf94625063542942fa19c6ff7326c9cf57e8db988ad953c24ef842e22505c3bfae1a6c96a197e3aac61c63fa93ece11f76373c77eca31d5f8810705729459c8d7979134d5e06aa33d39882455e05c74888bc070", 0x71}, {&(0x7f0000003400)="8cfbc49543b09c89a8ce382e9ecb2dc3e6c97231f542a3b7558f1ead718434474615336f44b634a36a3bfd82450e3308c1b71658d516c32b12348d97b1026bbb925f3f6d269632bc6410d0edf1820770526fe99447192d894be9a5467e12c76a6676e455809d6fc0299c669dc6213448e005461bac567faf6232ed03c251e037c1a3e116ad7c3ee266611bf1305a5d17acb87997e89f0e1ad82acb477da12efd4073de56aaa09f9f56c2a32ea3fde16bc178742d0f402073cc6659bf5c9b3953da17cd6512b17fc222d872933960a4d72c", 0xd1}, {&(0x7f0000003500)="5cfdb09967c426d24dc413e1e32d7f79943c9ed92b8c01848795871a23cc7454339e3883f1ed8988a8d65f5c9356159f4e66c2c67dd182bd941a87c190d181c249699e6a612699238b95c8e15db65fcfa1f5ea0c18cd7cf304bccf6b9e93f276", 0x60}, {&(0x7f0000003580)="2d9a02db2da754b7f8560a1038830387b822bcf50d2768dc517d6717ea74d4397b75f7164f03d85172cfe199f963ff085a82b371b69229fb97a9bfdca28185a0239226116397e6b2734a0bd310631da1ace801aada38522927b19bb11ed580f0edac80c433a62b30eb5a90ff34ec69b45725ee855b1a3b0e6d3037a4e06c1eff6e339db5bb2839d5ff84e99650e2c4005216fd17bbb63600ae5d255f3278e8129ec92c470607931f32abcdd2b55de1f6974e07367022e1ac52f26b3db7e095dcbe62b7ecb410bf801c58172834cb7bc8d45fea33af8fde18f38b35f3849781d35ebcfc5f3c4641afc4e68056b0e49ac5d96542cd628da514038dbf", 0xfb}, {&(0x7f0000003680)="e0c4fc047c414372cfeda563209bf8e84ed8c30532930f0288bf5a369093358d635ffc40ae7d66b59539694d42fd5a9a105ee24aae26b51b309c373b42128f3c06b65deaa060e33bc67141addc2e2159b6290b5e8fa95772cbef742a6063a8262749b4e076985cdda40ebc87f008d8b5083d55fe7d6eb6b6", 0x78}, {&(0x7f0000003700)="5a4324474e1af20040cb34036de2a575e3158d257edbdf280b993b7cdc5d82b604cb0542a6627463840300d90d976ec2523f3b0cafb7ca7900e51e776164abcbeb2565bb556cfccfc2194eb41150dfedc5d1c1e8578034338106e58fb2f12a4295cc453875ecee953ab9aa904ac931f30b599a05361743f5372e8f989cea19dc7468", 0x82}], 0x9, &(0x7f0000003a00)=[@cred={{0x1c, 0x1, 0x2, {r68, r71, r73}}}, @rights={{0x1c, 0x1, 0x1, [r74, r75, r76]}}, @cred={{0x1c, 0x1, 0x2, {r77, r78, r80}}}, @rights={{0x2c, 0x1, 0x1, [r81, r82, r83, r84, r86, r87, r1]}}], 0x90, 0x1}, {&(0x7f0000003ac0)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000003d80)=[{&(0x7f0000003b40)="65435b491c0fa28203fe5279", 0xc}, {&(0x7f0000003b80)="2f9c2d027a43b5dc05c446c0c64ce0d8ac007241c8940292f2c5fe41cf7ef68ab642374e2fb3f334606877a6a4644dc5d961a89eb5e2fa64e31d99fb0c635c216f497f2fb5856def5e0b2074e1af85d62b0ec21b13ee79bb89367c835fc0f6f66e32b6f0498776bb19837763ac1091c8cf184b8e9522a3fa3d65a6a509b476beee570023acd195b59978f572772e99dc67aa5fbffa124c7eadc36cacbf38e3c6705b051b926c651683a36c72a8a85eceea9b697ec2bad8a5c0f6d32c88f3940328c0bff1f97ed048f2c113479078e26f8e67", 0xd2}, {&(0x7f0000003c80)="1aaaa5a69a565d642c74b1710b09e5b64ae197f262803ec4d9cf8a7946393acf8a2f53e7a9d7ce887640cb9f51b471b943f397372ab917c2eef9b858b616b8f48999cbd74c5539a3a5476d095390e547865803ed46ee5ad6a15c4585cfddaff6b851558cacc708fb7808d4f8074629ab0ba535cdbbc82b288e51f3da1e4e4f21c78dba6a7efbfb63450f7aec9443ff81dad42620f51e5028bccf24f1feac21f5079d3fc448b26ce487bb291c049825f8f0d7fee86120b68145a0e474032bd8c5d6c350050374157509402505ef68e39c", 0xd0}], 0x3, &(0x7f0000004080)=[@rights={{0x10}}, @cred={{0x1c, 0x1, 0x2, {r88, r91, r92}}}, @cred={{0x1c, 0x1, 0x2, {r93, r94, r96}}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r97, r0]}}, @rights={{0x2c, 0x1, 0x1, [r98, r1, r0, r100, r0, r101, r103]}}, @cred={{0x1c, 0x1, 0x2, {r104, r105, r107}}}, @rights={{0x24, 0x1, 0x1, [r108, 0xffffffffffffffff, r0, r0, r109]}}], 0xe8, 0x4004000}, {&(0x7f0000004180)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000042c0)=[{&(0x7f0000004200)="006e51457007fc50204ef22c3124c33fd5264ae5a617374062cfb945720c42b2e92450eb9f62c4ab1fed5fe7df82354d6a8b5cb15bfa8fc1cbe5c1ae0ead58b42038b2cf6f959340d063194546e638027ec30a9c51db5703274e8450d821c5c18dfa34445e37ccb9d0913a2163d5f4f60e35f956b68b9cc58c3a2c006e5fefe09e0ca952d49b2237b2af72332b0851d5968e08ecf7eeb900b98bb4aec4e06ad07a961216088b6e1640aed7180339aba893", 0xb1}], 0x1, 0x0, 0x0, 0x80}], 0xa, 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:58:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000600)) write$FUSE_GETXATTR(r4, &(0x7f0000000100)={0x18, 0x0, 0x8, {0x396}}, 0x18) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) r6 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r6, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$RTC_PLL_GET(r6, 0x80207011, &(0x7f00000001c0)) getsockname$packet(r5, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000180)=0x14) r7 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r8 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r8}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffffffffffc71, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="076304408000000003015f", @ANYRES64=r8, @ANYBLOB="06630440000000000663044002000000"], 0x0, 0x0, 0x0}) 22:58:01 executing program 4: mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000040)={0x7, 0x6, 0x8}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 787.964422] binder: undelivered TRANSACTION_ERROR: 29201 [ 787.973758] binder: undelivered TRANSACTION_ERROR: 29201 [ 787.986092] binder: BINDER_SET_CONTEXT_MGR already set [ 788.021887] binder: 5229:5276 ioctl 40046207 0 returned -16 [ 788.021897] binder: undelivered TRANSACTION_COMPLETE [ 788.022528] binder: undelivered transaction 3326, process died. [ 788.091307] binder: 5229:5276 BC_FREE_BUFFER u0000000020ffc000 no match [ 788.099024] binder: 5229:5251 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 788.106726] binder: 5229:5251 BC_FREE_BUFFER u0000000020ffc000 no match 22:58:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="40543e75f5bb03000000e075148c0f34"], 0x10}}, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x40020000000c) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8982, &(0x7f0000000140)={0x6, 'sit0\x00', {0x8}, 0x2}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) ioctl$sock_inet6_udp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000001000000000000000000d0c5906800000000000000000000000000000000000000000000000000000000080000000000000000e9ffffff00e3f3b902788b3ff4d91d261ce7c095d86f68f939c8ecdb9e79a40617d481f90717eceef2368ce2c0d8b1fb0d8b719acd2527fe8fe76245cfb850f006d3e70b5eaee3b7d98661a2882e78fb"], 0x0, 0x0, 0x0}) 22:58:04 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000280)={0x0, 0xfb, 0x9b, 0xc, 0x5, "4d548eff1d8e6396ada99107259c04e8", "0d327a4a38587faca4b3812dd125726c07304b44163f1f90a0be7bb563241b536a21f137f084c177cfddb66ddb53ea837222ffce59610ac19ad9604034b2a6e02695b01d3909c73e3baf0cf6cb640ee0734dc7289acb0f05dc1b1a14340e4c4e176d8b1a35a94f6eadf3b5067e3dc4fe990a5a55097b9029738b850ecd860ae8d1408e5a6994"}, 0x9b, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) r4 = dup3(r1, r3, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="11634840000000000000000000000000a3000000000000000000000000000000000000000010000000000000e30200"/76], 0x0, 0x0, 0x0}) 22:58:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x180) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) write$P9_RXATTRCREATE(r4, &(0x7f0000000040)={0x3ba}, 0x7) r5 = socket(0x11, 0x3, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000280)="a933fb23", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r6 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r7, &(0x7f0000000200)=""/250, 0x50c7e3e3) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) ioctl$PPPIOCGFLAGS1(r7, 0x8004745a, &(0x7f0000000600)) ioctl$RTC_IRQP_READ(r7, 0x8008700b, &(0x7f0000000080)) r8 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r8, 0x0) read(r8, &(0x7f0000000180)=""/19, 0xfffffe47) sendfile(r5, r6, 0x0, 0x4e68d5f8) getuid() ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000680a137e99aa26c3dd8f599afe92ef960000000000000000000000000000000000100000000000000200000000000000000000000000000000000300"/83], 0x0, 0x0, 0x0}) 22:58:04 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r3, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0xc4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000007800000000000000180000000000000089d4e259a6d15f37f81d6d8d0038de601de30f28026e5a72285f66cdb05a8fc1fb71d444e3f17e2d7aa5dd4724466973c3026878ec128d7698af72ee969817ac83ce265e33c046c28401ff3246a2d250496d7ace6454a7cf12693b630da8520a88784d038eb862cb6c977d29a8ab1686e08ef345172492ce3953c97cf552ce46", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRES64=r1, @ANYRESDEC=r2]], 0x0, 0x0, 0x0}) 22:58:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x800) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$FS_IOC_MEASURE_VERITY(r2, 0xc0046686, &(0x7f0000001280)={0x2, 0xa3, "9a4f81102710633a8e2150650e2dbbfe52bf7a156a70fe2d9a73c5141ba0410376163eadae9bbc700619fea49a4a20f4e59c070fcb8a721a7949b490f58aa57ebd29246680ee04327874b86a3bc23b4afdf0a6fe3d05a2667f50fb6bb3b7dd7eccbdbf24e89680d0919ccb21aa3590c0020f49c253fe9c07cf6ef958e5e1d328a1987d53e180160e8627aedfd6045320130274f40babf522b1fbe293a8043591f3cf73"}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="11630000000000000000000000000000000000000000000010000000000000e300000000000040d558000000000000000000000000000000000000000000000000e0ffffffffffffff00"], 0x0, 0x0, 0x0}) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r4, 0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r4, &(0x7f0000000240)={'syz0', "d24c445c672ba19fcd3c25ac654e21735fffb39228c9a7fff40b6846680da98c7ff519c437d0e40ec91b2e19cca1b024125de4da4e16c9b844d30a65f49bb323c44f38d79e2483f8ff722a39a4c09e7ade1a747cb4a1bcf0ca81c090a6990e9d9527045d3732c6dbb21aa523122b3c7187cc62cb695f74ba0a678b923ddf3717008b113cbb4ddad2984339f7df4328016b3223283ecce0c4ae0c28472e8111a1284f721284bee5755512bbb9ad1c2403161a39c00b4038cdb6b5ce0274cfec63daf8d0eb1c5e0d91c09bd88d101bdae1a4b55ef4516c2299d76bb4922445d1c0255d2206196d650f76a835ea92276ff024e1f43fbefb243b283a26595d04ae221738617e5369b0f4d0c750ecf18518f5714757865db994c4fc66426eaf83deb70ece1358f179726376855bb77d93f1aba988e1a61fbad630345cb43d38e72224342627977f457f1887babcd61978de0b88b532c8b3e7de7a248f7a46a96899672638f792d8b5440aeef9904a178e2a88a48cd494e387ba24eb5639e1717a0fd3696dc2d21b0cb68bd1d49224960c252ff6b5da2bfab82f96e5bd3f90e2558a80eb44b2d6731b9afda7f3922b06e5bf06e128d187f29db1946fe844b43e8ca234261cc36fee1c42eec19f0c6288dc6095034f46b843e7d2f1f4e37a73b436e1da9c8b374687b9effdfc115a4fe99177e96ff4be2017dacb3e7d6144a1f34d02931fbb31d176618a64d468fcea8c385bd8eadbe9d55e040204e69e761b3936ec3e64846bdaa1d418ca661a9de9a24ce2cb0b5ee6183eff9c043c4becbf32b2d69185a0fd96304830c73b80064e77ad33a09ef387af8f5e2110df8ea2183e0519b158cc1199f35587acb64a3ce095cbdbf867daca205c7fb539155740f857c11aaa7ebd500c65c89683401a700582229e22304d4711e8e5c4fa5edb3987c04a2fea7f2e8c79507eb02f080ff6e35081d0699b5fc06677300c657f678438c51583542ee58608b9b97864af140b56df7bfd2a0088e72dce62d74d564d314a41bff46020148c02051db96b352dda59b6dd374d0dbfb47612687d9d09255989d0fa32a039e10742dffc502151391bf1bd175119ae587c3d12ae2f411aa26a70ba799b35d1bac705346c96c39fbf2c8737141890f3c279bd47c36def351aacc12f730c08282e65ff85a30e12ac71357fe6a2a2fa727ae0bb925584590161da635326d04bd80072db183f53f1d72f7b949e57fa8bf9af526e5287198413f9b9ec637482eac77b32bc99cee32bbf710fbd8c496cc4335f6470c63cf8cae0f457a8eda546d24858e5c75668fd4bb51bb253ff9f56b79fb1f740612ef9d5bf8356a04ce9e9f7a193f1981cbc3bfb5f0fb29cc7f09e27e1027a698f74dd64bbe8f67cd0ee4e6797c25a033984eea821e872c85667efea16fb4087bb34b39f2874bdbdaf405e2392bf962892ad6624909c515f6e900113c90a68fae09091bf0995ed597d604b773571c76b5a549df1e02704f24c1b0e9f8518720aed065e8ba61932e1be19eeb41c2b09017636c16900906a9652a65d7cfde64f7cda51e28c74f01329cce935c1b6a44b561d1db958c1fd4c669caefeba26c2d5d0e01b4339904e4bb5cb8a955e10658af4426a51809eb0e35b38463f8e49ae9370bb35d31f77ab30416f62daf16530f694b8f603334ae643cf562146e5c6d00774267778ddda5834f1581951ae83b14aea95e8dab01ffb63eb6b28e250d16cb34e18d1f550529f08095de29a1ce5320ee03125f81d7e2bee799e6f117fb4ded343e8fd7f4d845b6f331385526e19a27590056b63bcae1f580e3e7faaf98252250e599f13e58c15d51675f1e42ff94f1222b458f540d414ebccd47b8a4cff1d9e96cd31a1f33e127146b2407b2fb4111b7827a77194b88173e8bef666fb74d1a11c69f4d4cb8f59193a908546965d04292e782a7233c68fe1d0411e02e41932e15d044c5ed4fb2b6d07df38e4d075edc8093d77dee3f8bcd682c9e31b89218a22d1b8b059879b4b7112ce454e68bcaead1914ca487f90ac2b17e3115c4d6c45ec88e93d4f0595244a96f5266c1fe538ab20b37969500c56ecd24853a54a5ed61f9d71af6deea9d8e7c760ed12aacb03284c1dfbfdb4c1615d9553caa6ce7c49a2d51c2af0d912d6d4db1ee54159d79aa62aabe649346836af6fd3693cf22010e3d6bffe40234005bfa4f727774b8c74eb42ca949a72f53eb19d071318c63273b9a29792bdb028ca91bcbb23e2210f5a21d81bbcdac3dcb1dbc7aea12a922bf498d6addb479a08763e23291c19f9bb0bf934c9cf196568e0b988cb92980fa0c6ff09bf0ae97cc8b3e85f308d953755e19d3cb2a23d3efbff1eba22eed76ae8e8f8b6109c0285fd2a9e949bb89738b42a8b9908791a5a1705e1c4b92bc14b4e0b2a876bf757bc6fa4d6f80019d312f1b79b09a5a3961102e28be645f4e193e1bb098c3cf7b3f99f570bb75ddeb2b5afe8ca6207c3300c9e8d33200d9f7c5c585f74e482f01b7460f1a3cdf72dbc0bfe72dd5bcc205d3abf55a52afc65ca0829df0ecca224c4238c9d2808892417c0a36afa79bf9aae601ea4f02acdd97748b83fc20413bfe4ed12fd480f7fa130fdf84153ebc790af3cdb1743302bcca29600e39d0ad59b095e1f4ce4ee4d00104335a0859e411197f6b961847ca3d3169b4be01952d3dcb4a67a3df72f79afc2925fb3e9b362b44abd91b47fbddabbd99555f4776b6d54967c516d46d1fb9e1e8b7b03601f5e8130bb0671135d8b02b40c095647f48edc45a9b43140724900c21f50783aa3b2de2a1d4b5174171602fdec45d315a0550378913d70e96b1f29c45681aac446041bdaabb676dad59a7867d33fd2ba8313614acc58109f02655c07380a067889afca6fac218b0987df547a2851ebfbc7981c25f25f0aeb9b516984b040d5ffc2460b75d07a796f705b2e6e7597c2086c282c885839066c5118df84434ce08cdf001074a64f6f929bd92670ac479a167015b869c212b0f262156c257a31a70e48f11fcf7295cfbcb7578af230541876449c8234d8fb79067ca31a1fa20f3722e3e76e4faae52bdafe429275f406185581451f65738822703be0bcdce9ef77cd93274818732e2c35f4732630498014d90dfba51c393144943d7aa4fb7018028a11c4a741ad8a6eba0b05e20f62e54f81faae9b5af3d134b0a5a5ab3a53cee20fc843934273915b2b0c5af694ac3f7960d4e306a0d8d6550a768e32b11bfecb6bc2fd2dbc62d239d4592d27a75644358de4800686df50f78309a0b2676ce0ecf4a06a2f2d28d4ebf1319032fc656b49623cb9f90514288630cd4e0de41e5e6125102f593926e56c267af0943bdca2c0c50ecf1b84d498f23c8ac996316f1f24f5e29072f32917b8daeec7e0754f593f74b06db5425c0fbdd745dc6f4a959b4e9135df4ae3527deca4d3551b62d7e2d23b36a3cb5b61a82e3a5aa072906e3659031d11f55b408acb539b078353ddcc8d81a22e31a637bf121b82f5836a65e905b21b1e929bd69ab6c138119040475031555eed784dbbeb819d34bbc7746e16ce03e3aef859eba750f18a607f419048454e7d1cd90f94e1d72d26ab788210b09f99be5613c1a749eab29578433fba7145bff99f42d7719412ac1d59ef46f7ce7fd93fc2ab24d230c50f990c9e9eac3ff68d49a4e2c06a99be57105a54887d103090665794a5bc8a035bcb45b6e124f118e538717a259136856f8cd6f8cd46e21b4a74d93fc7a55fa17a1cde43bf825a1aec8efeb665533403542b584b91b5255902babce286bdd57f2e33744be5e158a3baba6267a21c59e93dbcb3da5eaeb86eb13b471772aad03ac91480101fd7084cca18d57bb76ef07d2e68082dfe8484dbd672c1fea33c067cca730ce7b4be7e604a4f9e536b964fa03264523132507e73143ccc3d2333e7c67fe0c631bc7a866b4f4803136ce10e178bd2473d68300715d976c5344c3dc116cca04cdbc1022489ad9464724cf3ecde272c3a74b357bdfc5683a1e0ef61e04e1eb10068522b46507987db1c9ef506e16ab44546f16c8f4fbed0dce75651c6c4cbb106ef01c8f77004736df76d7b129579eafdf6d1e0ef5cdbe2652eddf7cb0bde9db37d4f117b70ffca7b5f1e179de3aa1bce45af9f6f4ebb56bd2bde3a3e2534e45e54b1fcff8795bcb3c1f7af43064c7d41596944437eb3ea139b8e88897f632e51eeb6006f7d7d8156cceb0a9d0dc593aab27f3efcfe2f5a8ac8a5ce27cb6cf5497d7d58c4f98b4327045ab2fadec2a6e3577d4f0c0f95299981a5e882f374877fb5091522baaab808279ecb6121202052579ff2d48a89613e5f54f7ad61b293569b1b35be88b807a76c6c0c50dc99c123b641ab08d7a5cc27ff48e7a9ad1638bd7abb0488125a44fcef9cdae27e82da7875d768fa4a34278034074546f76ccb3386d63ab2ddccdba9ec7b3829f3ea762989ffb167902f5b872f9fb666c42bf12d3db14325af567a243ca0710a7729378cf9751e9154b0c1759f314fdcac7cb6b96df2ef95fd9760397e9678f896358f39e6d2c12c90eeec51587e82b29fd19233227d5a5c29b62565392cc50df80c39261e35991cb9f256c01d724bab1829a4d66935da59e88d2e11f01bd9d27bf7c440da32a2b1c7b34725aec13031281136f1c839d6f3c7caf7903c9dffd1c0b02762de64c183d4f5f1cf7ad26f062b36a030722fa83e9ea25eddf6cd4575dbc9bac15420a01094fa7a064aa872881b50a5a9d774c00b5226431f92969887db12686af0cb3a789d4f26811f2283a0625e490b35ef5ed44a92373bec16155dd2cab3099cb7dd4f8c539210f62a3c4ef5933652eb8b233b152493ced3228b948ef16566e1946e407c33f85a149e80c0292929a0df25bc6e0adb8bde139538304761c2fdabda813e54ce74478fcf5c3cc3473c7e3aaec93231045be4bed490172b89ce8905026db7380b1c544231f7d0eb95bfb77630b1091b846db6de350f2f5633f8e98609a428143f4b5af02a5afe065f5518f2d7322a478366091d5d05367ea552905b0c7d54a7b2de931fc4267e35ee011618ded33f00554cbdbb84707dcbbee053b0b02ca66ef92d2782c5f411e1d113383eace4999cd7227e60fda2514ac233fd262780d0a17cc0c4c57b198bfc63921e7305eef42255574e20ea84a5c182b1a0ab27c4e85dabd19690e4c4760f65204f25d175650894fafe7c027a19e7b6b7ec939794fbe0e24c9317bacc39abc7aee021e51d819ac130e7f7ee80fe4304a29e78481f06a3325bc0e659dc309c129548d3e58c5f0b2f7861c3c8f84f263a71c57dec165a628c8b8a84743b55431db70b3a49281d0eb22f59f4b43c6ff92222b92d94c105b9ddf90de82d11bcac0dec65dc759fa2c07578c9f06823f03395993cebb404c31833d4bf889f0fa40710d9750eb669a60acd1717c0e4d11e8b6e15204bb1fa8d3157156a2f073088a76f954a888a0a14349c0a1d435b976f09a512ee6be15eab4de3fdd040912ecb6281b4fc36fc1b489a990dfc61c44dd93b23c570823488c2e91425d2208ff0afdb62b323d05365628bbc89c763d6599f40ca26756fc5e20a60829a45a7ef8b96698d5f8f6154a2e7222302de2aaf42a74c13319eac5b5ebad0c1434f0a7b8fe35d8c10d78ed61c6999da6e48d6fcb6aefa501c3100b13519b39d406e8b0016ede35d8c5d51a1272c7ff65a5fad0f09c947a98398a0a889a550060d43f77575669923c301dee903cce145bb0da2205e581e6e0a983f5eb4"}, 0x1004) r5 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/se@inux/policy\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000000)={{0x1983a073f6cffb9d, 0x74dd87cd0f1e3155, 0x5, 0x1, 0x3ff}}) ioctl$NS_GET_NSTYPE(r5, 0xb703, 0x0) r6 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, &(0x7f0000000100)={0x4, 0xd7}) 22:58:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$TIOCMGET(r2, 0x5415, &(0x7f0000000000)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) [ 790.195735] binder_alloc: 5289: binder_alloc_buf, no vma [ 790.201813] binder: 5287:5291 unknown command 25361 [ 790.208406] binder: 5292:5296 got transaction with invalid data ptr [ 790.209017] binder: 5287:5291 ioctl c0306201 20000200 returned -22 [ 790.210564] binder: 5289:5293 transaction failed 29189/-3, size 0-0 line 3137 [ 790.210915] binder: undelivered TRANSACTION_ERROR: 29189 [ 790.215768] binder_alloc: 5289: binder_alloc_buf, no vma [ 790.215806] binder: 5289:5300 transaction failed 29189/-3, size 0-0 line 3137 [ 790.216077] binder: undelivered TRANSACTION_ERROR: 29189 [ 790.261411] binder: 5292:5296 transaction failed 29201/-14, size 120-24 line 3155 [ 790.268773] binder: 5302:5303 ioctl 5415 20000000 returned -22 22:58:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) r2 = syz_open_procfs(r1, &(0x7f0000000000)='cgroup\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x30, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x2}, @request_death, @request_death], 0x1000, 0x0, &(0x7f0000000240)="a231c78474de7e1eed379530964b761fa3a5461338fb250f18be10152c3010d540245310a39fb4b5f26f387c1796c3ca10befa51c707d9e426abe662b54e32a98cc146e05a693cde12d8ad249f210bdf1606081897db5f12570de8ee55bcf239ada44342573addb5b16452753e139d9a1efbe08c5e55d2c92b757d8b98f392051b9423c733c85413aae094f3fd11b10afbe3e290c093587ca2fcf47ddb1bf3273396024c29c4cd264bb99ebb8862ca035c52d441f6ae4d6351cf2867b24e8c44dbcf050f09b9bf6fc5655f9a42db33e3b21205ddea6bf6268653f49fec7e7429b4c3702d6424262564c541b2697d782181d9042ae830e85f4e6be4672fe20a63cc59049ccf9d7815266fad33f82f1576a0f5460d6254d806cb0039bf138cf50af5d58d2b7c969d79b1b7365206cadc2920549440c0069dbc563b206c3e09e6a68ec91d8b0fe522737ec0c1413026182061b715738e949d80275fefb03cdcd1bc35a68e4c978a60d24bb689d304a6b417383b3c181be334a4f6aec49c3c966962981b94411a47afcc19f71aebcd1b2de9adada3d1a79fa1c967f123d8ccf777888f93afbe99e30177df15ae771cc4ea794c47800c3649698f58c7ba9be6d816d06f586dcaa5b3720b1de19ec0e6f58d1661bdb488d52a9b9600db21b12ca7eda1e3833fe401a80d9ce7fb3eb7ad3e6ef457bdd94dd9a4c89a690bb8e9966b1639006f0e289ebbd670611428480a4dc822f44820156f5f53687e47c6936c4de7a1ba3a9b2b06e0614dfbddecc0d08dee41b60a801090e0bb75dbad419ccf9f3dd06b45b28d29eb412f669f505ff62ad898fa5534f65eca8b659b5fbb39672678bb52283b8a520db38bb7bc9085fcb3fb75627cbac648bd9a78905cccb603157cf43b8c4cdfb7d09926132f2bdc3200607920926d5b48f32cd578ff59cf3a00c4baabf38efd3ae37eb4a11415c3fad8d78e8f97ab469af9f55885c70404340efd981e8f8ad84613fe1bf3ab3cf9af847335cb4fe5cc1f787c9d809a6d37b479faa9aa8484e7512a3d457694cf1fc3deb1e885c613ff775925b098dc781ad2a065a28b5a090211a7cb145408c7414b616f738cd4b004d6ec1f283f8a7bdb969792a3f1fa5829ce2fce19cddee2086ea0319ab3c0178597fc06e8a1ef7dd83e44b7a3042638e535b605203b1d60aa1a47c1bfaa6f709bbd124b909a4b077f41008ea5f1fef20494d6dfb1d54892b4687c9c18b098369dde2b147e8bf17ba411f1bdf14aefa8375de5374c30c6aed280df3f9c48d0cd0ce5558def61349c69e618a6ef433d1e7c416b67ab9539418af552212671c0671c92d864a51490c5529fcc940d351de443d1facb400f0e9a09aae82536d45aa8a6bb7bb7f5cab748799018e60c5060900014ce4496949a863b53e162a8564d562b87f3f3a5369a6c9b173a67417b3485ade279d005c5475394dfbd1ab1e90b663f4b7a3624db0ea4ad1a6131deccf99e56b848f73c0ade4a62d024adf360a6822d5469c6cff5ef8f0eaf5b42151ef2a4182ea599eee3e0a62a16ad390f60dd73118afd516f2bf306f7153080c12eb8980f579482aca4c39312cc0a2382ed12136163e73e5ef99bdbff02501d57524cc43c7e40780f5b77b24b32003373fccbff3817195b12f971637d72beafaae1fb5df6f82785f48fb2939394beb1a04477347c46ccd0020b5172a8b06e0d734fac4bba2a45631c61a416c2059b41f78aefe42c006b735b9cdbc59e1e26dc61c22039607655a1cb24f5947a79f092079ebebbd8f441a4bd96ee6ac03b189b0e9ce44a910f05a794ba4c5e6673eec9f6d9277b20a6d8d256cdca4b87a3dc56384173e3ad534a952ad0180753328d96fd2db2c5bece34e677d77716fedbcacd5778e58dd35792af3d63c40e52ed6144c7dc32f11c71545531ca5cfa79cb7c4fc46969e084b95512a577f234525884a40c96debd6efb76bcc237209e2aa95fad147d453be29131010c3cdba44a9f34ead1176ad25c3885281affd850f190eaa3389934b034ef1d39962f591b7dc4347d591952971b0843b7203f9631d5942263a39e367bc853267ea64a9e05db254d86be0b854a2ae53ec3ee0edc4827b4c28c8be63326411237b7a3224bae467d5dc324318f2c1fb604450300c15f7a931fe0d545bd3afd445bec39f7d77860135c3e0dcf0401dd6973abbb257f9efd3308fcfe14bd6a4d1a7119e16468d3f670c8132a92e91a9f280a3f5fe11891986c189ae75dbdb2da8d13cb7b125db269e03e7324a5ce1115c74b37e5d8d060258d54a3bffc62dfd49542591b791ef1da36e52d38d0d0a82bfff07aedb41ca04eb48a637106343475b7f2b2c6a181826e4e57520ebbff738f4c5701f7fbccea54a5e14908c3bb820102d2730cfaa603679ec9f904160d463b32408c658a365131ae45f6ab12b261eeaf8bf05ce3d2a8fedfb7a551b5b298deb091857841269d072b43a4d90bd0c1c86a5e4d1e66c0287b28e7368957e66b3e5a6e4ab11585c821042d07a4208f8625473bf8d4b59354f43844c0244d793981c9155df88a697f29ce21d08dba1abe2b22cc8f0c603b42a39974ff87eef8ea6ab88ecdb6bd2a06f21d4c2ad54acc4a90f4cad6645575930b89ff2038a51996a61b31d061697c1eee817b4c0f08f060201b6edff1313637d414574b7ce6788286ac689827e5c4a694b78d1d6facb37dfc76941a4a06bc70d2dc4b879023ccf303aa9d6a893eb77f5d381baecbf448d3cb21fb9564bb0a1fd8b6eaa9263ab5d8f45557033e68f51fcfe3ee8d626ef692009044e50457bf89a9b653528c89d0205c646c4d277c81fc515e8dcc2297f0942910b19ec153e5703d3c1614bc44dd2cfa4d92784df7b6b2b865cc20d0bd071b5a5b94057a0b31038d56818721f6b7ab8e68fe5b376ae769e8169ce85f5bc8418ca748bba8969045a47655dfdc120444a46ae5bb9de9a863f6662600e6ba143afca27032ef016c70844fe0715b6577ec00953aced625b5f0262b69d565f6e016da01076ac738e2dc324bbf891b140acdc994c6290471cf346add11555f3951c59df8c64afd8fb9ba165dcab7b058c653a606b5f4fc639854dceb7733e54ed6a6801675187ce7f120609bac3f539a055e9a1658e06d351c2fad2d59a9a6881a8a6e36af737c5c5acf56b411265d33172291f00b329920f80e3d3319c459c0be46d74e1733eea9feef4aa8b09c87210a80e18111a89a8e3e3a161f861ed877c6de2eccc19f73f3fb1d51815ed036dd04434d9ae8f98fb15c62b2d34c2c9ad358a55a19595b3f0a13e648a0bced9d12f3a7f11e2cc0fdce349870e71b2feaacd3cdae02b804215e11248bde9caf57cc2653956bed224775ca8e74b2578592ebeb9c333b8d0e846a7aa9286beb8e22df2f61e0ef5ffff531b70baa531b4c4336d336ef9624d38940b373cddedc98435823bb7e2bc67c072795abd763879f027ca3574871dd194972f6a3dddc0cafd9fee47cc2b1e7d682f906dfa1dce8bc4844fa257908f64a12a46cf0430478d5901e0ba137d6cfd6594102ef86e3d280d311b01398260b56395590cbea88baaae825b4c2f075b8a172a6295c2866577c90d0f5d6a1dc167664a4ae16f000c9ac598d50ba3486d0ff076813ca003f0fc13e2d6f04d39280ec514e3a06190526d8b66af4b409c76780d7c0076544d66cde858ea71db8a3bdee14e23f71d486fbd773c8d8ce1b417b05fcd710ca8957fe6c6d5fe780af2970672e787958e4f539797b49967a053297c5796cd363c0c5534be9eb20bc0929aa079685765c820032f75f487a77a0d551c2bc32a3a9d9f3dec3525892205eef5db57d749719fbb8d5e3057968a3ec823fb33fff621dce46b171a6b915be7ec91caf0f64d5382b616503d05311c4ba3f32fabbe1d8d7cd5559d70fe2e4a899fd20cd6512fc184d519b82d99a65571a4e1a08b9d1a96db661bb9ff8becc34d8668d358863c689f8d4a6ab16952e8fecfabd83ab80d45b4349aa6f357418bef1e3fa4c5b62386a7e11656df4555000f5dfc5190d495d773933ca7f9975b0cc0321fa5629d6b0510df572f4008f0e889eca4c577d531d55905aa5d34f39a6079adce0eef9f7f5624be727354a72a2351b9722ff188bdb2b2b3022d44dd4eef1945e8dd6cf8c521c037cb3f05ddc9312da35e9a7d6ca1ee7449d2f1da43315297a58d97320ce572e8876a3358f78ac278b4b11a42b48020ccb533d67cff0169cdf7a91c31eb9a88b88bad4d450d51bf5aedec912e0c770808b47aea839a389005bde13bc3b6e55a5b6aaed9d30339d62d35f7928f4fbbdd37bd5f19eff7cf2adc8f768647aaf758649c211949edd3b8ee6c03c0f2e8f436865e090eeef10bba898e244cf281870185fbc1f3b8e40154f94c1b9538e5e52bf4e5192397fa569e9270135ff6f9d144700f4ddb2a44d37a141bcc26dfc5232d8b8657102c4f565b065b441b0fc2b6a0d565907ff619ff4da8e6adce8570cc1f6a15ba96662b97676c89b84734e5391f4305208d93f4288f8b8fbde6497d6f197f2705b387e04f94bb69724fe8a153cf26e4074a2e57d01316af55ed54a3198e08586e2109577f95b51fbb2401da4a0e70105cdb9b0656a1bce76400a2ff11c6950db05bdbf7191241f59e660975723f280be3e0df0b41b2ad6ada0cfefde182e99946d40f5c253fc513115f79d8c14b98b51b9f617681fdf2f07aba763dccd43cdfb34b74eb39cba58036f4c7404c76ecacae4614200d475e8cadd00b100f03d6db9942e1d72e8af4cb58e1f658a769f10e9d36bd4e4fc83374109eed0190bcba9bc94d67071821007cff14bd0c3dc2bad5e118897f38552aa2238ec30d186ae5600c93c74795de6be88b7384b8f76400707c89dbcb2ba6c558eb591bcabcbcb27fad1a24ff00e8c1ab352083b4728ff8d64645bc88d8c981602efa151a76bcd4c1414c3dc8c849b0e4be457cd4093e4c8adbb2c8237ad15f373fbcbcbf8cfcc1724da1a8d9f56ff795b4d0f97820e20e504cc629a52846c5a0901bc2ab53f6790b0dbe34106dd9583af20c19e460ca0a53dcafdb9a1eadf4763d6403fa098e00cc9b888e72e04fe5ac0cbca610c6755fea1cf858d69a94a9822154f13e48552b678731e05cc012f53fb87186e06a6a6e85a56c461bbd4bc0ec6de821a235ef2740187d2e7c691c57b9fa6839e459f548ebb5032b3acff68d044de20da132b410b3e4d0098529b1d35eff16005a1e9e56a763b577c89c8f2a777db45969d4ec5919a404742259be16e8a8d252fd1f3cbbf05ad76ef86915048dc204e5b6e1fe165ff6628512e3df14c57b3ecccbcb5c12753147563d0671206ea343b648e36354071131ee6f9ad76b177e64a1f5ded001e20fe195c16980ffa58c0e5e688190090403c4b67949e3b047e078cd267a8ada80552c1604237488be1856bf237279227884d5f74b2fd3bdafaa4f3e5e0879ae6d98268ed524ad2759acbfabb7e75b831045f8ff61e8dc8a47e82ada736d70610f48664d220f6d7ddf3ca77f78735403b559b4b87b5b726ed23bd7b0f2fddea432df79f3a07a6c0cd264709606b896c50c2739ee65066576c3f905224a182f60cef9f90016dc883e812efa361f5df569efea459c9653815a7359741d00c3c5eae6505152c3fa9d32377795e3e3a9c9d8753dc1ee77296991f3a27f1113799cc407687fe1bd680e8148544e4bd536a0cc2f09088efc0b7259bbd227fcbdbcf3e3c090ed0d0a16602046708a3f6ea2815fbf0c24d0a"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x3b) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r5, 0x0, 0x0) sched_setscheduler(r5, 0xb, &(0x7f0000001240)=0x7) r6 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) setsockopt$inet_opts(r6, 0x0, 0x6, &(0x7f00000001c0)="936f3952ab861cef40e2b4d09621c7f0afd6c670ecb5ad9fbec1f40f074451c32ec3aa627dca9e5abcfd67f9e17b8be8d1a53aad63e69e68b6ecd7c76aafb67a87fdb469bd", 0x45) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 790.295377] binder_alloc: 5294: binder_alloc_buf size 2151018850806137536 failed, no address space [ 790.309373] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) [ 790.320262] binder: 5306:5306 transaction failed 29201/-28, size 0-0 line 3137 [ 790.327904] binder: undelivered TRANSACTION_ERROR: 29201 [ 790.328569] binder: 5290:5304 got transaction to invalid handle 22:58:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) setsockopt$inet_mreqsrc(r3, 0x0, 0x28, &(0x7f0000000000)={@rand_addr=0x844f, @rand_addr=0x94c, @multicast2}, 0xc) r4 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r5 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r5, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) [ 790.328577] binder: 5290:5304 transaction failed 29201/-22, size 268435456-131072 line 3014 [ 790.356001] binder: BINDER_SET_CONTEXT_MGR already set [ 790.368712] binder: undelivered TRANSACTION_ERROR: 29201 [ 790.374811] binder: 5288:5314 ioctl 8912 400200 returned -22 [ 790.382663] binder_alloc: 5288: binder_alloc_buf size 4840 failed, no address space [ 790.388214] binder: 5292:5312 ioctl 40046207 0 returned -16 22:58:04 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000200)=[@clear_death={0x400c630f, 0x2}, @increfs={0x40046304, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r1}, @flat=@handle={0x73682a85, 0x1, 0x2}}, &(0x7f0000000140)}, 0x1000}, @register_looper, @release={0x40046306, 0x2}, @release={0x40046306, 0x1}, @enter_looper], 0x0, 0x0, 0x0}) [ 790.388745] binder_alloc: 5292: binder_alloc_buf, no vma [ 790.388786] binder: 5292:5312 transaction failed 29189/-3, size 120-24 line 3137 [ 790.422463] binder: undelivered TRANSACTION_ERROR: 29189 [ 790.437604] binder: BINDER_SET_CONTEXT_MGR already set [ 790.458277] binder: 5318:5320 ioctl 40046207 0 returned -16 [ 790.475491] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 790.493192] binder: 5318:5320 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 790.502403] binder: 5288:5314 transaction failed 29201/-28, size 4096-739 line 3137 [ 790.503005] binder: 5318:5320 IncRefs 0 refcount change on invalid ref 2 ret -22 [ 790.503013] binder: 5318:5320 got reply transaction with no transaction stack [ 790.503021] binder: 5318:5320 transaction failed 29201/-71, size 0-0 line 2922 [ 790.503408] binder: undelivered TRANSACTION_ERROR: 29201 [ 790.511633] binder: 5318:5326 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 790.511643] binder: 5318:5326 IncRefs 0 refcount change on invalid ref 2 ret -22 22:58:04 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1673cbff9e08f69ba9ab3659144af100"/37], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 790.511650] binder: 5318:5326 got reply transaction with no transaction stack [ 790.511658] binder: 5318:5326 transaction failed 29201/-71, size 0-0 line 2922 [ 790.511944] binder: undelivered TRANSACTION_ERROR: 29201 [ 790.594161] binder: 5329:5330 got transaction with too large buffer [ 790.609796] binder: 5329:5330 transaction failed 29201/-22, size 120-24 line 3295 [ 790.629140] binder_alloc: 5316: binder_alloc_buf size 4840 failed, no address space [ 790.629578] binder: undelivered TRANSACTION_ERROR: 29201 [ 790.642291] binder: 5329:5333 got transaction with too large buffer [ 790.642351] binder: 5329:5333 transaction failed 29201/-22, size 120-24 line 3295 22:58:04 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000008000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000c60000614e00852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r2 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r2) add_key$keyring(0x0, 0x0, 0x0, 0x0, r2) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r2) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) ioctl$VT_ACTIVATE(r3, 0x5606, 0x3) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000000)={r2, 0xb0, 0xc2}, &(0x7f0000000140)={'enc=', 'raw', ' hash=', {'md4-generic\x00'}}, &(0x7f0000000200)="49badb724aaf3b9a91d7957d63c3705be64ce8697e83b84c844a064acae163f660ef3d96eb424307534aa2b8cc103e05c2c06077e362d764022796cd5dfc85c052a6bce1ccc88fcb6d0c196e24a0ef3d00b706c36e834d265e332f7327d95940e973a4fa105f75b4f7b63027619dc2fb72d91011b472e46f3e836e7857abcde249e5eb01f56b47d691f42a66b42e69f8a8ab8d5308b9d5000b73dfa9525dab073a2afd01f7fed0967f5cd3822465b8cc", &(0x7f00000002c0)=""/194) r4 = socket(0x4, 0x3, 0x53) r5 = socket$packet(0x11, 0x2, 0x300) r6 = socket(0x1, 0x2, 0x0) getsockname$packet(r6, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r5, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r7}, 0x80, 0x0}}], 0x300, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000040)={'vxcan0\x00', r7}) [ 790.642639] binder: undelivered TRANSACTION_ERROR: 29201 [ 790.686708] binder: 5336:5337 got transaction with too large buffer [ 790.693370] binder: 5336:5337 transaction failed 29201/-22, size 120-24 line 3295 [ 790.702046] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 790.710924] binder: 5316:5332 transaction failed 29201/-28, size 4096-739 line 3137 [ 790.998385] binder: undelivered TRANSACTION_ERROR: 29201 [ 791.006845] binder: undelivered TRANSACTION_ERROR: 29201 [ 791.190222] binder: undelivered TRANSACTION_ERROR: 29201 [ 791.486784] binder: undelivered TRANSACTION_ERROR: 29201 [ 791.512555] binder: BINDER_SET_CONTEXT_MGR already set [ 791.517939] binder: 5336:5338 ioctl 40046207 0 returned -16 [ 791.524222] binder: 5336:5338 transaction failed 29189/-22, size 120-24 line 3014 [ 791.583650] binder: undelivered TRANSACTION_ERROR: 29189 22:58:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x6c, 0x0, &(0x7f0000000380)=[@clear_death={0x400c630f, 0x2}, @enter_looper, @request_death, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@flat=@handle={0x73682a85, 0x101}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/117, 0x75, 0x2, 0x37}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/176, 0xb0, 0x0, 0x6}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}}, @register_looper], 0x7c, 0x0, &(0x7f0000000400)="534c8911e636f8f899278ab31001e3b1d53aaef54bc4a9216081220ab8e1c7754e90e4bc90231f762b5dd5842dc1ba4bc6970069c57bd63d892774a56192491b79f52a9e6ed309ddb2e70df1cf6a19373bdaeb6903decca6ed5d8447ace682f728c324d53d84ede7a9ed692f2276e55a14510ef0a8036d25ef535200"}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f00000001c0)={0xff00, 0x9, 0x5, 0x7, 0x8001, 0x6}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:07 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000280)={0x0, 0xfb, 0x9b, 0xc, 0x5, "4d548eff1d8e6396ada99107259c04e8", "0d327a4a38587faca4b3812dd125726c07304b44163f1f90a0be7bb563241b536a21f137f084c177cfddb66ddb53ea837222ffce59610ac19ad9604034b2a6e02695b01d3909c73e3baf0cf6cb640ee0734dc7289acb0f05dc1b1a14340e4c4e176d8b1a35a94f6eadf3b5067e3dc4fe990a5a55097b9029738b850ecd860ae8d1408e5a6994"}, 0x9b, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) r4 = dup3(r1, r3, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="11634840000000000000000000000000a3000000000000000000000000000000000000000010000000000000e30200"/76], 0x0, 0x0, 0x0}) 22:58:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$TIOCCBRK(r4, 0x5428) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) 22:58:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x3ec208b0b000b0a5) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$packet(0x11, 0x3, 0x300) r8 = fcntl$dupfd(r6, 0x0, r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000340)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r8, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8c0060}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x68, r9, 0xf6b98f7d4236dc16, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x5}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_TIMEOUT={0xc}]}, 0x68}, 0x1, 0x0, 0x0, 0x40414}, 0x4000000) sendmsg$NBD_CMD_STATUS(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x7c, r9, 0x10, 0x70bd29, 0x25dfdbfe, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x47f}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4fa}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8001}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_SOCKETS={0x2c, 0x7, [{0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r3}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x1) splice(r2, 0x0, r5, 0x0, 0x1003, 0x0) ioctl$TCGETX(r2, 0x5432, &(0x7f0000000100)) r10 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$EVIOCGVERSION(r10, 0x80044501, &(0x7f0000000040)=""/8) clock_getres(0x6, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="f05a7e14000000000000000000000100"/62], 0x0, 0x0, 0x0}) 22:58:07 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000010000000000000e30200000000000000000000000000000000000000000000000000000000000096cc82348fe7b49b7b741d05e275312bbb2bb24aa45fc1c3e1ae4f85f9080887d46cdfc423079b42bc3559693afb0ad46702b5bb1106ed7e021e3e3ea1f9f3be814aa38d02e038320e52060c13b8c21c110816fbd4569c5ba26d1215dc4ecbcffac17bdf4f537087a0f9"], 0x0, 0x0, 0x0}) 22:58:07 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) fsetxattr$security_smack_transmute(r2, &(0x7f0000000500)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000380)='\x10\x00\b\x00', 0x4, 0x4) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r4, 0x0, 0x1003, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) recvfrom$packet(r1, &(0x7f0000000200)=""/197, 0xc5, 0x40000000, &(0x7f0000000180)={0x11, 0xb214c4463235aa92, r6, 0x1, 0x5, 0x6, @dev={[], 0xc}}, 0x14) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r7, 0x0, r8, 0x0, 0x1003, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r9, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r9, 0x8004745a, &(0x7f0000000600)) ioctl$PERF_EVENT_IOC_SET_FILTER(r9, 0x40082406, &(0x7f00000004c0)='wlan1&GPL@,-}nodev%(\x00') ioctl$FIBMAP(r8, 0x1, &(0x7f0000000480)=0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r10 = syz_open_dev$binderN(0x0, 0x0, 0x0) r11 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_RX_RING(r11, 0x10e, 0x6, &(0x7f0000000000)={0xa72, 0x3, 0x3f, 0x4}, 0x10) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600000000e9ff00000000000000000000000055831df96d"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000284f00e5db0000005000000000000000"]], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r13, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r12, 0x0, r13, 0x0, 0x1003, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r12, 0x10e, 0x1, &(0x7f0000000300)=0x7, 0x4) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000003c0)=0xffffffffffffffff) 22:58:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000480)=""/219, 0xdb}, {&(0x7f0000000340)=""/88, 0x58}, {&(0x7f00000003c0)=""/36, 0x24}, {&(0x7f0000000600)=""/220, 0xdc}], 0x4) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @fd, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16, 0x0, 0x1}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}}], 0x0, 0x0, 0x0}) r3 = fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) ioctl$LOOP_CHANGE_FD(r3, 0x4c06, 0xffffffffffffffff) syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r4, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x48, r5, 0x800, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x20}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x20004800}, 0x800) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/enforce\x00', 0x40, 0x0) [ 793.216683] binder_alloc: 5348: binder_alloc_buf size 4840 failed, no address space [ 793.230484] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) 22:58:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000100000000000051631399c9ae260c991e9c28e63d00000000000000000000000000000000000000000000000000f9c0530d00"/90], 0x0, 0x0, 0x0}) creat(&(0x7f0000000000)='./file0\x00', 0x716dfb06296a9b8e) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$PIO_CMAP(r2, 0x4b71, &(0x7f0000000040)={0xc332, 0x94, 0x100000001, 0x153d, 0x401, 0x5}) 22:58:07 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$inet_buf(r3, 0x0, 0x26, &(0x7f0000000000)=""/80, &(0x7f0000000080)=0x50) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r4, 0x0, 0x43, &(0x7f0000000100)={'HL\x00'}, &(0x7f00000001c0)=0x1e) [ 793.261464] binder_alloc: 5357: binder_alloc_buf size 4840 failed, no address space [ 793.268848] binder: 5346:5351 unknown command 343825136 [ 793.268856] binder: 5346:5351 ioctl c0306201 20000200 returned -22 [ 793.283959] binder: 5348:5352 transaction failed 29201/-28, size 4096-739 line 3137 [ 793.294720] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 793.304210] binder: undelivered TRANSACTION_ERROR: 29201 22:58:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) 22:58:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$FIGETBSZ(r3, 0x2, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) read$FUSE(r1, &(0x7f0000000480), 0x1000) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="16000000b98d03987b54dfbc5012bed1c82f5a8b4146ee170000000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) [ 793.322763] binder: 5365:5367 got transaction with fd, -1, but target does not allow fds [ 793.330185] binder: 5347:5372 ioctl 8912 400200 returned -22 [ 793.330346] binder: 5357:5360 transaction failed 29201/-28, size 4096-739 line 3137 [ 793.330437] binder_alloc: 5347: binder_alloc_buf size 4840 failed, no address space [ 793.330444] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 793.330481] binder: 5347:5372 transaction failed 29201/-28, size 4096-739 line 3137 [ 793.342783] binder: undelivered TRANSACTION_ERROR: 29201 [ 793.382461] binder: 5368:5377 transaction failed 29201/-28, size -1862066790687037778-61 line 3137 [ 793.397748] binder_alloc: 5378: binder_alloc_buf size 4840 failed, no address space [ 793.410687] binder: undelivered TRANSACTION_ERROR: 29201 22:58:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r2, 0x8982, &(0x7f0000000000)={0x3, 'ip_vti0\x00', {0xd447}, 0x84}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r3, 0x0, r4, 0x0, 0x1003, 0x0) dup(r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:07 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0xfffffffffffffffe) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 793.417888] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 793.426666] binder: 5378:5381 transaction failed 29201/-28, size 4096-739 line 3137 [ 793.445800] binder: undelivered TRANSACTION_ERROR: 29201 [ 793.466092] binder: 5365:5367 transaction failed 29201/-1, size 104-24 line 3241 [ 793.498440] binder: undelivered TRANSACTION_ERROR: 29201 [ 793.504282] binder: undelivered TRANSACTION_COMPLETE [ 793.511723] binder: BINDER_SET_CONTEXT_MGR already set [ 793.517848] binder: 5389:5397 ioctl 40046207 0 returned -16 [ 793.517885] binder: undelivered transaction 3389, process died. 22:58:07 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.net/syz1\x00', 0x200002, 0x0) fchdir(r0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x1, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000440)=0x3f, 0x12) getpgid(0x0) write$FUSE_LK(r1, 0x0, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000140)={@rand_addr="73d0226db513bdba574a6696ccda0a40", 0x9, 0x0, 0x0, 0xe, 0x0, 0x7fffffff}, &(0x7f0000000180)=0x20) socket(0xa, 0x800, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r2) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) fadvise64(r2, 0x0, 0x200, 0x7) r5 = creat(&(0x7f0000000700)='./bus\x00', 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000001b40)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) open(0x0, 0x0, 0x1c0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, 0x0, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) fcntl$getown(r6, 0x9) syz_genetlink_get_family_id$nbd(&(0x7f0000000300)='nbd\x00') sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000001c40)={0x0, 0x0, &(0x7f0000001c00)={&(0x7f0000001bc0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="738b1000"], 0x3}, 0x1, 0x0, 0x0, 0x8000}, 0x4000413) write$cgroup_type(r5, &(0x7f0000000340)='threaded\x00', 0xffffffc5) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r5, 0x660c) r7 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) symlinkat(&(0x7f0000000500)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r7, &(0x7f00000000c0)='./file1\x00') 22:58:07 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x18) ptrace$cont(0x18, r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x85, 0x0, 0xca}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 22:58:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1158d108b2be181cef535d0cf9b77b42c8d87e60723364000000200100000000000000000000010000000000000000000000000000000000002cc6e03406c3dd03c8fc59f1f9e35f0a55f0b93e3b0f8400"/101], 0x0, 0x0, 0x0}) 22:58:07 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r2, &(0x7f0000000640)=ANY=[], 0xffffff9c) r3 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r3, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) ioctl$FIBMAP(r3, 0x1, &(0x7f0000000540)=0x3) recvmsg(r2, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x1b1, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4091, 0x20013a5a}], 0x1, &(0x7f0000000140)=""/29, 0x6}, 0x100) r4 = accept(0xffffffffffffffff, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @dev}}, &(0x7f0000000480)=0x80) setsockopt$inet6_tcp_int(r4, 0x6, 0x17, &(0x7f00000004c0)=0x401, 0x4) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) ioctl$sock_inet_SIOCGIFDSTADDR(r5, 0x8917, &(0x7f0000000500)={'bpq0\x00', {0x2, 0x4e20, @remote}}) r6 = accept$inet(r2, 0x0, &(0x7f0000000180)) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r7, 0xffffffffffffffff, 0x0, 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r7) getsockopt$inet_buf(r6, 0x0, 0x24, &(0x7f00000002c0)=""/85, &(0x7f0000000340)=0x55) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000002c0231c9115fea39c5470bb2ba05dc67aa3f20fbd43c1bd8cea0e8a83b2f", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 22:58:07 executing program 0: socket$inet6_udplite(0xa, 0x2, 0x88) r0 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x101640, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) creat(&(0x7f0000000100)='./file1\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = add_key$user(&(0x7f00000003c0)='user\x00', 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffc) keyctl$setperm(0x5, 0x0, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r1}, &(0x7f00000001c0)=ANY=[], 0x0, 0x0) gettid() ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x0) ioctl(0xffffffffffffffff, 0x1000008913, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x5e9, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xfffffffffffffd64) ioctl(r5, 0x20, &(0x7f0000000340)="ab58b876e7f2d826a351f1c5e8df51f3d588") ioctl$KDDISABIO(r3, 0x4b37) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r6) r7 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r7, 0x8200) r8 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x40000008}) ftruncate(r3, 0x3) getsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0xcc, &(0x7f0000000140), &(0x7f0000000300)=0x4) ftruncate(r7, 0x81ff) [ 794.016582] binder: undelivered TRANSACTION_ERROR: 29201 [ 794.038756] binder: 5409:5412 unknown command 147937297 [ 794.048024] binder: 5409:5412 ioctl c0306201 20000200 returned -22 22:58:08 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x48080, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000100)={{0x3, 0x1, 0x9, 0x1, 0x37}, 0x98, 0x10001, 'id0\x00', 'timer1\x00', 0x0, 0x357, 0x2ceb5bdc, 0x0, 0x6}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x10000) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000040)={0xf878, 0x2e02, 0x235, 0xcf58, 0x1}) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) 22:58:08 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="16000000000000000000000000000000000000000000000095fb9999a3b21f1f6cd607b44a2014fb0eae036650467d6589e13f473fbed6b5010adc5f0b6a4a766ebeb5e21a30ccb75d446de2ac96433490101bcfe2ae3a23a555d3d021bb01a798dba76fc2fac6bbd0684baf1b019108f4af52eefa2d8cc3e8464ec3cfe1f0d75e90c7"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) ioctl$BLKTRACESTART(r2, 0x1274, 0x0) 22:58:08 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') r4 = openat$selinux_create(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/create\x00', 0x2, 0x0) splice(r4, &(0x7f0000000240)=0x40, r3, &(0x7f0000000280)=0x8, 0xf4ce, 0x0) splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f0000000000)={0xc, 0x6, {0x52, 0x3, 0x6, {0x5, 0x2}, {0x1f, 0x80}, @const={0xc9, {0x8, 0x8, 0x4, 0x2}}}, {0x2d, 0x54b1, 0x6, {0xff, 0x5}, {0x5, 0x3f}, @rumble={0x7, 0x1}}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000100000000000000000000000b00"/76], 0x0, 0x0, 0x0}) [ 794.155360] binder: 5433:5434 got transaction with too large buffer [ 794.162280] binder: 5433:5434 transaction failed 29201/-22, size 120-24 line 3295 [ 794.191601] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket 22:58:08 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) vmsplice(r3, &(0x7f0000000400)=[{&(0x7f0000000000)='i\b', 0x2}, {&(0x7f0000000240)="ab4638b75dd212efca670259412781bc5aad56cec00a8bfed25e010abdf5db26212dcc80b78d7e326f67d1dbec8b138aa82e08951696e12c0926e342a2129f5cf34d3c2cd36891ecd09a2d0fa93b14edc850ab67ad5ddee29a41be623d1a424e378705653c7c41e8ca9e256eebdf42377e70aec0a334720d1a1775d10c3dfa99946f3194f312074483234a3afcf847838c59273d675e0ab548d14b378e9507aad27fd01c3bc65a5f8ae7d50c6843ef9071cc13", 0xb3}, {&(0x7f0000000040)="08fdc6439ee1a47ddd06fbec3c77c4244e3692c486ad58f8bee631656968", 0x1e}, {&(0x7f0000000080)="acfc2dd2358cc1c9362118b2290b8ede35986fe0207635c4d508e1864b3134c540e0ec4244c39e0b7d6c12f88fbae432fa55a80e4cfb37018498e68d6e01fa40", 0x40}, {&(0x7f0000000300)="cd946f7c1b1a3dda275b47584ee092e7329db1f2c3726a835873d98f20b01925d31486f1a43317e17447e0be442479a9a9f6f8385526fa817c5428a4df44001081acd77d9cf123478081d1fc12fe26dcba6476fc3bf31a6f78189874b2241238bf9bc26cf71cf15e5b7d42f7e9b0aa9d39c32e581d71bbca24fad3bee555e71ea7fceda68462004d5aaa8ae399751d3656e739b90d0edea69ac7471bb0bc0e5036cdcb5b54cac41167469140fe170e1524ebe7691ace969a2a63bbbf4caace074671511793a7b1642038663fc2bcca9280bbad1b9be87726a0", 0xd9}, {&(0x7f0000000100)="13e5930cde13494c35df7575109815db09c6f3ac1489de5821f44667b5ba5c66c24f8c78", 0x24}], 0x6, 0x6a4d69b1920ecab6) [ 794.261188] binder: 5441:5443 got transaction with invalid data ptr [ 794.271934] binder: 5441:5443 transaction failed 29201/-14, size 11-0 line 3155 22:58:08 executing program 3: mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0xf31806ec25c736e3, &(0x7f0000ffc000/0x4000)=nil) r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000005235feffff00000000"]], 0x0, 0x0, 0x0}) 22:58:08 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e249ed8e64d44621276f0b575096265820b41a5551221a4f47de5391e22bbe7195632eefc195ece5d8f1f54156eb07fdcf622a505909fd1d33063e7a4756c990d85ac7c771"], 0x0, 0x0, 0x0}) [ 794.314732] binder: undelivered TRANSACTION_ERROR: 29201 [ 794.335295] binder_alloc: 5450: binder_alloc_buf size 4840 failed, no address space [ 794.379199] binder: 5457:5459 got transaction with invalid offset (5908722711110090792, min 40 max 120) or object. [ 794.393206] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 794.417039] binder: undelivered TRANSACTION_COMPLETE [ 794.423263] binder: undelivered transaction 3408, process died. 22:58:08 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = epoll_create(0xa92) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xa8, 0x0, &(0x7f0000001540)=ANY=[@ANYBLOB="00634040030000000000000000000000000000000000000010000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009a77e5170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400"/4096], @ANYBLOB="00100000000000000100000000000000140000000000000085616466000000000900000000000000000000000000000018000000000000008561646600000000000000000000000000000000000000003d00000000000000"], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="11634840030000000000000000000000000000000000000030000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a62730000000001000000000000000000000000000000852a646600000000", @ANYRES32=r2, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB="00040000000000000e630c400300000000000000000000000763044003000000"], 0x0, 0x0, 0x0}) [ 794.432799] binder: 5450:5452 transaction failed 29201/-28, size 4096-739 line 3137 [ 794.443499] binder: 5457:5459 transaction failed 29201/-22, size 120-24 line 3199 [ 794.460169] binder: undelivered TRANSACTION_COMPLETE [ 794.475218] binder: undelivered transaction 3410, process died. [ 794.492479] binder: BINDER_SET_CONTEXT_MGR already set [ 794.500505] binder: 5457:5459 ioctl 40046207 0 returned -16 [ 794.507820] binder: undelivered TRANSACTION_ERROR: 29201 [ 794.521467] binder: undelivered TRANSACTION_ERROR: 29201 22:58:08 executing program 2: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000000)={0x9, 0x7e, 0x1, 0xffffffffffffffff}) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000080)={{0x2, 0x0, @identifier="407b928ba4c63bb4245253e34607e211"}, 0xe0, [], "3ec9d7a7e8cdd6caf7253e132cb725c151fe2142ea76270fd88ee71940eef044cd9f69800e831945917c4b5c3533334bdf6f99418908299848ae0d50abe526edbb49f8a9b0ed09f969c443fffd54bd878b4ca511a54deeea02c4cc07d09b3d5479cec88f0b2815a3faf36da44a8e5c2e0e2ba0b6d8ad4629500e2259343035e990ddde37efbfef716f3a3fe845cee9d81ef0401be427d6d7b736fe9a43c276f568c4491c2a5b83a8adc644189dafff90bfdf2e7d0437208f7d4eb3c1a480762e6c91d3a5e7fab0c4e04bbd8a026ba85563dcca3f4bcedce62d939d0cd0e13729"}) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f0000000440)=[{&(0x7f0000000840)=""/252, 0xfc}], 0x1, 0x1) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$LOOP_SET_FD(r1, 0x4c00, r4) tkill(r3, 0x3b) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) capget(&(0x7f00000001c0)={0x20080522, r3}, &(0x7f0000000200)={0x101, 0x4, 0x81, 0x1, 0x9b, 0x2}) 22:58:08 executing program 0: socket$inet6_udplite(0xa, 0x2, 0x88) r0 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x101640, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) creat(&(0x7f0000000100)='./file1\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = add_key$user(&(0x7f00000003c0)='user\x00', 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffc) keyctl$setperm(0x5, 0x0, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r1}, &(0x7f00000001c0)=ANY=[], 0x0, 0x0) gettid() ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x0) ioctl(0xffffffffffffffff, 0x1000008913, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x5e9, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xfffffffffffffd64) ioctl(r5, 0x20, &(0x7f0000000340)="ab58b876e7f2d826a351f1c5e8df51f3d588") ioctl$KDDISABIO(r3, 0x4b37) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r6) r7 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r7, 0x8200) r8 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x40000008}) ftruncate(r3, 0x3) getsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0xcc, &(0x7f0000000140), &(0x7f0000000300)=0x4) ftruncate(r7, 0x81ff) 22:58:08 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x1002) socket$inet6_tcp(0xa, 0x1, 0x0) fchdir(0xffffffffffffffff) prctl$PR_SET_PDEATHSIG(0x1, 0x0) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x0, 0x0) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/Dev/`inde\xb5\x86\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000)={0xf1100000, 0x6, 0x6, 0x7fffffff, 0x8}, 0x14) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 794.616258] binder: 5467:5476 got transaction to invalid handle [ 794.622572] binder: 5467:5476 transaction failed 29201/-22, size 104-24 line 3014 22:58:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x4000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000020000000000000000000000000000001500000000000000852a747000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000e5c4c232afe79a2bebbd7d38108586c6b10627a17f31555c09771bb7c42c45a14fd615b424dc257191ef8782c5a98b"], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 22:58:08 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) socket$inet6(0xa, 0x5, 0x26) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14b002, 0x0) ftruncate(r1, 0x200005) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000140)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x1d2, 0x0) sendfile(r2, r1, 0x0, 0x8000ffffffff) [ 794.710787] binder: 5492:5494 not enough space to store 2 fds in buffer [ 794.718722] binder: 5492:5494 transaction failed 29201/-22, size 112-24 line 3278 [ 794.728680] binder: undelivered TRANSACTION_ERROR: 29201 [ 794.738426] binder: BINDER_SET_CONTEXT_MGR already set [ 794.744718] binder: 5492:5498 ioctl 40046207 0 returned -16 [ 794.751038] binder: 5492:5498 transaction failed 29189/-22, size 112-24 line 3014 [ 794.759511] binder: undelivered TRANSACTION_ERROR: 29189 [ 794.820492] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 794.903812] binder_alloc: 5479: binder_alloc_buf size 4840 failed, no address space [ 794.946306] binder: undelivered TRANSACTION_ERROR: 29201 [ 794.948027] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 794.948072] binder: 5479:5505 transaction failed 29201/-28, size 4096-739 line 3137 [ 794.970556] binder: BINDER_SET_CONTEXT_MGR already set [ 794.976534] binder: 5433:5444 ioctl 40046207 0 returned -16 22:58:08 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = signalfd(r1, &(0x7f0000000000)={0x7ff}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x16c, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:58:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f0000000040)=0x888) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$TIOCNOTTY(r3, 0x5422) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r5) r6 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r6, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r7, 0x0, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$PERF_EVENT_IOC_ID(r7, 0x80082407, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 795.117655] binder: 5511:5512 got transaction with invalid offset (364, min 0 max 120) or object. [ 795.144486] binder: 5508:5510 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 795.155072] binder: 5511:5512 transaction failed 29201/-22, size 120-24 line 3199 22:58:09 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net\x00', 0x200002, 0x0) r0 = socket$netlink(0x10, 0x3, 0x7) r1 = accept4(r0, &(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x0, 0x0) r2 = eventfd2(0x0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000000)) r3 = eventfd2(0x6, 0x1) fstat(r3, &(0x7f00000001c0)) write$P9_RGETATTR(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000580)='\x00\x00\x00\x00\x00\xe8\xee\xc9\x96\xc2;\xaf\t\xa8M*\xe4;~y\xb2\xb3\xba\b;/\xb6&\xa5\xaa\xcec\x1e\x8a\xc9n;v<\xd6h\xb0\x15\xaf;x\xb5;\xea;P\xb5w^2\f\xe5\xcc`\xa0\xce\xf0+\x19v\xb9I\xdf\xfe\x13\xd9\x1a\xd6;+\x16\x05\x1aul>\x82@\x0f\xdf\xcd\x99\x9a\x13\xe2[F\xf0\xc1\xfb\xae\xb5\xb5\x1f\xf3\xe9\xd5\xbf\x13k\xbc)\xa1nbx\x9c\x02\xa6p?\x12\x89\nAr\xe9Q\xb0\x80Q\x8e\xf2\xf0yX\x9b\x96\xa4\x8b\x01f\xe0\x04\xbd\x93K!\xa0D-\xfc\x12\x02\xe2\xb5WQ\xb4\xb1\xf2\x16)\xc8\b\xc2\x99\x9a\xd9\xa6p\xedK(\x0f\xadG\xa0\xa1\x13\xd78Mt$\x06\xb6c\xd0Y\x05\xd1l\x98|\xff\xb5\v\x93\x7f\xbc\x1a\x7f\xa90xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r7, 0x0, r8, 0x0, 0x1003, 0x0) dup2(r6, r8) fstat(r0, 0x0) r9 = perf_event_open$cgroup(&(0x7f0000000480)={0x3, 0x70, 0x11, 0x0, 0x5, 0x2, 0x0, 0x23f, 0xc9a080666dc8c606, 0x17, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, @perf_bp={&(0x7f0000000340), 0x5}, 0x2, 0x2, 0x8001, 0x3, 0x8000, 0x5, 0x800}, r0, 0x9, r4, 0x2) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) fcntl$dupfd(r9, 0x0, r10) r11 = open(&(0x7f00000000c0)='./bus\x00', 0x800000141042, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r12, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r12, 0x8004745a, &(0x7f0000000600)) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r12, 0x8982, &(0x7f00000003c0)={0x3, 'yam0\x00', {0x800}, 0xfff}) setitimer(0x1, &(0x7f0000000280)={{0x77359400}, {0x0, 0x7530}}, &(0x7f00000002c0)) ftruncate(r11, 0x200004) sendfile(r0, r11, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./file0\x00', 0x0) 22:58:09 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x201, 0x0) write$cgroup_type(r1, &(0x7f0000000040)='threaded\x00', 0x9) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 795.174643] binder: undelivered TRANSACTION_ERROR: 29201 [ 795.185989] binder: 5508:5510 transaction failed 29201/-22, size 120-24 line 3199 [ 795.235393] binder: undelivered TRANSACTION_ERROR: 29201 [ 795.248428] binder: 5519:5520 got transaction with too large buffer [ 795.282259] binder: 5519:5520 transaction failed 29201/-22, size 120-24 line 3295 [ 795.302706] binder: undelivered TRANSACTION_ERROR: 29201 [ 795.326017] binder: undelivered TRANSACTION_ERROR: 29201 [ 795.338272] binder: BINDER_SET_CONTEXT_MGR already set 22:58:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="116348400000000000000000000000000100"/76], 0x0, 0x0, 0x0}) [ 795.363351] binder: 5519:5526 ioctl 40046207 0 returned -16 [ 795.381760] binder: 5519:5529 transaction failed 29189/-22, size 120-24 line 3014 22:58:09 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death={0x400c630f, 0x1}], 0x6e, 0x0, &(0x7f0000000140)="5f1765e7544ae794664d5ccc73a663c026ff6c6fec3e3b29a8d65db12169ce3012561c56eb37df4e9f88bd74a85868603b275a3d8735440fd49af0796bc9710e1f412803eeacea37b85fba1b06619f3a88367b97f083b43888af0f6f39d22a8d6e15c5fd7f507e68ee364fb6a10b"}) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 795.411599] binder: undelivered TRANSACTION_ERROR: 29189 [ 795.431750] binder: release 5530:5531 transaction 3429 out, still active [ 795.449423] binder: BINDER_SET_CONTEXT_MGR already set 22:58:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000001d000000000000000000000001000000000000000000000000000000000000000000000000000000009800000000000000000000000005000000000000000400"], 0x0, 0x0, 0x0}) clock_gettime(0x0, &(0x7f00000019c0)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{&(0x7f0000000040)=@ethernet={0x0, @dev}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000100)=""/31, 0x1f}, {&(0x7f0000000240)=""/201, 0xc9}, {&(0x7f0000000340)=""/66, 0x42}, {&(0x7f00000003c0)=""/246, 0xf6}, {&(0x7f00000004c0)=""/193, 0xc1}], 0x5, &(0x7f0000000640)=""/231, 0xe7}, 0xc759}, {{&(0x7f0000000740)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000001900)=[{&(0x7f00000001c0)=""/36, 0x24}, {&(0x7f00000007c0)=""/61, 0x3d}, {&(0x7f0000000800)=""/218, 0xda}, {&(0x7f0000000900)=""/4096, 0x1000}], 0x4}, 0x5}], 0x2, 0xe133a211a1d773f3, &(0x7f0000001a00)={r2, r3+30000000}) getsockopt$EBT_SO_GET_INIT_ENTRIES(r4, 0x0, 0x83, &(0x7f0000001bc0)={'broute\x00', 0x0, 0x3, 0xc1, [], 0x7, &(0x7f0000001a40)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000001ac0)=""/193}, &(0x7f0000001c40)=0x78) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)='cgroup.subtree_control\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000001c80)=0x7fffffff, 0x4) [ 795.479968] binder: undelivered TRANSACTION_COMPLETE [ 795.485058] binder: 5530:5535 ioctl 40046207 0 returned -16 [ 795.485938] binder_alloc: 5530: binder_alloc_buf, no vma [ 795.485978] binder: 5530:5535 transaction failed 29189/-3, size 0-0 line 3137 [ 795.511701] binder: 5536:5538 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 795.559667] binder: BINDER_SET_CONTEXT_MGR already set [ 795.573887] binder: 5542:5544 ioctl 40046207 0 returned -16 [ 795.594420] binder_alloc: 5530: binder_alloc_buf, no vma [ 795.613423] binder: 5542:5544 transaction failed 29189/-3, size 0-0 line 3137 [ 795.637738] binder: undelivered TRANSACTION_ERROR: 29189 [ 795.648141] binder: BINDER_SET_CONTEXT_MGR already set [ 795.667250] binder: 5542:5548 ioctl 40046207 0 returned -16 [ 795.668374] binder: undelivered TRANSACTION_ERROR: 29189 [ 795.668584] binder: undelivered TRANSACTION_ERROR: 29201 [ 795.668713] binder: send failed reply for transaction 3429, target dead [ 795.698747] binder: 5542:5549 transaction failed 29189/-22, size 0-0 line 3014 22:58:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) ioctl$KDGKBLED(r2, 0x4b64, &(0x7f0000000000)) [ 795.736468] binder: undelivered TRANSACTION_ERROR: 29189 22:58:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="116348400000000000000000000000000100"/76], 0x0, 0x0, 0x0}) 22:58:09 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) sendto$inet(r0, 0x0, 0xe1, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e20, @local}, 0x10) writev(r0, &(0x7f0000000440)=[{&(0x7f00000003c0)="b1", 0x1}], 0x1) write$binfmt_script(r0, &(0x7f00000009c0)=ANY=[@ANYBLOB="23ff1f0a8117fb62d5eb1b3c750c75c5533f018823a1699743876915922a9b66379e3db9e86db57e1d384bfe3042c49ef9134937af481f2b44e023b3c35f0b8810707ed2659a715f3b513e33fd96c9d3c9afed9390b357d0744ddc020aedf819000000000000000832ff0769dea9ed32487d2bf1ac37afcf98d817857774004608d609000000701f793b97fdcccc622708000000e69857745a810000810000009755979c72f645e9898fb9d61b0ec3a669af77550098323d177d4900"/201], 0xc9) close(0xffffffffffffffff) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0x8bc, 0x11, 0x0, 0x27) 22:58:09 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x304080, 0x0) getsockopt$inet6_opts(r6, 0x29, 0x36, &(0x7f0000000280)=""/187, &(0x7f0000000080)=0xbb) setresgid(0x0, 0x0, r5) setgroups(0x2, &(0x7f0000000000)=[r5, 0xee00]) [ 796.013628] binder: release 5556:5557 transaction 3437 out, still active [ 796.022227] binder: undelivered TRANSACTION_COMPLETE [ 796.038638] binder: send failed reply for transaction 3437, target dead 22:58:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) r3 = open(&(0x7f0000000940)='./file0\x00', 0x80, 0x10) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f00000041c0)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, &(0x7f00000042c0)={&(0x7f0000004180)={0x10, 0x0, 0x0, 0x806880}, 0xc, &(0x7f0000004280)={&(0x7f0000004200)={0x44, r4, 0x120, 0x70bd2d, 0x0, {}, [@SEG6_ATTR_SECRET={0xc, 0x4, [0x10000, 0x232]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x6}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x54, r4, 0x800, 0x70bd26, 0x25dfdbff, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0xfffffffa}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xffff8000}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x9}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x1, 0x10001, 0x7, 0x5]}, @SEG6_ATTR_SECRET={0xc, 0x4, [0x0, 0x6]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x7ff}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) r5 = syz_open_procfs(r2, &(0x7f0000000280)='net/ip_tables_matches\x00') r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000900)={0xe4, 0x0, &(0x7f0000000700)=[@reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f00000002c0)={@flat=@binder={0x73622a85, 0x100}, @fda={0x66646185, 0x2, 0x1, 0x1d}, @fda={0x66646185, 0x7, 0x0, 0x29}}, &(0x7f0000000340)={0x0, 0x18, 0x38}}}, @decrefs={0x40046307, 0x2}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fda={0x66646185, 0x6, 0x1, 0xf}, @flat=@binder={0x73622a85, 0x0, 0x2}, @fd={0x66642a85, 0x0, r6}}, &(0x7f0000000480)={0x0, 0x20, 0x38}}, 0x800}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000004c0)={@flat=@weak_binder={0x77622a85, 0xc15b0b91e6ae3f7a, 0x1}, @flat=@handle={0x73682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f0000000600)=""/206, 0xce, 0x1, 0x8}}, &(0x7f0000000540)={0x0, 0x18, 0x30}}, 0x1000}], 0xe9, 0x0, &(0x7f0000000800)="9e73246e3be3d4684930e695eedbeb5e247890727f199635ca601e3480aab924475e1821d6256e494de0ff4830a509994f72362ec5d3b307254362ee8cab442ea9a120dc1201540b4b8c3bc3075d696928a8d0d39f9511ff0bc20c5f76a6ba1a12250ae9c54d250a50ebe27c0dd656eaf8cd2e4827a0954b9ff76e357a5648e3ea5d5753c34356dde8ff3f8ea15760fc28dd6ca7a8bd11ead10ce2fabe3cf9c818a09aee0ef9699613365e8d0f82a7c719e7d3dfc426f0e8b2b065a82f6d32b75353ef6d9ffbeb3ef96ac971295bb8a9855b3051279856fa0a8ae434f5358cc59b041b8a0985f93127"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) r7 = socket(0x0, 0x805, 0x7f) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r7, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000040)={&(0x7f0000000140)={0x64, r8, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@ipv4={[], [], @local}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0xe}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x8084}, 0x7) [ 796.083207] binder_alloc: 5561: binder_alloc_buf size 4840 failed, no address space [ 796.096405] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 796.110690] binder: 5561:5562 transaction failed 29201/-28, size 4096-739 line 3137 [ 796.128140] binder: undelivered TRANSACTION_ERROR: 29201 22:58:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000380)='/dev/bsg\x00', 0x84848f39b1eafdb1, 0x0) ioctl$LOOP_SET_STATUS(r2, 0x4c02, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0xc3a, 0xa, 0x1, 0x10, "15f9c38e7df893c42cf995696e3851f69c2437ecdf1a644315beb89116379acbeb454e86fbd386aefeba0458f66db9f25f6a4b699b0281402052d276e3cb24c0", "d96007c1e1c8208689cffb6ee417c3e2333df2783208889bce28023cc1073e83", [0x3ff, 0x1]}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000340)={0x58, 0x0, &(0x7f0000000240)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000140)={@fd={0x66642a85, 0x0, r3}, @fda={0x66646185, 0x2, 0x1, 0x9}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/89, 0x59, 0x0, 0x2b}}, &(0x7f0000000200)={0x0, 0x18, 0x38}}}, @increfs={0x40046304, 0x1}, @exit_looper], 0x4a, 0x0, &(0x7f00000002c0)="64ac18ba7c20f883e7692b2086dcd2a879733eff96bb8442b93b09a1143c5d6cacc88a31352d4795fb909cbc20354db6bf436d09972e9798a1eeade2f9cf6d545f52757e5ffaa6336d38"}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000600)) ioctl$TCSBRK(r4, 0x5409, 0xa6d) 22:58:10 executing program 0: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0xc00c28af09239543, 0x0) openat$keychord(0xffffffffffffff9c, &(0x7f0000000440)='/dev/keychord\x00', 0x0, 0x0) pipe(&(0x7f0000000840)) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000c80)={0x8, "5f5539ae7383df635d7eb9f00cde999ef4e1d4fbae589edcbcd64ae9781d89f20a7c347bd734db9d80a3e9ee0d0f04fe5305dacf9e656dc623d0d8abb05b81ebf7fa83533ebfe364612ee7d5571be6e3af5eccf0e26370ff66a26e95f4b7b1206b9d9a70fe612b356ec5074716b0e71eb9f60ac1c5e653c9a7de0de9a5f8c8047f77ece27201fc36e2ca04338864356e123b3b96be97afa5d6698e6f08a657f7ad07b42df05dfca83247581434b575e2d4419e52f1103e9e3ddc440a98f9caeace71f8affb3cfc62e4b428403787ff063d2923a50c0410f191c7923b77c51fea54cc7f2b8adcd2a5e1f53495c168736a160f28435b70f6e40df8523c2deaef8b70f13bc408d1d6eb05dbcae35f0c12cb00b8d589c0dda912acf9315852e1cbb85857f9421cd623fc5046448db22eec3c07358c4778c73a2495bf3452b18d8e904ed88ae250a99edb20b78fc923ccc841847a4f6d514320309afe2f0a075e50096c7a8cd4da2d88791d01a10cea10a97d32e8bb05a5e2bf52be5fffa3fb26953a0fadac598644cf0297d01d5c1ed9f2123ba789fa650b0d140a478903cc23a5b5c2a2a52f19bdd40039ac0291f648f1f991e272c52669f7843e73b3be22103fe0a88d5d405b9ecea5d602be0b5466d18d8a971b69a8e80e48621103a6bc6ee3a7b70b199005241779f22fa2cc159988eaf2d53c858ec06ab56acc232b587ffee3a5cb29f5641b2189fb1617d1a652e42511fe2e447a2636f18ceabc261126200193eb9f309f80aa204a93883bf6fb247ade866685f300295f8735e18d1d81365dbd2bddfa1779c59effed803bbe0a68302b1ab0f0d00892138ad24d52d653d92897bd28c2f031a77eae54ef3ce9a1fc44ea41763b2d780a454f68ea1a297302b4fa6664923a818040f5a74e0db3ff24e940e97d4abff40af2d36f7bceb8a0c5e90dbefbc8ba496f6e42f11ce11fb20655138f9387938abc3aa3a742f749a8695d972c537127519f654945bac96f0a2ef9d6b24f2226ae677684e3eb63041d6b5105777a8e6aa41ff11366448c0af1ddf5e3f2a1d828b4c9ede3809eab736c9035f2a7032ce38b699dfdc3e158e1ce62d325441e1b05a3ba5f663f20b0cb703cb2960aad298177881aa6b52bf4ae112c5d2bb691ac34b0723be7ddcfff0015e578475db1f062c5a50b54bbcba2f591eb4d6de66f386b0d5dd3975229ad25ae95d82266dfb9c1a6f497ef54b6ac5ee81edae16c47e89f9a435377dfac411db459559ce483921251745b8b94f69d4815b009ea86aedc5a75a516ff2afaff9a418f73c2cacbcdf45dd02ba962399f9b81e149635c2b4c0bda790a6d72fc243f6fbc73d0a0636db51c03d93b44b42c07f2269b465231f953e6a45dc549e9b5ef05443da7820cd667f5b0ff47a13f0a3df630a6f98f72e09978b829389d6a11afb0a7a0988822bb95fcb50399e51295f464662118646d2996da0fa710b082036820ae0a60828479bad4489061244b74179cfec74ab273551190c0eb2ca95be86391b8e469454796d04b29646b8aaae49889ffd84e83e33fb0cd7b10d778e72422f474911897dbd4548d9658e9af23cfff0ad4a7d750ab59e0f8988082ab7ac8d27eeab1c5809de6694aba8ee6ff1ba23d422f38dc026a77933cb0fc916d22131f7f736e35c881c5551f13a5037f65b9090372bb8e73bb9cd686715afef6b40ff275a978078c1e1c7db358285e5caee5c53cb4a7b446db91e5c0615342265edd9f09a72002aae56c7ad4269a0513569db514ee852724cdcccb72e8836fc270f7aa03e03e65f4572c2909e6fb1b557e89c3b505ba2f2b10b545513758abdbdc5b3e5ec1fe4d6bd5947b354058eccb79f10e971a85bdafa5aa27224acc734d884f9282ed033fc540defa3181d451713565d940879cd70a1d704b9a390de509351d5129bff18051b0c7ca196a78d3b8d0c8f384c79ad637b2e1770fecfc980960ef403cbc6bb284792cd169133f35aea028d9ffdc1668572dd197db86a26cb6fe1bb822bb76968ef2cd3c384704b75d0f17a50bcce054a400edd3b2f2abf72d2d8a679fdc94216d2d7d43ca1e60aeb5a313f8104f8ae54e75beb6c106cf080b9ecc9a1f91508b37d9ede25a1bede738c3a7f3501391a7b1863fe120ea26c4ff13f1de4588b150f3f2c12a9b9d92e6a8610c788c4d449a91416307a313536e1779bef88028d65a9398c5d1492b729d5f08e34e64fa07507f64297a1f9305a2d68169f653d5c107c9860ca0d822916eb357c646c229e792b1a5da56b35ab971bb82e41581e11f24f9c6b26c019dd2f2f89f2a82b74bd856ed7b46a2d9c07b2856bc39e9a28f271c5bb06db5bfa04d21e37e778b3e03071d25da8bbc91543fe8909603ba92e3455cb0edfe1dc040f12c169a97a5b8fb09f97acda29ab8491e7c9f81320b1a9de5773078557a6a0bdc5a1bfd2d953c47b3e5ccc70d76dc4ba10c297d7591e2c2150b8235de09714fedcf23aedb0ec9586e52f6af6c299256ad5a0a4ce22666be48592977dc5ff5c5eea529b81df4510016240b8fc8489bf59c899bb75481220554d0b9aebf1660cb72b01dfc3ffaac27dc1d36247e86339c6d99fc3ca8edf585fdb236ecdffda1b99819f873367ee5d8fde5d596517f895c9154deab01ca26008edbeadecfe33cae750ff044469a1b3b104b35af0c04a35a48aecf54dd8844b598432b81f67ce232ad46a247cad103274cd7c206d890008b149aaa3310f9794243cc5e04d4bd3e66a5b01ef67044412eba507a20399856cd26fb6233ebc064aa7b5ba94198bc05301dd74d6875b6d3b4731c2a11f0656767a3e6ba0a3d6951a7f9385ff99876891b8150ac5257756ef92a6c3854ccba8f13bca3cd3e66fdc93feefc44c3eba570970e0a6921f1eef24713ed5a174b8e52a0bc1bd3b420bdd0e521835289d29267fca4512caeaf64d1adeba2457864801d30d37e4eea965f8cfdb314f62307d8a12084a65da330f800862cae3876cdffe8c77d982ce9527b069628f0d796c0ec1c1b423ab6eb248e176a9b201d4de572f7901d8d88ae3dc6c3f196a4e3fb81552f16f7a7b7b3a242824b0618a855fc150fe8d484c80b3e1ea6c42f165dcfa7b0b292f9c7f27179d32260d4f472385a8818f7d76133030cf1256153b4162c8c3a3629c01e9b8cb5a30b3d0068d7f0e3727d8159739386511746fad1cfcc98c7af05b489876432957c6d59c51f12ebb62acac90311e6b00cea58b355db5a36718dfb8140d23e64e41ef9d33969cae75ea3ef8f14ad8c9b2d0c8bd7bf4366b091b5992ffbd71800495c0484cbee4b5fffaede0808cdcfa2409227e6b96dd82481d6d00bfff72c29f860b7fa4fa9c3634d9a2e4f7a8ef240c997b749e0562514d5c2c5d66da75149dea37b1cbb347fa0df5be2b9a5ddf20a6d47936b3b55cedc64453e69413a89c8a9eaeda00fccc96281b4f29db0f3e45fa098c77ffe3c0488529ecfa801cdf7fe8a23f6a3aa04acaf4e300c44e6d873f43b9fd4b13cbed2411c97378e07c7a6799d272d36ac8964233130947ed88f727915fa58a4812ceacd6cc6a52bc7fcba5e57543e93d293d5a428c73b194f33ba752b0ebeb0262423e7a8f490707a220857f44e191304cffb93cfc75b217ca306292549c8742fe3aa62a464d40c666115015201c0fef3e9555615f91c3d15b6e1556a9b04febc2ae7e3d689ca5f58b51f2717ae8c5153f2c2a4df11ea8cafcc369327c2a0a6f7946daf09be323d59e4b0e42ebcdeca373a6d70a3286382f1405b7107af899da00dbd52324657870bd18ca26f3ef47e0e81cd335c827512e88f24202836e7a1b505f0d03a23d577430d971458a11ff42e36b2d2883b664d402eb7497a90ba1f94829b6d9c6b4c4f7e9dc49882520a6fd2590cb8b41328541b9076e43f6019c3da9084e57960478c268f4215bb98455fbd2981e7e37caf7aaf9008f87cfe196da930637c55da5a34e142a433494e6f92a5985d7e6fc0ec68d2ad25144919af6dc81afc88cd05f01b401730bccc3086c9dd06d38ed522e52e7ffae7671898fb91cec0821c061aaea6c47ae877d2d7f5ca1ecf159e0ea152ce713f652c116f62e12cad293331db922a5fed311ab22096d90fc17ccc53f84d46eae680def0b9949e0d9debff263d575e590941a5ce0b33548beb6dbc01104f6054da73cc349625adece6a54e092d8d740915b91d81df30374a78693d6b69724f05354d61ac0febff4a544b88954d11d3f4927895edf6ad755313227ac87f24f12d70a831df16bd45c4a03570fdf27d698fa5581fce2d002890a3f2059a6bfdf77f0aeee3ad8318449bc1b2d486b225b148a78e921c73a2c37256dfb1ad611e410d5436e0d31d00ab5177da7915a74ef3307927c23c764f5cf62c3e2db86284c9abb39045b625d507f5c8d440557b4dad2a39593fbb572cce25a364aae44134fdd97ef0148690881bee42b6bd929f12cdf07996597a2a8366b12841f8fb8dfc0ece651756637b95c6bdb92320302805b4a700e7d3dfb0b8878862f400f8437a6c153b5fab40d30af07e73cf4345cb6fa81574018a7bc0e8789fae8b8560f4b93d413fa8e0e0218527ccb82873fc9da6cc34b6197c1d8bd9223ab7c4efb1f8cf021450037f4576934d83116655c120062fc3b912176fd395ccc792d492f2730465f8b4c68155b6ceb52e80742d2970e24004171f4685cd78467a4e943a0fecff66dffff10922d69236460dc37c1df9b19dded1ecb932dd8dd2045d2f8e8d3dfb6a83a65d6623553a2aed7a12b78effeeaa58eec84cdefc84923177afb7bd04f6fc3d3332d63ed5c5d6fe8820b9853e7615407eb23962f5232db44bc0267e7f07e47b158de0732a974b80aeb00ffeeca83d26fe21e487ea4472cd9048f942155784af8f68006cdb4286480a7ffa1ba6e93fe7fdb33283359d28bf9311dee59899e0e77aa113fadda21526c8e2bd60f21e182b735a5b0177fb95e948857c6c4ae391b2b4950a35b129e7bf25b7eb2c0857290c55f5d28b78ca1f39f0cd676610805b0a378647ae958182b26de1ddbf80e80d7ab1d2476086ed192e98bee0969bc0e8765278cb5570ccc29ac6d7298821bff4f85895deffcf4ce54a69878cfb41eade0d8703cbcff02352733ace2d800ba68b0fdcc52b94247ecacddf80ad228cf76eb547d276d0f6402054e34c3569e2b53ea3cbc54e49e099372cde3acd1ba47f836a765f855763a175a58ec4d6cecc72375da2d8c956c2868e77bfdb697182b554f0b743d7095cf13a3ba1d19e7590c281bd09ce235898a9682aacb5633b4fa4c3bdd71139c20c518b6a7651a47df7658a5a7ed41b3e7e43543d68c1dd4a5d01ec7e42cabdd6963db84f0d69b5a471ff8b929a8774baee39b14ab325af2ea7756c656c0135a59568499208341333d6b896cf0cc10108970e20313df241d179bd2a4d2392b269e6aeb9d2570bba7e3c67f49e90cf95562f93077a5fb588225724d444fcd8da55921dcff7b0be49ac0171ae98209e729f65bcebe447ccc0a185719f3fd55d1ae263daac4a420da91d05cdfc85d48e5743483dbb6fe81e5c216948953d95d5e725db17df44f05a57c6cc425e55572f9163e536a6d2d51d5213c937f6ddba08fc1f90ec73088a766a685f2c0d43b80422d48eef23b2ea588ea26b8dffb4f0df0cf91d6ea8f14a663ba2b165e4427010742fe63905d62b9dcf2385dce09fe75e4746d5c9c402ee77bfc9f39a28eb9f2751a81b090a499706accafbf5ae1afa9af350fd7481bb", 0x1000}, 0x1006) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001e80)=ANY=[]}, 0x1, 0x0, 0x0, 0x1}, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) fstat(0xffffffffffffffff, &(0x7f0000000380)) write(r1, &(0x7f00000001c0), 0xfffffef3) mknodat(0xffffffffffffffff, 0x0, 0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000080)) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000325f23)=""/221, &(0x7f0000000080)=0x83) r2 = epoll_create(0x5) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000100)={0x200f}) r4 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYRESOCT, @ANYRESDEC], 0x4e) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @mcast2, 0x2}, 0x1c) sendto$inet6(r6, &(0x7f0000000300), 0xfdb8, 0x4008080, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r6, &(0x7f00000092c0), 0x4ff, 0x0) socketpair(0x0, 0xa054b98f838cc548, 0x7f, &(0x7f0000000180)) faccessat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x1600) 22:58:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x840}], 0x0, 0x0, 0x0}) [ 796.167476] binder: release 5572:5574 transaction 3442 out, still active [ 796.187908] binder: 5573:5576 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 796.198883] binder: undelivered TRANSACTION_COMPLETE [ 796.207425] binder: send failed reply for transaction 3442, target dead 22:58:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000000)={0x0, 'gre0\x00', {0x4}, 0x2}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) memfd_create(&(0x7f0000000080)='/dev/binder#\x00', 0xa) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000010000200"/70], 0x0, 0x0, 0x0}) [ 796.214612] binder: 5573:5576 transaction failed 29201/-22, size 120-24 line 3199 22:58:10 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x102001030}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0x68, r2, 0x200, 0x70bd2d, 0x25dfdbfc, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x80000001, @link='syz1\x00'}}}, [""]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x40) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 796.253827] binder_alloc: 5583: binder_alloc_buf size 33558528 failed, no address space [ 796.262290] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 796.267253] binder: BINDER_SET_CONTEXT_MGR already set [ 796.267261] binder: 5536:5545 ioctl 40046207 0 returned -16 [ 796.267675] binder: 5536:5538 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 796.289539] binder: 5573:5588 got reply transaction with no transaction stack [ 796.299956] binder: 5573:5588 transaction failed 29201/-71, size 96-24 line 2922 [ 796.303430] binder: 5583:5584 transaction failed 29201/-28, size 33558528-0 line 3137 [ 796.329219] binder: 5589:5590 got transaction with too large buffer [ 796.335958] binder: 5589:5590 transaction failed 29201/-22, size 120-24 line 3295 [ 796.344006] binder: undelivered TRANSACTION_ERROR: 29201 22:58:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) fcntl$setlease(r4, 0x400, 0x1) setxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@ng={0x4, 0x8}, 0x2, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 796.350496] binder: undelivered TRANSACTION_ERROR: 29201 [ 796.367870] binder: BINDER_SET_CONTEXT_MGR already set [ 796.385013] binder: 5589:5593 ioctl 40046207 0 returned -16 [ 796.397919] binder_alloc: 5594: binder_alloc_buf size 4840 failed, no address space [ 796.418683] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 796.442296] binder: 5594:5597 transaction failed 29201/-28, size 4096-739 line 3137 [ 796.467627] binder: undelivered TRANSACTION_ERROR: 29201 [ 796.609521] binder: undelivered TRANSACTION_COMPLETE [ 796.615145] binder: BINDER_SET_CONTEXT_MGR already set [ 796.620683] binder: 5551:5554 ioctl 40046207 0 returned -16 [ 796.626933] binder: undelivered transaction 3435, process died. [ 796.633831] binder: 5551:5554 transaction failed 29189/-22, size 0-0 line 3014 22:58:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f0000000000)=0x80000001) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xa, 0x1}) dup2(0xffffffffffffffff, r0) 22:58:10 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000002700000000000000852a747000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="0000fadc4d6c2a068b0000000000000000000000000000000000000000a1cc5bc81d055aa228d368c4eb65e007812b94051fcf1375fbd76568a5121e2499354b4fbcb7e38fd178b35cf67abd5d220cbcd41fcce339f3ca38aeee88db707f42f243e333251898ec6fe7f05cedd0bf2f0cc1a039216a5573f02455955731284eef3102de3980c50c9094924bf6a27467f7b3c11aad7f49e68fe81fe07045fe06a0f9db05d1adde2a454c9d471b29cca2e5f3d5b69a9a83578a6d1fb325999552dbdb5ec244082a37df8e91d14d03eedc3565265fc2aaeb1d16125235b4d50ed01e96e312dd503e4ac3fc642873347dd38cb6d4808c929ba1ee670431d884a7a4688518"], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 796.687636] binder: undelivered TRANSACTION_ERROR: 29189 [ 796.712965] binder: 5604:5605 got transaction with too large buffer [ 796.725479] binder: 5604:5605 transaction failed 29201/-22, size 120-24 line 3295 [ 796.734866] binder: BINDER_SET_CONTEXT_MGR already set [ 796.740449] binder: 5604:5611 ioctl 40046207 0 returned -16 [ 796.752236] binder: undelivered TRANSACTION_ERROR: 29201 [ 796.753032] binder_alloc: 5604: binder_alloc_buf, no vma [ 796.753073] binder: 5604:5611 transaction failed 29189/-3, size 120-24 line 3137 [ 796.791937] binder: undelivered TRANSACTION_ERROR: 29189 [ 796.799474] binder: BINDER_SET_CONTEXT_MGR already set [ 796.810590] binder: 5606:5615 ioctl 40046207 0 returned -16 [ 796.816433] binder: undelivered TRANSACTION_COMPLETE 22:58:10 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x8ab, 0x37e) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r3, 0x10e, 0x8, &(0x7f0000000080)=0x800, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) r5 = dup3(r1, r4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) 22:58:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000600)) getsockname$inet(r4, &(0x7f0000000000), &(0x7f0000000040)=0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:10 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r0, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) fcntl$setpipe(r0, 0x407, 0x7) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r3 = accept(0xffffffffffffffff, &(0x7f00000004c0)=@hci, &(0x7f0000000140)=0x80) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000580)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r3, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x61000240}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, r4, 0x800, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}}, 0x2000014) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000100)=0xdb51) r5 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x4c, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000010000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB="852a747001000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00'/204], @ANYBLOB="cc0000000000000002000000000000000e00000000000000852a62770a00000001000000000000000000000000000000852a747001000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00'/83], @ANYBLOB="5300000000000000020000000000000008000000000000005ff4b0ff310c252497b90e4f241607d201f23a9b63421258c124b393694ade704df4d93089eaa586a40c9467cbe602edbf77474e85a9a5c464e6bf44b4"], @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="000000003b0d0d1da2e0d7e3f1fc00000000280000000000"], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) r6 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r6, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r6, 0x40045402, &(0x7f00000001c0)) 22:58:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) [ 796.852836] binder: undelivered transaction 3457, process died. [ 796.911927] binder: 5625:5630 unknown command 0 [ 796.917956] binder: 5625:5630 ioctl c0306201 20000200 returned -22 22:58:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$binfmt_elf64(r1, &(0x7f0000000640)=ANY=[], 0xffffff9c) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) fchmod(r2, 0x122) fallocate(r3, 0x20, 0x1, 0x1) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) ftruncate(r1, 0x3) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r4, 0xc0406618, &(0x7f0000000000)={{0x6, 0x0, @reserved="45b5a27445365b41b1c1bbd46a68d3ee73079103556e05b4184906cf448e27f9"}}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 796.955014] binder: 5625:5636 unknown command 0 [ 796.964523] binder: undelivered TRANSACTION_ERROR: 29201 [ 796.965041] binder: BINDER_SET_CONTEXT_MGR already set [ 796.965048] binder: 5573:5588 ioctl 40046207 0 returned -16 [ 796.966236] binder: 5573:5588 got reply transaction with no transaction stack [ 796.966244] binder: 5573:5588 transaction failed 29201/-71, size 96-24 line 2922 [ 796.994114] binder: 5625:5636 ioctl c0306201 20000200 returned -22 [ 797.029040] binder_alloc: 5624: binder_alloc_buf size 4840 failed, no address space [ 797.052131] binder: BINDER_SET_CONTEXT_MGR already set [ 797.056334] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 797.056378] binder: 5624:5638 transaction failed 29201/-28, size 4096-739 line 3137 [ 797.128114] binder: 5623:5627 ioctl 40046207 0 returned -16 22:58:11 executing program 0: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0xc00c28af09239543, 0x0) openat$keychord(0xffffffffffffff9c, &(0x7f0000000440)='/dev/keychord\x00', 0x0, 0x0) pipe(&(0x7f0000000840)) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000c80)={0x8, "5f5539ae7383df635d7eb9f00cde999ef4e1d4fbae589edcbcd64ae9781d89f20a7c347bd734db9d80a3e9ee0d0f04fe5305dacf9e656dc623d0d8abb05b81ebf7fa83533ebfe364612ee7d5571be6e3af5eccf0e26370ff66a26e95f4b7b1206b9d9a70fe612b356ec5074716b0e71eb9f60ac1c5e653c9a7de0de9a5f8c8047f77ece27201fc36e2ca04338864356e123b3b96be97afa5d6698e6f08a657f7ad07b42df05dfca83247581434b575e2d4419e52f1103e9e3ddc440a98f9caeace71f8affb3cfc62e4b428403787ff063d2923a50c0410f191c7923b77c51fea54cc7f2b8adcd2a5e1f53495c168736a160f28435b70f6e40df8523c2deaef8b70f13bc408d1d6eb05dbcae35f0c12cb00b8d589c0dda912acf9315852e1cbb85857f9421cd623fc5046448db22eec3c07358c4778c73a2495bf3452b18d8e904ed88ae250a99edb20b78fc923ccc841847a4f6d514320309afe2f0a075e50096c7a8cd4da2d88791d01a10cea10a97d32e8bb05a5e2bf52be5fffa3fb26953a0fadac598644cf0297d01d5c1ed9f2123ba789fa650b0d140a478903cc23a5b5c2a2a52f19bdd40039ac0291f648f1f991e272c52669f7843e73b3be22103fe0a88d5d405b9ecea5d602be0b5466d18d8a971b69a8e80e48621103a6bc6ee3a7b70b199005241779f22fa2cc159988eaf2d53c858ec06ab56acc232b587ffee3a5cb29f5641b2189fb1617d1a652e42511fe2e447a2636f18ceabc261126200193eb9f309f80aa204a93883bf6fb247ade866685f300295f8735e18d1d81365dbd2bddfa1779c59effed803bbe0a68302b1ab0f0d00892138ad24d52d653d92897bd28c2f031a77eae54ef3ce9a1fc44ea41763b2d780a454f68ea1a297302b4fa6664923a818040f5a74e0db3ff24e940e97d4abff40af2d36f7bceb8a0c5e90dbefbc8ba496f6e42f11ce11fb20655138f9387938abc3aa3a742f749a8695d972c537127519f654945bac96f0a2ef9d6b24f2226ae677684e3eb63041d6b5105777a8e6aa41ff11366448c0af1ddf5e3f2a1d828b4c9ede3809eab736c9035f2a7032ce38b699dfdc3e158e1ce62d325441e1b05a3ba5f663f20b0cb703cb2960aad298177881aa6b52bf4ae112c5d2bb691ac34b0723be7ddcfff0015e578475db1f062c5a50b54bbcba2f591eb4d6de66f386b0d5dd3975229ad25ae95d82266dfb9c1a6f497ef54b6ac5ee81edae16c47e89f9a435377dfac411db459559ce483921251745b8b94f69d4815b009ea86aedc5a75a516ff2afaff9a418f73c2cacbcdf45dd02ba962399f9b81e149635c2b4c0bda790a6d72fc243f6fbc73d0a0636db51c03d93b44b42c07f2269b465231f953e6a45dc549e9b5ef05443da7820cd667f5b0ff47a13f0a3df630a6f98f72e09978b829389d6a11afb0a7a0988822bb95fcb50399e51295f464662118646d2996da0fa710b082036820ae0a60828479bad4489061244b74179cfec74ab273551190c0eb2ca95be86391b8e469454796d04b29646b8aaae49889ffd84e83e33fb0cd7b10d778e72422f474911897dbd4548d9658e9af23cfff0ad4a7d750ab59e0f8988082ab7ac8d27eeab1c5809de6694aba8ee6ff1ba23d422f38dc026a77933cb0fc916d22131f7f736e35c881c5551f13a5037f65b9090372bb8e73bb9cd686715afef6b40ff275a978078c1e1c7db358285e5caee5c53cb4a7b446db91e5c0615342265edd9f09a72002aae56c7ad4269a0513569db514ee852724cdcccb72e8836fc270f7aa03e03e65f4572c2909e6fb1b557e89c3b505ba2f2b10b545513758abdbdc5b3e5ec1fe4d6bd5947b354058eccb79f10e971a85bdafa5aa27224acc734d884f9282ed033fc540defa3181d451713565d940879cd70a1d704b9a390de509351d5129bff18051b0c7ca196a78d3b8d0c8f384c79ad637b2e1770fecfc980960ef403cbc6bb284792cd169133f35aea028d9ffdc1668572dd197db86a26cb6fe1bb822bb76968ef2cd3c384704b75d0f17a50bcce054a400edd3b2f2abf72d2d8a679fdc94216d2d7d43ca1e60aeb5a313f8104f8ae54e75beb6c106cf080b9ecc9a1f91508b37d9ede25a1bede738c3a7f3501391a7b1863fe120ea26c4ff13f1de4588b150f3f2c12a9b9d92e6a8610c788c4d449a91416307a313536e1779bef88028d65a9398c5d1492b729d5f08e34e64fa07507f64297a1f9305a2d68169f653d5c107c9860ca0d822916eb357c646c229e792b1a5da56b35ab971bb82e41581e11f24f9c6b26c019dd2f2f89f2a82b74bd856ed7b46a2d9c07b2856bc39e9a28f271c5bb06db5bfa04d21e37e778b3e03071d25da8bbc91543fe8909603ba92e3455cb0edfe1dc040f12c169a97a5b8fb09f97acda29ab8491e7c9f81320b1a9de5773078557a6a0bdc5a1bfd2d953c47b3e5ccc70d76dc4ba10c297d7591e2c2150b8235de09714fedcf23aedb0ec9586e52f6af6c299256ad5a0a4ce22666be48592977dc5ff5c5eea529b81df4510016240b8fc8489bf59c899bb75481220554d0b9aebf1660cb72b01dfc3ffaac27dc1d36247e86339c6d99fc3ca8edf585fdb236ecdffda1b99819f873367ee5d8fde5d596517f895c9154deab01ca26008edbeadecfe33cae750ff044469a1b3b104b35af0c04a35a48aecf54dd8844b598432b81f67ce232ad46a247cad103274cd7c206d890008b149aaa3310f9794243cc5e04d4bd3e66a5b01ef67044412eba507a20399856cd26fb6233ebc064aa7b5ba94198bc05301dd74d6875b6d3b4731c2a11f0656767a3e6ba0a3d6951a7f9385ff99876891b8150ac5257756ef92a6c3854ccba8f13bca3cd3e66fdc93feefc44c3eba570970e0a6921f1eef24713ed5a174b8e52a0bc1bd3b420bdd0e521835289d29267fca4512caeaf64d1adeba2457864801d30d37e4eea965f8cfdb314f62307d8a12084a65da330f800862cae3876cdffe8c77d982ce9527b069628f0d796c0ec1c1b423ab6eb248e176a9b201d4de572f7901d8d88ae3dc6c3f196a4e3fb81552f16f7a7b7b3a242824b0618a855fc150fe8d484c80b3e1ea6c42f165dcfa7b0b292f9c7f27179d32260d4f472385a8818f7d76133030cf1256153b4162c8c3a3629c01e9b8cb5a30b3d0068d7f0e3727d8159739386511746fad1cfcc98c7af05b489876432957c6d59c51f12ebb62acac90311e6b00cea58b355db5a36718dfb8140d23e64e41ef9d33969cae75ea3ef8f14ad8c9b2d0c8bd7bf4366b091b5992ffbd71800495c0484cbee4b5fffaede0808cdcfa2409227e6b96dd82481d6d00bfff72c29f860b7fa4fa9c3634d9a2e4f7a8ef240c997b749e0562514d5c2c5d66da75149dea37b1cbb347fa0df5be2b9a5ddf20a6d47936b3b55cedc64453e69413a89c8a9eaeda00fccc96281b4f29db0f3e45fa098c77ffe3c0488529ecfa801cdf7fe8a23f6a3aa04acaf4e300c44e6d873f43b9fd4b13cbed2411c97378e07c7a6799d272d36ac8964233130947ed88f727915fa58a4812ceacd6cc6a52bc7fcba5e57543e93d293d5a428c73b194f33ba752b0ebeb0262423e7a8f490707a220857f44e191304cffb93cfc75b217ca306292549c8742fe3aa62a464d40c666115015201c0fef3e9555615f91c3d15b6e1556a9b04febc2ae7e3d689ca5f58b51f2717ae8c5153f2c2a4df11ea8cafcc369327c2a0a6f7946daf09be323d59e4b0e42ebcdeca373a6d70a3286382f1405b7107af899da00dbd52324657870bd18ca26f3ef47e0e81cd335c827512e88f24202836e7a1b505f0d03a23d577430d971458a11ff42e36b2d2883b664d402eb7497a90ba1f94829b6d9c6b4c4f7e9dc49882520a6fd2590cb8b41328541b9076e43f6019c3da9084e57960478c268f4215bb98455fbd2981e7e37caf7aaf9008f87cfe196da930637c55da5a34e142a433494e6f92a5985d7e6fc0ec68d2ad25144919af6dc81afc88cd05f01b401730bccc3086c9dd06d38ed522e52e7ffae7671898fb91cec0821c061aaea6c47ae877d2d7f5ca1ecf159e0ea152ce713f652c116f62e12cad293331db922a5fed311ab22096d90fc17ccc53f84d46eae680def0b9949e0d9debff263d575e590941a5ce0b33548beb6dbc01104f6054da73cc349625adece6a54e092d8d740915b91d81df30374a78693d6b69724f05354d61ac0febff4a544b88954d11d3f4927895edf6ad755313227ac87f24f12d70a831df16bd45c4a03570fdf27d698fa5581fce2d002890a3f2059a6bfdf77f0aeee3ad8318449bc1b2d486b225b148a78e921c73a2c37256dfb1ad611e410d5436e0d31d00ab5177da7915a74ef3307927c23c764f5cf62c3e2db86284c9abb39045b625d507f5c8d440557b4dad2a39593fbb572cce25a364aae44134fdd97ef0148690881bee42b6bd929f12cdf07996597a2a8366b12841f8fb8dfc0ece651756637b95c6bdb92320302805b4a700e7d3dfb0b8878862f400f8437a6c153b5fab40d30af07e73cf4345cb6fa81574018a7bc0e8789fae8b8560f4b93d413fa8e0e0218527ccb82873fc9da6cc34b6197c1d8bd9223ab7c4efb1f8cf021450037f4576934d83116655c120062fc3b912176fd395ccc792d492f2730465f8b4c68155b6ceb52e80742d2970e24004171f4685cd78467a4e943a0fecff66dffff10922d69236460dc37c1df9b19dded1ecb932dd8dd2045d2f8e8d3dfb6a83a65d6623553a2aed7a12b78effeeaa58eec84cdefc84923177afb7bd04f6fc3d3332d63ed5c5d6fe8820b9853e7615407eb23962f5232db44bc0267e7f07e47b158de0732a974b80aeb00ffeeca83d26fe21e487ea4472cd9048f942155784af8f68006cdb4286480a7ffa1ba6e93fe7fdb33283359d28bf9311dee59899e0e77aa113fadda21526c8e2bd60f21e182b735a5b0177fb95e948857c6c4ae391b2b4950a35b129e7bf25b7eb2c0857290c55f5d28b78ca1f39f0cd676610805b0a378647ae958182b26de1ddbf80e80d7ab1d2476086ed192e98bee0969bc0e8765278cb5570ccc29ac6d7298821bff4f85895deffcf4ce54a69878cfb41eade0d8703cbcff02352733ace2d800ba68b0fdcc52b94247ecacddf80ad228cf76eb547d276d0f6402054e34c3569e2b53ea3cbc54e49e099372cde3acd1ba47f836a765f855763a175a58ec4d6cecc72375da2d8c956c2868e77bfdb697182b554f0b743d7095cf13a3ba1d19e7590c281bd09ce235898a9682aacb5633b4fa4c3bdd71139c20c518b6a7651a47df7658a5a7ed41b3e7e43543d68c1dd4a5d01ec7e42cabdd6963db84f0d69b5a471ff8b929a8774baee39b14ab325af2ea7756c656c0135a59568499208341333d6b896cf0cc10108970e20313df241d179bd2a4d2392b269e6aeb9d2570bba7e3c67f49e90cf95562f93077a5fb588225724d444fcd8da55921dcff7b0be49ac0171ae98209e729f65bcebe447ccc0a185719f3fd55d1ae263daac4a420da91d05cdfc85d48e5743483dbb6fe81e5c216948953d95d5e725db17df44f05a57c6cc425e55572f9163e536a6d2d51d5213c937f6ddba08fc1f90ec73088a766a685f2c0d43b80422d48eef23b2ea588ea26b8dffb4f0df0cf91d6ea8f14a663ba2b165e4427010742fe63905d62b9dcf2385dce09fe75e4746d5c9c402ee77bfc9f39a28eb9f2751a81b090a499706accafbf5ae1afa9af350fd7481bb", 0x1000}, 0x1006) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001e80)=ANY=[]}, 0x1, 0x0, 0x0, 0x1}, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) fstat(0xffffffffffffffff, &(0x7f0000000380)) write(r1, &(0x7f00000001c0), 0xfffffef3) mknodat(0xffffffffffffffff, 0x0, 0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000080)) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000325f23)=""/221, &(0x7f0000000080)=0x83) r2 = epoll_create(0x5) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000100)={0x200f}) r4 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYRESOCT, @ANYRESDEC], 0x4e) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @mcast2, 0x2}, 0x1c) sendto$inet6(r6, &(0x7f0000000300), 0xfdb8, 0x4008080, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r6, &(0x7f00000092c0), 0x4ff, 0x0) socketpair(0x0, 0xa054b98f838cc548, 0x7f, &(0x7f0000000180)) faccessat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x1600) 22:58:11 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r2 = openat(r1, &(0x7f0000000000)='./file0\x00', 0x400000, 0x80) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, &(0x7f0000000040)={{0x3a, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'nq\x00', 0x10, 0x8, 0x12}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x2002, 0x7, 0x1, 0x7}}, 0x44) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="116348400000e1ffff3f00000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000800"/76], 0x0, 0x0, 0x0}) 22:58:11 executing program 3: mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="16b3ee1ceef37a67f0414b000000010000000000e6ffffff00000400000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) 22:58:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff11, 0x18, &(0x7f0000000000)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x200000}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 797.361247] binder: 5654:5655 got transaction to invalid handle [ 797.397098] binder: 5654:5655 transaction failed 29201/-22, size 0-0 line 3014 22:58:11 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1963484000000000000000000000000000000000000000000100000000000000000000003c9006f750060340cfa078afead500"/86], 0x0, 0x0, 0x0}) [ 797.416346] binder_alloc: 5661: binder_alloc_buf size -208 failed, no address space [ 797.428810] binder: undelivered TRANSACTION_ERROR: 29201 [ 797.436943] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) [ 797.447869] binder: 5661:5662 transaction failed 29201/-28, size -239-24 line 3137 [ 797.488944] binder: undelivered TRANSACTION_ERROR: 29201 [ 797.498925] binder_alloc: 5661: binder_alloc_buf size -208 failed, no address space [ 797.525158] binder: 5669:5671 unknown command 1078485785 [ 797.535761] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) [ 797.548350] binder: 5669:5671 ioctl c0306201 20000200 returned -22 [ 797.573154] binder: 5661:5670 transaction failed 29201/-28, size -239-24 line 3137 [ 797.588645] binder: 5669:5673 unknown command 1078485785 [ 797.605306] binder: undelivered TRANSACTION_ERROR: 29201 [ 797.626276] binder: 5669:5673 ioctl c0306201 20000200 returned -22 22:58:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) eventfd(0x9) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) write$FUSE_NOTIFY_STORE(r2, &(0x7f0000000000)={0x29, 0x4, 0x0, {0x1, 0x1, 0x1, 0x0, [0x0]}}, 0x29) fsetxattr$smack_xattr_label(r1, &(0x7f0000000040)='security.SMACK64EXEC\x00', &(0x7f0000000140)={'/dev/binder#\x00'}, 0xe, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 797.704438] binder: undelivered TRANSACTION_ERROR: 29201 [ 797.725889] binder_alloc: 5675: binder_alloc_buf, no vma [ 797.745962] binder: 5675:5677 transaction failed 29189/-3, size 120-24 line 3137 22:58:11 executing program 1: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f0000000280)) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/policy\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="8914b1f66b07d114"], 0x0, 0x0, 0x0}) r4 = socket$inet(0x2, 0x9, 0x50) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r4, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r4, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x8000, 0x0) ioctl$TIOCGRS485(r5, 0x542e, &(0x7f0000000100)) r6 = dup(r4) ioctl$VT_RESIZEX(r6, 0x560a, &(0x7f0000000000)={0x2, 0x100, 0x3, 0x9, 0x3ff, 0x5}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r7, 0x0, r8, 0x0, 0x1003, 0x0) ioctl$TIOCGPTLCK(r7, 0x80045439, &(0x7f00000002c0)) [ 797.780373] binder: undelivered TRANSACTION_ERROR: 29189 [ 797.786151] binder: BINDER_SET_CONTEXT_MGR already set [ 797.799997] binder: 5675:5677 ioctl 40046207 0 returned -16 [ 797.849654] binder: 5681:5682 unknown command -156167031 [ 797.867365] binder: 5681:5682 ioctl c0306201 20000200 returned -22 22:58:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:58:11 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r3 = signalfd(r1, &(0x7f0000000000)={0x6}, 0x8) write$binfmt_elf64(r3, &(0x7f0000000240)={{0x7f, 0x45, 0x4c, 0x46, 0xc1, 0x5, 0x5, 0xc4, 0x4, 0x2, 0x3, 0x8, 0x2cb, 0x40, 0x31a, 0x1, 0x8001, 0x38, 0x2, 0x101, 0x5, 0x81}, [{0x3, 0x120000, 0x20d8, 0xb7bf, 0x6, 0x7fff, 0x2, 0x3}], "5320773b25ec1b977bb019263f190015a603d3edd6752cae4e93701009afd992cb74a2722e718a21b9f9cb06840d193f89f158b779d797d9849ae7cdab6b53034aaef2311af6346782108731a18a7b2899c418b62fada5a8bb66e1825541405064639b700c9c2f55c718cb9a4c06043454b04a426c70d93d0db15e5c47a7424d99388e19174738dd0db39698bc9951a5533d9cfa59ee0b9ec551f91438cbe797ac148e49a17aba19c2db889bd060de549facb01aac609e54e49d07e15fc4cb1c2c8b0a24a71fef62a142d603280ddd4d6346a00d3464a09310572c1788f7567d9ad555bf38ba7f5852b33f95db324d543a8163", [[], [], [], [], [], [], [], [], []]}, 0xa6b) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r7, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r7, 0x8004745a, &(0x7f0000000600)) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'bond_slave_1\x00', 0x1000}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:11 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x9aac12d2, &(0x7f0000000980), 0x0, 0x0, 0xfffffffffffffea8, 0x20000001}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe9\xdc\x00', 0x200085}) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f0000000040)=0x7) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f0000000100)=@ccm_128={{0x303}, "1889f72078c93610", "4d0d954312b064dedb4592442345c345", "3844c4e9", "b09dc5460bc9281d"}, 0x28) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f2, &(0x7f0000000140)='\x05\x006tnl0\x00\xbc)\x9c\xeb\x02-6\x87\xdcF\x8eJW\x0e]\xb7\xaf\x14d\xe2\x14\xce`9\xc3\x82De\xacz\x1f\xc1\a\xb8&%v\xbd\x99\xe4\x04\r:TOYH\xc94\xcf\xee\x1d\xdf\x00!q\x06\xe0l\xed\xc9\x9b\x9eo\xef\xe5\xf1 \xcc\x1cp%\xcc\x85\xfe\xfd\x95\x99\x7fK>\xb7\xf7\x93\x92\x84\xb5p') [ 797.967862] binder: 5681:5682 unknown command -156167031 [ 797.974678] binder: 5681:5682 ioctl c0306201 20000200 returned -22 [ 798.018518] binder_alloc: 5691: binder_alloc_buf, no vma [ 798.038682] binder: 5691:5692 transaction failed 29189/-3, size 120-24 line 3137 22:58:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$TIOCNXCL(r2, 0x540d) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000000)=[0x0, 0xd7]) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:58:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ff8000/0x8000)=nil, 0x8000, 0x1, 0x11, r0, 0xffffffffffffffee) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffffffffffe8f, 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0}) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) fcntl$getownex(r3, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$cont(0x20, r4, 0x16, 0x100) [ 798.072946] binder: undelivered TRANSACTION_ERROR: 29189 [ 798.137120] binder_alloc: 5695: binder_alloc_buf size 4840 failed, no address space [ 798.172321] binder: 5706:5710 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 798.189656] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 798.210291] binder: 5706:5710 transaction failed 29201/-22, size 120-24 line 3199 [ 798.230577] binder: 5695:5709 transaction failed 29201/-28, size 4096-739 line 3137 [ 798.252285] binder: undelivered TRANSACTION_ERROR: 29201 22:58:12 executing program 0: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0xc00c28af09239543, 0x0) openat$keychord(0xffffffffffffff9c, &(0x7f0000000440)='/dev/keychord\x00', 0x0, 0x0) pipe(&(0x7f0000000840)) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000c80)={0x8, "5f5539ae7383df635d7eb9f00cde999ef4e1d4fbae589edcbcd64ae9781d89f20a7c347bd734db9d80a3e9ee0d0f04fe5305dacf9e656dc623d0d8abb05b81ebf7fa83533ebfe364612ee7d5571be6e3af5eccf0e26370ff66a26e95f4b7b1206b9d9a70fe612b356ec5074716b0e71eb9f60ac1c5e653c9a7de0de9a5f8c8047f77ece27201fc36e2ca04338864356e123b3b96be97afa5d6698e6f08a657f7ad07b42df05dfca83247581434b575e2d4419e52f1103e9e3ddc440a98f9caeace71f8affb3cfc62e4b428403787ff063d2923a50c0410f191c7923b77c51fea54cc7f2b8adcd2a5e1f53495c168736a160f28435b70f6e40df8523c2deaef8b70f13bc408d1d6eb05dbcae35f0c12cb00b8d589c0dda912acf9315852e1cbb85857f9421cd623fc5046448db22eec3c07358c4778c73a2495bf3452b18d8e904ed88ae250a99edb20b78fc923ccc841847a4f6d514320309afe2f0a075e50096c7a8cd4da2d88791d01a10cea10a97d32e8bb05a5e2bf52be5fffa3fb26953a0fadac598644cf0297d01d5c1ed9f2123ba789fa650b0d140a478903cc23a5b5c2a2a52f19bdd40039ac0291f648f1f991e272c52669f7843e73b3be22103fe0a88d5d405b9ecea5d602be0b5466d18d8a971b69a8e80e48621103a6bc6ee3a7b70b199005241779f22fa2cc159988eaf2d53c858ec06ab56acc232b587ffee3a5cb29f5641b2189fb1617d1a652e42511fe2e447a2636f18ceabc261126200193eb9f309f80aa204a93883bf6fb247ade866685f300295f8735e18d1d81365dbd2bddfa1779c59effed803bbe0a68302b1ab0f0d00892138ad24d52d653d92897bd28c2f031a77eae54ef3ce9a1fc44ea41763b2d780a454f68ea1a297302b4fa6664923a818040f5a74e0db3ff24e940e97d4abff40af2d36f7bceb8a0c5e90dbefbc8ba496f6e42f11ce11fb20655138f9387938abc3aa3a742f749a8695d972c537127519f654945bac96f0a2ef9d6b24f2226ae677684e3eb63041d6b5105777a8e6aa41ff11366448c0af1ddf5e3f2a1d828b4c9ede3809eab736c9035f2a7032ce38b699dfdc3e158e1ce62d325441e1b05a3ba5f663f20b0cb703cb2960aad298177881aa6b52bf4ae112c5d2bb691ac34b0723be7ddcfff0015e578475db1f062c5a50b54bbcba2f591eb4d6de66f386b0d5dd3975229ad25ae95d82266dfb9c1a6f497ef54b6ac5ee81edae16c47e89f9a435377dfac411db459559ce483921251745b8b94f69d4815b009ea86aedc5a75a516ff2afaff9a418f73c2cacbcdf45dd02ba962399f9b81e149635c2b4c0bda790a6d72fc243f6fbc73d0a0636db51c03d93b44b42c07f2269b465231f953e6a45dc549e9b5ef05443da7820cd667f5b0ff47a13f0a3df630a6f98f72e09978b829389d6a11afb0a7a0988822bb95fcb50399e51295f464662118646d2996da0fa710b082036820ae0a60828479bad4489061244b74179cfec74ab273551190c0eb2ca95be86391b8e469454796d04b29646b8aaae49889ffd84e83e33fb0cd7b10d778e72422f474911897dbd4548d9658e9af23cfff0ad4a7d750ab59e0f8988082ab7ac8d27eeab1c5809de6694aba8ee6ff1ba23d422f38dc026a77933cb0fc916d22131f7f736e35c881c5551f13a5037f65b9090372bb8e73bb9cd686715afef6b40ff275a978078c1e1c7db358285e5caee5c53cb4a7b446db91e5c0615342265edd9f09a72002aae56c7ad4269a0513569db514ee852724cdcccb72e8836fc270f7aa03e03e65f4572c2909e6fb1b557e89c3b505ba2f2b10b545513758abdbdc5b3e5ec1fe4d6bd5947b354058eccb79f10e971a85bdafa5aa27224acc734d884f9282ed033fc540defa3181d451713565d940879cd70a1d704b9a390de509351d5129bff18051b0c7ca196a78d3b8d0c8f384c79ad637b2e1770fecfc980960ef403cbc6bb284792cd169133f35aea028d9ffdc1668572dd197db86a26cb6fe1bb822bb76968ef2cd3c384704b75d0f17a50bcce054a400edd3b2f2abf72d2d8a679fdc94216d2d7d43ca1e60aeb5a313f8104f8ae54e75beb6c106cf080b9ecc9a1f91508b37d9ede25a1bede738c3a7f3501391a7b1863fe120ea26c4ff13f1de4588b150f3f2c12a9b9d92e6a8610c788c4d449a91416307a313536e1779bef88028d65a9398c5d1492b729d5f08e34e64fa07507f64297a1f9305a2d68169f653d5c107c9860ca0d822916eb357c646c229e792b1a5da56b35ab971bb82e41581e11f24f9c6b26c019dd2f2f89f2a82b74bd856ed7b46a2d9c07b2856bc39e9a28f271c5bb06db5bfa04d21e37e778b3e03071d25da8bbc91543fe8909603ba92e3455cb0edfe1dc040f12c169a97a5b8fb09f97acda29ab8491e7c9f81320b1a9de5773078557a6a0bdc5a1bfd2d953c47b3e5ccc70d76dc4ba10c297d7591e2c2150b8235de09714fedcf23aedb0ec9586e52f6af6c299256ad5a0a4ce22666be48592977dc5ff5c5eea529b81df4510016240b8fc8489bf59c899bb75481220554d0b9aebf1660cb72b01dfc3ffaac27dc1d36247e86339c6d99fc3ca8edf585fdb236ecdffda1b99819f873367ee5d8fde5d596517f895c9154deab01ca26008edbeadecfe33cae750ff044469a1b3b104b35af0c04a35a48aecf54dd8844b598432b81f67ce232ad46a247cad103274cd7c206d890008b149aaa3310f9794243cc5e04d4bd3e66a5b01ef67044412eba507a20399856cd26fb6233ebc064aa7b5ba94198bc05301dd74d6875b6d3b4731c2a11f0656767a3e6ba0a3d6951a7f9385ff99876891b8150ac5257756ef92a6c3854ccba8f13bca3cd3e66fdc93feefc44c3eba570970e0a6921f1eef24713ed5a174b8e52a0bc1bd3b420bdd0e521835289d29267fca4512caeaf64d1adeba2457864801d30d37e4eea965f8cfdb314f62307d8a12084a65da330f800862cae3876cdffe8c77d982ce9527b069628f0d796c0ec1c1b423ab6eb248e176a9b201d4de572f7901d8d88ae3dc6c3f196a4e3fb81552f16f7a7b7b3a242824b0618a855fc150fe8d484c80b3e1ea6c42f165dcfa7b0b292f9c7f27179d32260d4f472385a8818f7d76133030cf1256153b4162c8c3a3629c01e9b8cb5a30b3d0068d7f0e3727d8159739386511746fad1cfcc98c7af05b489876432957c6d59c51f12ebb62acac90311e6b00cea58b355db5a36718dfb8140d23e64e41ef9d33969cae75ea3ef8f14ad8c9b2d0c8bd7bf4366b091b5992ffbd71800495c0484cbee4b5fffaede0808cdcfa2409227e6b96dd82481d6d00bfff72c29f860b7fa4fa9c3634d9a2e4f7a8ef240c997b749e0562514d5c2c5d66da75149dea37b1cbb347fa0df5be2b9a5ddf20a6d47936b3b55cedc64453e69413a89c8a9eaeda00fccc96281b4f29db0f3e45fa098c77ffe3c0488529ecfa801cdf7fe8a23f6a3aa04acaf4e300c44e6d873f43b9fd4b13cbed2411c97378e07c7a6799d272d36ac8964233130947ed88f727915fa58a4812ceacd6cc6a52bc7fcba5e57543e93d293d5a428c73b194f33ba752b0ebeb0262423e7a8f490707a220857f44e191304cffb93cfc75b217ca306292549c8742fe3aa62a464d40c666115015201c0fef3e9555615f91c3d15b6e1556a9b04febc2ae7e3d689ca5f58b51f2717ae8c5153f2c2a4df11ea8cafcc369327c2a0a6f7946daf09be323d59e4b0e42ebcdeca373a6d70a3286382f1405b7107af899da00dbd52324657870bd18ca26f3ef47e0e81cd335c827512e88f24202836e7a1b505f0d03a23d577430d971458a11ff42e36b2d2883b664d402eb7497a90ba1f94829b6d9c6b4c4f7e9dc49882520a6fd2590cb8b41328541b9076e43f6019c3da9084e57960478c268f4215bb98455fbd2981e7e37caf7aaf9008f87cfe196da930637c55da5a34e142a433494e6f92a5985d7e6fc0ec68d2ad25144919af6dc81afc88cd05f01b401730bccc3086c9dd06d38ed522e52e7ffae7671898fb91cec0821c061aaea6c47ae877d2d7f5ca1ecf159e0ea152ce713f652c116f62e12cad293331db922a5fed311ab22096d90fc17ccc53f84d46eae680def0b9949e0d9debff263d575e590941a5ce0b33548beb6dbc01104f6054da73cc349625adece6a54e092d8d740915b91d81df30374a78693d6b69724f05354d61ac0febff4a544b88954d11d3f4927895edf6ad755313227ac87f24f12d70a831df16bd45c4a03570fdf27d698fa5581fce2d002890a3f2059a6bfdf77f0aeee3ad8318449bc1b2d486b225b148a78e921c73a2c37256dfb1ad611e410d5436e0d31d00ab5177da7915a74ef3307927c23c764f5cf62c3e2db86284c9abb39045b625d507f5c8d440557b4dad2a39593fbb572cce25a364aae44134fdd97ef0148690881bee42b6bd929f12cdf07996597a2a8366b12841f8fb8dfc0ece651756637b95c6bdb92320302805b4a700e7d3dfb0b8878862f400f8437a6c153b5fab40d30af07e73cf4345cb6fa81574018a7bc0e8789fae8b8560f4b93d413fa8e0e0218527ccb82873fc9da6cc34b6197c1d8bd9223ab7c4efb1f8cf021450037f4576934d83116655c120062fc3b912176fd395ccc792d492f2730465f8b4c68155b6ceb52e80742d2970e24004171f4685cd78467a4e943a0fecff66dffff10922d69236460dc37c1df9b19dded1ecb932dd8dd2045d2f8e8d3dfb6a83a65d6623553a2aed7a12b78effeeaa58eec84cdefc84923177afb7bd04f6fc3d3332d63ed5c5d6fe8820b9853e7615407eb23962f5232db44bc0267e7f07e47b158de0732a974b80aeb00ffeeca83d26fe21e487ea4472cd9048f942155784af8f68006cdb4286480a7ffa1ba6e93fe7fdb33283359d28bf9311dee59899e0e77aa113fadda21526c8e2bd60f21e182b735a5b0177fb95e948857c6c4ae391b2b4950a35b129e7bf25b7eb2c0857290c55f5d28b78ca1f39f0cd676610805b0a378647ae958182b26de1ddbf80e80d7ab1d2476086ed192e98bee0969bc0e8765278cb5570ccc29ac6d7298821bff4f85895deffcf4ce54a69878cfb41eade0d8703cbcff02352733ace2d800ba68b0fdcc52b94247ecacddf80ad228cf76eb547d276d0f6402054e34c3569e2b53ea3cbc54e49e099372cde3acd1ba47f836a765f855763a175a58ec4d6cecc72375da2d8c956c2868e77bfdb697182b554f0b743d7095cf13a3ba1d19e7590c281bd09ce235898a9682aacb5633b4fa4c3bdd71139c20c518b6a7651a47df7658a5a7ed41b3e7e43543d68c1dd4a5d01ec7e42cabdd6963db84f0d69b5a471ff8b929a8774baee39b14ab325af2ea7756c656c0135a59568499208341333d6b896cf0cc10108970e20313df241d179bd2a4d2392b269e6aeb9d2570bba7e3c67f49e90cf95562f93077a5fb588225724d444fcd8da55921dcff7b0be49ac0171ae98209e729f65bcebe447ccc0a185719f3fd55d1ae263daac4a420da91d05cdfc85d48e5743483dbb6fe81e5c216948953d95d5e725db17df44f05a57c6cc425e55572f9163e536a6d2d51d5213c937f6ddba08fc1f90ec73088a766a685f2c0d43b80422d48eef23b2ea588ea26b8dffb4f0df0cf91d6ea8f14a663ba2b165e4427010742fe63905d62b9dcf2385dce09fe75e4746d5c9c402ee77bfc9f39a28eb9f2751a81b090a499706accafbf5ae1afa9af350fd7481bb", 0x1000}, 0x1006) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001e80)=ANY=[]}, 0x1, 0x0, 0x0, 0x1}, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) fstat(0xffffffffffffffff, &(0x7f0000000380)) write(r1, &(0x7f00000001c0), 0xfffffef3) mknodat(0xffffffffffffffff, 0x0, 0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000080)) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000325f23)=""/221, &(0x7f0000000080)=0x83) r2 = epoll_create(0x5) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000100)={0x200f}) r4 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYRESOCT, @ANYRESDEC], 0x4e) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @mcast2, 0x2}, 0x1c) sendto$inet6(r6, &(0x7f0000000300), 0xfdb8, 0x4008080, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r6, &(0x7f00000092c0), 0x4ff, 0x0) socketpair(0x0, 0xa054b98f838cc548, 0x7f, &(0x7f0000000180)) faccessat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x1600) 22:58:12 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000740)=0x100, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) ppoll(&(0x7f0000000080)=[{r0}], 0x1, 0x0, 0x0, 0x0) 22:58:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, @flat=@weak_binder={0x77622a85, 0x100, 0x2}}, &(0x7f0000000000)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x14) 22:58:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$packet_buf(r1, 0x107, 0x972fd7b437912c3e, &(0x7f0000000580)=""/234, &(0x7f0000000140)=0xea) r2 = accept(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, &(0x7f0000000100)=0x16) accept$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000200)=0x1c) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x4c, 0x0, &(0x7f0000000400)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000500)={@ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/221, 0xdd, 0xfffffffffffffffd, 0x8000000000002e}, @fda={0x66646185, 0x4, 0x1, 0x37}, @ptr={0x70742a85, 0x0, &(0x7f0000000480)=""/123, 0x7b, 0x1, 0x3}}, &(0x7f00000006c0)={0x0, 0x28, 0x48}}}], 0x0, 0x0, 0x0}) [ 798.416015] binder: 5719:5725 got transaction to context manager from process owning it [ 798.429776] binder: 5719:5725 transaction failed 29201/-22, size 104-24 line 3005 [ 798.440390] binder: undelivered TRANSACTION_ERROR: 29201 [ 798.440735] binder: 5719:5727 got transaction to context manager from process owning it [ 798.440748] binder: 5719:5727 transaction failed 29201/-22, size 104-24 line 3005 [ 798.499824] binder: BINDER_SET_CONTEXT_MGR already set [ 798.518084] binder: 5730:5732 ioctl 40046207 0 returned -16 [ 798.518112] binder: undelivered TRANSACTION_ERROR: 29201 [ 798.547892] binder: 5730:5732 got transaction to invalid handle [ 798.567178] binder: 5730:5732 transaction failed 29201/-22, size 112-24 line 3014 [ 798.591479] binder: undelivered TRANSACTION_ERROR: 29201 [ 798.601716] binder: 5730:5734 got transaction to invalid handle [ 798.621854] binder: 5730:5734 transaction failed 29201/-22, size 112-24 line 3014 22:58:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x6, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}]}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470060000000000000000000000000000000000000000000000000000000000000000000000852a7470000000006013cf05c951c60b553d6cd7e6", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) [ 798.646626] binder: undelivered TRANSACTION_ERROR: 29201 22:58:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000600)) dup2(r4, r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000008000000000000130010000000000000e3020000000000000000000000000000e20000000000000000000000000000007103161b231a7d3ad6dc0e346ee53ec402164a8f6d2d3f04e609e7d63061d74875886030f8f5092d5a5d1ab68fb9"], 0x0, 0x0, 0x0}) [ 798.832684] binder: undelivered TRANSACTION_ERROR: 29201 22:58:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000040)) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)) r1 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, r1) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="2a00000029020064dc000048010059aad4639ef0acd7c44b0000030000000000000000080000000000008d4e4891cf5b8b7ddcf2"], 0x2a) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000002000"/76], 0x0, 0x0, 0x0}) 22:58:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) write$nbd(r2, &(0x7f0000000000)={0x67446698, 0x1, 0x3, 0x1, 0x4, "bae7961377431d5bb78ba6378b4b6f896f16fa60d69c82af3635a505d4a480896e5cccc7fdff110569e7d991ef22f1cdee5f66a77b86a54923f080c0cb0adb12e98edfcfee7431d9a9aec2e3ebc5059198dbdab409328883ec747ac3c3a575de83581968610e7b"}, 0x77) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0363ff40", @ANYRES64=r1], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000080)=[@timestamp, @sack_perm, @window={0x3, 0x6, 0x800}, @sack_perm, @sack_perm, @timestamp, @sack_perm], 0x7) [ 799.109908] binder: 5740:5742 transaction failed 29189/-22, size 0-0 line 3014 [ 799.130807] binder: undelivered TRANSACTION_ERROR: 29189 [ 799.174585] binder_alloc: 5741: binder_alloc_buf size 4840 failed, no address space [ 799.204463] binder: 5749:5751 unknown command 1090478851 [ 799.213545] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 799.236778] binder: 5749:5751 ioctl c0306201 20000200 returned -22 [ 799.258225] binder: 5741:5748 transaction failed 29201/-28, size 4096-739 line 3137 [ 799.295683] binder: BINDER_SET_CONTEXT_MGR already set [ 799.301936] binder: 5749:5754 ioctl 40046207 0 returned -16 [ 799.326695] binder: 5749:5754 unknown command 1090478851 [ 799.343675] binder: 5749:5754 ioctl c0306201 20000200 returned -22 22:58:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r1) add_key$keyring(0x0, 0x0, 0x0, 0x0, r1) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r1) keyctl$restrict_keyring(0x1d, r1, &(0x7f0000000000)='blacklist\x00', &(0x7f0000000040)='/dev/binder#\x00') r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r1, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000000)={0x0, 0x3, 0x100}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x802) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 799.431483] binder: undelivered TRANSACTION_COMPLETE [ 799.436941] binder: undelivered transaction 3499, process died. 22:58:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="118348400000000000000000000000000000007a6b4b397c00000000000100"/76], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x7, 0x27, 0x1}) [ 799.592328] binder: 5768:5770 unknown command 1078493969 [ 799.613302] binder: 5768:5770 ioctl c0306201 20000200 returned -22 22:58:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r1) add_key$keyring(0x0, 0x0, 0x0, 0x0, r1) r2 = add_key$keyring(0x0, &(0x7f0000000300)={'\x00', 0x2}, 0x0, 0x0, r1) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r2) add_key$keyring(0x0, 0x0, 0x0, 0x0, r2) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r2) keyctl$clear(0x7, r2) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x40000, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) ioctl$FICLONE(r4, 0x40049409, r3) ioctl$TIOCCBRK(r3, 0x5428) syz_open_dev$binderN(0x0, 0x0, 0x0) r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/policy\x00', 0x0, 0x0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r9, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r8, 0x0, r9, 0x0, 0x1003, 0x0) ioctl$TIOCGLCKTRMIOS(r8, 0x5456, &(0x7f00000002c0)={0x6, 0x1000, 0x1, 0x30f7, 0x14, 0x4, 0x8, 0x6, 0x1, 0x101, 0xd, 0x859c}) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000180)=ANY=[@ANYRESDEC=r7], 0x0, 0x0, 0x0}) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x101000, 0x0) ioctl$sock_SIOCDELDLCI(r4, 0x8981, &(0x7f0000000280)={'bond_slave_0\x00', 0x7ff}) ioctl$TIOCLINUX7(r10, 0x541c, &(0x7f0000000040)={0x7, 0xfc}) [ 799.641863] binder: BINDER_SET_CONTEXT_MGR already set [ 799.653182] binder: 5768:5771 ioctl 40046207 0 returned -16 [ 799.669177] binder: 5768:5771 unknown command 1078493969 [ 799.680358] binder: 5768:5771 ioctl c0306201 20000200 returned -22 22:58:13 executing program 0: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0xc00c28af09239543, 0x0) openat$keychord(0xffffffffffffff9c, &(0x7f0000000440)='/dev/keychord\x00', 0x0, 0x0) pipe(&(0x7f0000000840)) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000c80)={0x8, "5f5539ae7383df635d7eb9f00cde999ef4e1d4fbae589edcbcd64ae9781d89f20a7c347bd734db9d80a3e9ee0d0f04fe5305dacf9e656dc623d0d8abb05b81ebf7fa83533ebfe364612ee7d5571be6e3af5eccf0e26370ff66a26e95f4b7b1206b9d9a70fe612b356ec5074716b0e71eb9f60ac1c5e653c9a7de0de9a5f8c8047f77ece27201fc36e2ca04338864356e123b3b96be97afa5d6698e6f08a657f7ad07b42df05dfca83247581434b575e2d4419e52f1103e9e3ddc440a98f9caeace71f8affb3cfc62e4b428403787ff063d2923a50c0410f191c7923b77c51fea54cc7f2b8adcd2a5e1f53495c168736a160f28435b70f6e40df8523c2deaef8b70f13bc408d1d6eb05dbcae35f0c12cb00b8d589c0dda912acf9315852e1cbb85857f9421cd623fc5046448db22eec3c07358c4778c73a2495bf3452b18d8e904ed88ae250a99edb20b78fc923ccc841847a4f6d514320309afe2f0a075e50096c7a8cd4da2d88791d01a10cea10a97d32e8bb05a5e2bf52be5fffa3fb26953a0fadac598644cf0297d01d5c1ed9f2123ba789fa650b0d140a478903cc23a5b5c2a2a52f19bdd40039ac0291f648f1f991e272c52669f7843e73b3be22103fe0a88d5d405b9ecea5d602be0b5466d18d8a971b69a8e80e48621103a6bc6ee3a7b70b199005241779f22fa2cc159988eaf2d53c858ec06ab56acc232b587ffee3a5cb29f5641b2189fb1617d1a652e42511fe2e447a2636f18ceabc261126200193eb9f309f80aa204a93883bf6fb247ade866685f300295f8735e18d1d81365dbd2bddfa1779c59effed803bbe0a68302b1ab0f0d00892138ad24d52d653d92897bd28c2f031a77eae54ef3ce9a1fc44ea41763b2d780a454f68ea1a297302b4fa6664923a818040f5a74e0db3ff24e940e97d4abff40af2d36f7bceb8a0c5e90dbefbc8ba496f6e42f11ce11fb20655138f9387938abc3aa3a742f749a8695d972c537127519f654945bac96f0a2ef9d6b24f2226ae677684e3eb63041d6b5105777a8e6aa41ff11366448c0af1ddf5e3f2a1d828b4c9ede3809eab736c9035f2a7032ce38b699dfdc3e158e1ce62d325441e1b05a3ba5f663f20b0cb703cb2960aad298177881aa6b52bf4ae112c5d2bb691ac34b0723be7ddcfff0015e578475db1f062c5a50b54bbcba2f591eb4d6de66f386b0d5dd3975229ad25ae95d82266dfb9c1a6f497ef54b6ac5ee81edae16c47e89f9a435377dfac411db459559ce483921251745b8b94f69d4815b009ea86aedc5a75a516ff2afaff9a418f73c2cacbcdf45dd02ba962399f9b81e149635c2b4c0bda790a6d72fc243f6fbc73d0a0636db51c03d93b44b42c07f2269b465231f953e6a45dc549e9b5ef05443da7820cd667f5b0ff47a13f0a3df630a6f98f72e09978b829389d6a11afb0a7a0988822bb95fcb50399e51295f464662118646d2996da0fa710b082036820ae0a60828479bad4489061244b74179cfec74ab273551190c0eb2ca95be86391b8e469454796d04b29646b8aaae49889ffd84e83e33fb0cd7b10d778e72422f474911897dbd4548d9658e9af23cfff0ad4a7d750ab59e0f8988082ab7ac8d27eeab1c5809de6694aba8ee6ff1ba23d422f38dc026a77933cb0fc916d22131f7f736e35c881c5551f13a5037f65b9090372bb8e73bb9cd686715afef6b40ff275a978078c1e1c7db358285e5caee5c53cb4a7b446db91e5c0615342265edd9f09a72002aae56c7ad4269a0513569db514ee852724cdcccb72e8836fc270f7aa03e03e65f4572c2909e6fb1b557e89c3b505ba2f2b10b545513758abdbdc5b3e5ec1fe4d6bd5947b354058eccb79f10e971a85bdafa5aa27224acc734d884f9282ed033fc540defa3181d451713565d940879cd70a1d704b9a390de509351d5129bff18051b0c7ca196a78d3b8d0c8f384c79ad637b2e1770fecfc980960ef403cbc6bb284792cd169133f35aea028d9ffdc1668572dd197db86a26cb6fe1bb822bb76968ef2cd3c384704b75d0f17a50bcce054a400edd3b2f2abf72d2d8a679fdc94216d2d7d43ca1e60aeb5a313f8104f8ae54e75beb6c106cf080b9ecc9a1f91508b37d9ede25a1bede738c3a7f3501391a7b1863fe120ea26c4ff13f1de4588b150f3f2c12a9b9d92e6a8610c788c4d449a91416307a313536e1779bef88028d65a9398c5d1492b729d5f08e34e64fa07507f64297a1f9305a2d68169f653d5c107c9860ca0d822916eb357c646c229e792b1a5da56b35ab971bb82e41581e11f24f9c6b26c019dd2f2f89f2a82b74bd856ed7b46a2d9c07b2856bc39e9a28f271c5bb06db5bfa04d21e37e778b3e03071d25da8bbc91543fe8909603ba92e3455cb0edfe1dc040f12c169a97a5b8fb09f97acda29ab8491e7c9f81320b1a9de5773078557a6a0bdc5a1bfd2d953c47b3e5ccc70d76dc4ba10c297d7591e2c2150b8235de09714fedcf23aedb0ec9586e52f6af6c299256ad5a0a4ce22666be48592977dc5ff5c5eea529b81df4510016240b8fc8489bf59c899bb75481220554d0b9aebf1660cb72b01dfc3ffaac27dc1d36247e86339c6d99fc3ca8edf585fdb236ecdffda1b99819f873367ee5d8fde5d596517f895c9154deab01ca26008edbeadecfe33cae750ff044469a1b3b104b35af0c04a35a48aecf54dd8844b598432b81f67ce232ad46a247cad103274cd7c206d890008b149aaa3310f9794243cc5e04d4bd3e66a5b01ef67044412eba507a20399856cd26fb6233ebc064aa7b5ba94198bc05301dd74d6875b6d3b4731c2a11f0656767a3e6ba0a3d6951a7f9385ff99876891b8150ac5257756ef92a6c3854ccba8f13bca3cd3e66fdc93feefc44c3eba570970e0a6921f1eef24713ed5a174b8e52a0bc1bd3b420bdd0e521835289d29267fca4512caeaf64d1adeba2457864801d30d37e4eea965f8cfdb314f62307d8a12084a65da330f800862cae3876cdffe8c77d982ce9527b069628f0d796c0ec1c1b423ab6eb248e176a9b201d4de572f7901d8d88ae3dc6c3f196a4e3fb81552f16f7a7b7b3a242824b0618a855fc150fe8d484c80b3e1ea6c42f165dcfa7b0b292f9c7f27179d32260d4f472385a8818f7d76133030cf1256153b4162c8c3a3629c01e9b8cb5a30b3d0068d7f0e3727d8159739386511746fad1cfcc98c7af05b489876432957c6d59c51f12ebb62acac90311e6b00cea58b355db5a36718dfb8140d23e64e41ef9d33969cae75ea3ef8f14ad8c9b2d0c8bd7bf4366b091b5992ffbd71800495c0484cbee4b5fffaede0808cdcfa2409227e6b96dd82481d6d00bfff72c29f860b7fa4fa9c3634d9a2e4f7a8ef240c997b749e0562514d5c2c5d66da75149dea37b1cbb347fa0df5be2b9a5ddf20a6d47936b3b55cedc64453e69413a89c8a9eaeda00fccc96281b4f29db0f3e45fa098c77ffe3c0488529ecfa801cdf7fe8a23f6a3aa04acaf4e300c44e6d873f43b9fd4b13cbed2411c97378e07c7a6799d272d36ac8964233130947ed88f727915fa58a4812ceacd6cc6a52bc7fcba5e57543e93d293d5a428c73b194f33ba752b0ebeb0262423e7a8f490707a220857f44e191304cffb93cfc75b217ca306292549c8742fe3aa62a464d40c666115015201c0fef3e9555615f91c3d15b6e1556a9b04febc2ae7e3d689ca5f58b51f2717ae8c5153f2c2a4df11ea8cafcc369327c2a0a6f7946daf09be323d59e4b0e42ebcdeca373a6d70a3286382f1405b7107af899da00dbd52324657870bd18ca26f3ef47e0e81cd335c827512e88f24202836e7a1b505f0d03a23d577430d971458a11ff42e36b2d2883b664d402eb7497a90ba1f94829b6d9c6b4c4f7e9dc49882520a6fd2590cb8b41328541b9076e43f6019c3da9084e57960478c268f4215bb98455fbd2981e7e37caf7aaf9008f87cfe196da930637c55da5a34e142a433494e6f92a5985d7e6fc0ec68d2ad25144919af6dc81afc88cd05f01b401730bccc3086c9dd06d38ed522e52e7ffae7671898fb91cec0821c061aaea6c47ae877d2d7f5ca1ecf159e0ea152ce713f652c116f62e12cad293331db922a5fed311ab22096d90fc17ccc53f84d46eae680def0b9949e0d9debff263d575e590941a5ce0b33548beb6dbc01104f6054da73cc349625adece6a54e092d8d740915b91d81df30374a78693d6b69724f05354d61ac0febff4a544b88954d11d3f4927895edf6ad755313227ac87f24f12d70a831df16bd45c4a03570fdf27d698fa5581fce2d002890a3f2059a6bfdf77f0aeee3ad8318449bc1b2d486b225b148a78e921c73a2c37256dfb1ad611e410d5436e0d31d00ab5177da7915a74ef3307927c23c764f5cf62c3e2db86284c9abb39045b625d507f5c8d440557b4dad2a39593fbb572cce25a364aae44134fdd97ef0148690881bee42b6bd929f12cdf07996597a2a8366b12841f8fb8dfc0ece651756637b95c6bdb92320302805b4a700e7d3dfb0b8878862f400f8437a6c153b5fab40d30af07e73cf4345cb6fa81574018a7bc0e8789fae8b8560f4b93d413fa8e0e0218527ccb82873fc9da6cc34b6197c1d8bd9223ab7c4efb1f8cf021450037f4576934d83116655c120062fc3b912176fd395ccc792d492f2730465f8b4c68155b6ceb52e80742d2970e24004171f4685cd78467a4e943a0fecff66dffff10922d69236460dc37c1df9b19dded1ecb932dd8dd2045d2f8e8d3dfb6a83a65d6623553a2aed7a12b78effeeaa58eec84cdefc84923177afb7bd04f6fc3d3332d63ed5c5d6fe8820b9853e7615407eb23962f5232db44bc0267e7f07e47b158de0732a974b80aeb00ffeeca83d26fe21e487ea4472cd9048f942155784af8f68006cdb4286480a7ffa1ba6e93fe7fdb33283359d28bf9311dee59899e0e77aa113fadda21526c8e2bd60f21e182b735a5b0177fb95e948857c6c4ae391b2b4950a35b129e7bf25b7eb2c0857290c55f5d28b78ca1f39f0cd676610805b0a378647ae958182b26de1ddbf80e80d7ab1d2476086ed192e98bee0969bc0e8765278cb5570ccc29ac6d7298821bff4f85895deffcf4ce54a69878cfb41eade0d8703cbcff02352733ace2d800ba68b0fdcc52b94247ecacddf80ad228cf76eb547d276d0f6402054e34c3569e2b53ea3cbc54e49e099372cde3acd1ba47f836a765f855763a175a58ec4d6cecc72375da2d8c956c2868e77bfdb697182b554f0b743d7095cf13a3ba1d19e7590c281bd09ce235898a9682aacb5633b4fa4c3bdd71139c20c518b6a7651a47df7658a5a7ed41b3e7e43543d68c1dd4a5d01ec7e42cabdd6963db84f0d69b5a471ff8b929a8774baee39b14ab325af2ea7756c656c0135a59568499208341333d6b896cf0cc10108970e20313df241d179bd2a4d2392b269e6aeb9d2570bba7e3c67f49e90cf95562f93077a5fb588225724d444fcd8da55921dcff7b0be49ac0171ae98209e729f65bcebe447ccc0a185719f3fd55d1ae263daac4a420da91d05cdfc85d48e5743483dbb6fe81e5c216948953d95d5e725db17df44f05a57c6cc425e55572f9163e536a6d2d51d5213c937f6ddba08fc1f90ec73088a766a685f2c0d43b80422d48eef23b2ea588ea26b8dffb4f0df0cf91d6ea8f14a663ba2b165e4427010742fe63905d62b9dcf2385dce09fe75e4746d5c9c402ee77bfc9f39a28eb9f2751a81b090a499706accafbf5ae1afa9af350fd7481bb", 0x1000}, 0x1006) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001e80)=ANY=[]}, 0x1, 0x0, 0x0, 0x1}, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) fstat(0xffffffffffffffff, &(0x7f0000000380)) write(r1, &(0x7f00000001c0), 0xfffffef3) mknodat(0xffffffffffffffff, 0x0, 0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000080)) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000325f23)=""/221, &(0x7f0000000080)=0x83) r2 = epoll_create(0x5) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000100)={0x200f}) r4 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYRESOCT, @ANYRESDEC], 0x4e) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @mcast2, 0x2}, 0x1c) sendto$inet6(r6, &(0x7f0000000300), 0xfdb8, 0x4008080, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r6, &(0x7f00000092c0), 0x4ff, 0x0) socketpair(0x0, 0xa054b98f838cc548, 0x7f, &(0x7f0000000180)) faccessat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x1600) 22:58:13 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$input_event(r0, &(0x7f0000000080)={{0x77359400}, 0x1f, 0x0, 0x9}, 0x18) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000200)='proc\x00\b\xa4\x1b\xf0\x11\x10O\x01U\xbe\xdd\xa1\xa6\x10\xea\xccXZQ\xe0h~H\xc1\n\x00\aX\x96\xaf\xacy:\x95\xd9\x1c:\x15\td\xf5\x1d3\xfeN\xa5V3\x17v\x86`Xl\xd3\xc8\xac\xd52\x1e\xfc\xb8\x8b\xa3\xa4\xc4\x8f\xad\xd4\xce\'z\xed\xfd&(\xc4\xd2a\xd3\x88\xec\xfe\x84\xd6\xf27\xde\x04.\x8f\x9f\x8f\x92h\xb6.\xb7CMB\x17\x19\xc6\x16\x81\xf0\xa2\xb3`\x84`\xd5\xbfnq7\x8c\xfbP\xf5\xc8\xfek@\x90\xb3\f4\xb7Iq/\xe7\xcf/%\xc1o&\xa9\xa0\x8b\xec\xbb-\'v\x99\xc9we\'X\xe8nY\x81\xc1]\x94B(1\xac\x0f=\xf0\xaf\xb8\x16i\xfa\n[G\xb1\x93\xb8\xe2\xa7e\xa3\x00\x1d\xa8\x03\x1c\xedS\x85\xf0\xc2\"6\xf6\xa9\fe', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x430001, 0x0) chdir(&(0x7f0000000140)='./file0/file0\x00') 22:58:13 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_stats\x00', 0x0, 0x0) read$char_usb(r1, &(0x7f00000002c0)=""/38, 0x26) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000040)={0x0, 0x0, 0x1}) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) dup2(r4, r5) r6 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$LOOP_SET_CAPACITY(r6, 0x4c07) ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, &(0x7f0000000480)={0x0, 0x0, 0x1, 0x0, [], [{0x3e00000, 0x3f, 0x5, 0x392, 0x100, 0x8001}, {0x1, 0x10000, 0x10000, 0x1, 0x9, 0xffffffff}], [[]]}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r7, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r7, 0x8004745a, &(0x7f0000000600)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000600)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r4, 0xc0182101, &(0x7f0000000200)={r8, 0x9, 0x81}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2c}, @flat=@binder={0x73622a85, 0xa0b, 0x2}, @fda={0x66646185, 0x0, 0x0, 0x1}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0xffffffffffffffd6, 0x0, 0x0}) 22:58:13 executing program 2: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0xb10b, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r4 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write(r4, &(0x7f0000000000)="1c000084707032c0e88ffafffffffff807", 0xfffffffffffffccc) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfffffd88) [ 799.790969] binder: 5784:5785 ioctl c0c0583b 20000480 returned -22 [ 799.845982] binder: 5784:5791 got transaction to invalid handle [ 799.853030] binder: 5784:5791 transaction failed 29201/-22, size 120-24 line 3014 [ 799.860987] binder: 5784:5791 ioctl c0306201 20000080 returned -14 [ 799.871443] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=28784 sclass=netlink_route_socket [ 799.884712] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 799.895240] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 799.899470] binder: undelivered TRANSACTION_ERROR: 29201 [ 799.917664] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 799.928922] binder: BINDER_SET_CONTEXT_MGR already set [ 799.934483] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 799.934645] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 799.934804] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 799.935035] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 799.935581] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 799.935740] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket 22:58:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x23a, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:58:13 executing program 5: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bsg\x00', 0x200000, 0x0) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="3100000004000000000000decc000000060000000000000007fe4200000000000900000000000003000000000000000000"], 0x31) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x10d) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="2b8b832679fdc6cee22cebe5511400"/29], 0x1c) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r4, 0x0, r4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 799.935898] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 799.936003] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 800.030698] binder: 5744:5750 ioctl 40046207 0 returned -16 [ 800.097961] binder_alloc: 5799: binder_alloc_buf size 4840 failed, no address space [ 800.103648] binder: 5802:5803 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 800.103706] binder: 5802:5803 transaction failed 29201/-22, size 120-24 line 3199 [ 800.123985] binder: undelivered TRANSACTION_ERROR: 29201 [ 800.136596] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) 22:58:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) write$FUSE_NOTIFY_POLL(r2, &(0x7f0000000040)={0x18, 0x1, 0x0, {0x7ff}}, 0x18) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x6, 0x80, 0xc3, 0x9, 0x101}) r4 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x22, 0x0, &(0x7f0000000400)=ANY=[@ANYRESHEX=r3, @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) [ 800.145541] binder: 5802:5804 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 800.155794] binder: 5802:5804 transaction failed 29201/-22, size 120-24 line 3199 [ 800.164005] binder: 5799:5801 transaction failed 29201/-28, size 4096-739 line 3137 [ 800.172458] binder: undelivered TRANSACTION_ERROR: 29201 [ 800.186605] binder: undelivered TRANSACTION_ERROR: 29201 22:58:14 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x264334fc599cad28) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r6, 0x0, 0x1003, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r7, 0x0, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x200501, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(0xffffffffffffffff, &(0x7f0000000480)=""/250, 0xfffffd5a) ioctl$PPPIOCGFLAGS1(r8, 0x8004745a, &(0x7f0000000600)) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$RTC_EPOCH_READ(0xffffffffffffffff, 0x8008700d, &(0x7f0000000280)) getsockopt$packet_int(r5, 0x107, 0x9, &(0x7f0000000040), &(0x7f00000001c0)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000008003643000000000010000000000000e30200"/76], 0x0, 0x0, 0x0}) [ 800.207452] binder: BINDER_SET_CONTEXT_MGR already set [ 800.221774] binder: 5799:5808 ioctl 40046207 0 returned -16 [ 800.237335] binder: 5799:5808 transaction failed 29189/-22, size 4096-739 line 3014 [ 800.247427] binder: undelivered TRANSACTION_ERROR: 29189 [ 800.297247] binder_alloc: 5811: binder_alloc_buf size 4840 failed, no address space [ 800.309975] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 800.317086] binder: 5805:5814 ioctl 401c5820 20000000 returned -22 [ 800.317320] binder: 5805:5814 unknown command 808482864 [ 800.317326] binder: 5805:5814 ioctl c0306201 20000080 returned -22 22:58:14 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x800, 0x0) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = creat(&(0x7f00000001c0)='./bus\x00', 0x16) ioctl$FS_IOC_FIEMAP(r5, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) accept$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x14) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000240)={@remote, @empty, @loopback, 0x6, 0x554, 0x3142, 0x100, 0x6, 0x200040, r6}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:14 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) read(r2, &(0x7f0000000000)=""/250, 0xedf1d44) r5 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fcntl$setstatus(r5, 0x4, 0x40400) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) fcntl$setstatus(r0, 0x4, 0x6100) r6 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r6, 0x40086607, &(0x7f0000000180)=0xfffffffffffffffe) r7 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) sendmmsg(r7, &(0x7f0000007e00), 0x40000000000025d, 0x0) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0xf642e7e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) socket$inet6(0xa, 0x80008, 0x5) r9 = socket$inet_udp(0x2, 0x2, 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r9, 0x0, r10) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000500)) recvfrom$unix(r8, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000740)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in=@broadcast}}, &(0x7f00000001c0)=0xffffffbd) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000440)) [ 800.343538] binder: 5811:5812 transaction failed 29201/-28, size 4096-739 line 3137 22:58:14 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffe9a, 0x0, &(0x7f0000000480)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0xaf71c71f2ff30e72, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)={@fda={0x66646185, 0x6, 0x0, 0x34}, @fda={0x66646185, 0x0, 0x1, 0x2b}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000100)}}], 0xfffffffffffffd93, 0x0, 0x0}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$NS_GET_OWNER_UID(r4, 0xb704, &(0x7f0000000000)=0x0) r6 = getegid() fchown(r0, r5, r6) [ 800.382264] binder: undelivered TRANSACTION_ERROR: 29201 [ 800.400526] binder_alloc: 5818: binder_alloc_buf size 4840 failed, no address space [ 800.408624] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 800.417667] binder: 5818:5820 transaction failed 29201/-28, size 4096-739 line 3137 [ 800.426606] binder: undelivered TRANSACTION_ERROR: 29201 [ 800.449738] binder: 5822:5824 got transaction to invalid handle [ 800.458604] binder: 5822:5824 transaction failed 29201/-22, size 0-0 line 3014 [ 800.467401] binder: 5822:5824 ioctl c0306201 20000200 returned -14 [ 800.475099] binder: undelivered TRANSACTION_ERROR: 29201 [ 800.509044] Dead loop on virtual device ip6_vti0, fix it urgently! [ 800.516581] Dead loop on virtual device ip6_vti0, fix it urgently! [ 800.525484] Dead loop on virtual device ip6_vti0, fix it urgently! [ 800.533004] Dead loop on virtual device ip6_vti0, fix it urgently! [ 800.542795] Dead loop on virtual device ip6_vti0, fix it urgently! [ 800.552711] Dead loop on virtual device ip6_vti0, fix it urgently! 22:58:14 executing program 5: fcntl$setpipe(0xffffffffffffffff, 0x407, 0x8) r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8000, 0x0) write$P9_ROPEN(r2, &(0x7f0000000040)={0x18, 0x71, 0x1, {{0x41, 0x1, 0x4}, 0x949d}}, 0x18) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$FS_IOC_SETVERSION(r3, 0x40087602, &(0x7f0000000080)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x605, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) clock_adjtime(0x0, &(0x7f0000000240)={0x101, 0xbc4, 0x46, 0xfffffffffffff518, 0xffffffffffffff8c, 0xfffffffffffffffc, 0x5, 0x7, 0x401, 0xfffffffffffffff9, 0x7, 0xded1, 0x1, 0x1, 0xe81, 0x7f, 0x7, 0x3, 0xf8b, 0x6, 0xffffffff, 0x5, 0x7f, 0x6, 0x6, 0x1000}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000010000000000000e30200"/73], 0x0, 0x0, 0x0}) 22:58:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = socket(0x8, 0x80000, 0x0) sendmsg$netlink(r1, &(0x7f0000000080)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000040)=[{&(0x7f0000000640)=ANY=[@ANYBLOB="600100001f0000012bbd7000ffdbdfa54c016c0066b9761ae157fa76c74d639921e7cdaeb8fb446f4b0d91ccded1d971dec4a181eaca42afea916eefff6b693f1c341f76d3379a5cc8d728a44ef98f8225997929ced0c44bc6e5a9d355d9715b9a53c6164898ca84752d1cef7dab4212dd48a3d20df45264dd8ba75c3ae7e6456e0484a8feb8077e96452a6a24c7c660217e1fd4617dcd252323234df8605c618d66dbfb6b79a17fb0f5d5bf052924186be357118b1a4c25d3092c50e4962ad67bde65636d0aa96d2557f3e47267ad3a32b3443bd4ee8fc336ef019b2f932433e119dd859e0a07f431c35ac6b0ae77f780866f49e057eaef100f27114c67084f0567aa6eafb525b8a3881acf87b7e2a036a375628e54a6fe6069ad308321e001556265b4cc51bb67c378c8f828a62cf9f8f527b5b9026b54fa2be57c686c0315d9954786acd8eaf2a7f47bf16d5136d429cf0108006900e00000020004008800bf1c8b4e76a860251b6421632bf7195e427e3b49a3f1a95ff2621631b286dc967d91eaf4251c29e9324d8bea046e660e5d84f63dc5bb2a5fa38ba68335b5b4922de8c4fc1b2fa6e617de8f7a91301f32b8667375f16e864a0338cefadc59a3db622b50f3e1a660656d6de00b59f6ff7b9b8da0acc623fe9927cfaf7e13807fcbd42e1a725606a4d0fc858bca3e3817b0a3b59828a0c23ff0f44e37885ae049bc55f2717c1d"], 0x160}], 0x1, 0x0, 0x0, 0x91}, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r4, 0xffffffffffffffff, 0x0, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r5, 0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x6c, 0x0, &(0x7f0000000440)=[@acquire_done={0x40106309, 0x2}, @acquire={0x40046305, 0x2}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f00000003c0)={@flat=@binder={0x73622a85, 0x10b, 0x2}, @fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r5}}, &(0x7f0000000100)={0x0, 0x18, 0x30}}, 0x1000}, @register_looper], 0x4a, 0x0, &(0x7f00000004c0)="d0eb1cf0a36ef3676d5db27f70d5fbe38a6e7de993e850a842595f959673290d366f594abdf2349320aedb04e17cf33dbc22eff9bd545f2dbadcb8fc5ad8eb86f1b2c6d1130eafc42e4f"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) pipe2$9p(&(0x7f0000000540), 0x80800) 22:58:14 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r1) add_key$keyring(0x0, 0x0, 0x0, 0x0, r1) r2 = add_key$keyring(0x0, &(0x7f0000000300)={'\x00', 0x2}, 0x0, 0x0, r1) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r2) add_key$keyring(0x0, 0x0, 0x0, 0x0, r2) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r2) keyctl$clear(0x7, r2) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x40000, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) ioctl$FICLONE(r4, 0x40049409, r3) ioctl$TIOCCBRK(r3, 0x5428) syz_open_dev$binderN(0x0, 0x0, 0x0) r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/policy\x00', 0x0, 0x0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r9, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r8, 0x0, r9, 0x0, 0x1003, 0x0) ioctl$TIOCGLCKTRMIOS(r8, 0x5456, &(0x7f00000002c0)={0x6, 0x1000, 0x1, 0x30f7, 0x14, 0x4, 0x8, 0x6, 0x1, 0x101, 0xd, 0x859c}) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000180)=ANY=[@ANYRESDEC=r7], 0x0, 0x0, 0x0}) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x101000, 0x0) ioctl$sock_SIOCDELDLCI(r4, 0x8981, &(0x7f0000000280)={'bond_slave_0\x00', 0x7ff}) ioctl$TIOCLINUX7(r10, 0x541c, &(0x7f0000000040)={0x7, 0xfc}) [ 800.592296] binder: undelivered TRANSACTION_ERROR: 29201 [ 800.598779] binder: BINDER_SET_CONTEXT_MGR already set [ 800.606410] binder: 5784:5791 ioctl 40046207 0 returned -16 22:58:14 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x4000000}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 800.660554] binder: 5784:5785 ioctl c0c0583b 20000480 returned -22 [ 800.668423] binder_alloc: 5836: binder_alloc_buf size 812539092926464 failed, no address space 22:58:14 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r3, 0xc018620c, &(0x7f0000000000)) r4 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 800.718572] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 800.730521] binder: 5836:5841 transaction failed 29201/-28, size 812539092926464-0 line 3137 [ 800.741629] binder: undelivered TRANSACTION_ERROR: 29201 22:58:14 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x259042, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000040)={0x0, 0x4, 0x4, 0x2, 0x8001, 0x1c0}) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x58, r3, 0x1cffadad7586d358, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10001}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7ff}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x80) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000010000000000000e30200d76aa658271a2e621c00"/85], 0x0, 0x0, 0x0}) [ 800.778489] binder_alloc: 5855: binder_alloc_buf size 4840 failed, no address space [ 800.788246] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 800.798599] binder: 5855:5856 transaction failed 29201/-28, size 4096-739 line 3137 [ 800.809614] binder: undelivered TRANSACTION_ERROR: 29201 22:58:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000300)=ANY=[@ANYBLOB="000000000000000051ffffffe5ffffff000000000001d9070000000000000000440d79fb336b8accbcf3f275f37775442945e9be6f60ebdfcd01232a14ee302c2c0cb2d2e233b2af4736e53fd5b0d0c17cec706eb6c00d9ff5b204c1a9c65551b5ba332276096ca1d125824f6c996f"]) ioctl$sock_inet_SIOCGIFDSTADDR(r3, 0x8917, &(0x7f0000000040)={'hwsim0\x00', {0x2, 0x4e23, @multicast1}}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000000000)=0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0xfffffffffffffe03, 0xfffffffffffffea6, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 801.011562] binder: 5805:5809 ioctl 401c5820 20000000 returned -22 [ 801.018518] binder: 5805:5867 unknown command 808482864 [ 801.024835] binder: 5805:5867 ioctl c0306201 20000080 returned -22 [ 801.110908] binder: 5870:5872 got transaction with invalid offset (-509, min 0 max 120) or object. [ 801.120274] binder: 5870:5872 transaction failed 29201/-22, size 120-24 line 3199 22:58:15 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) read(r2, &(0x7f0000000000)=""/250, 0xedf1d44) r5 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fcntl$setstatus(r5, 0x4, 0x40400) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) fcntl$setstatus(r0, 0x4, 0x6100) r6 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r6, 0x40086607, &(0x7f0000000180)=0xfffffffffffffffe) r7 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) sendmmsg(r7, &(0x7f0000007e00), 0x40000000000025d, 0x0) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0xf642e7e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) socket$inet6(0xa, 0x80008, 0x5) r9 = socket$inet_udp(0x2, 0x2, 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r9, 0x0, r10) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000500)) recvfrom$unix(r8, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000740)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in=@broadcast}}, &(0x7f00000001c0)=0xffffffbd) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000440)) 22:58:15 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) read(r2, &(0x7f0000000000)=""/250, 0xedf1d44) r5 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fcntl$setstatus(r5, 0x4, 0x40400) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) fcntl$setstatus(r0, 0x4, 0x6100) r6 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r6, 0x40086607, &(0x7f0000000180)=0xfffffffffffffffe) r7 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) sendmmsg(r7, &(0x7f0000007e00), 0x40000000000025d, 0x0) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0xf642e7e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) socket$inet6(0xa, 0x80008, 0x5) r9 = socket$inet_udp(0x2, 0x2, 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r9, 0x0, r10) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000500)) recvfrom$unix(r8, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000740)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@local}, 0x0, @in=@broadcast}}, &(0x7f00000001c0)=0xffffffbd) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000440)) 22:58:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x9) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 801.480514] binder: undelivered TRANSACTION_COMPLETE [ 801.486067] binder: undelivered transaction 3530, process died. [ 801.503718] Dead loop on virtual device ip6_vti0, fix it urgently! [ 801.523103] binder: undelivered TRANSACTION_COMPLETE 22:58:15 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x1) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 801.548677] binder: undelivered transaction 3536, process died. [ 801.617352] binder: undelivered TRANSACTION_COMPLETE [ 801.623144] binder: undelivered transaction 3539, process died. [ 801.647203] binder: 5897:5901 got transaction with too large buffer [ 801.659050] binder: 5897:5901 transaction failed 29201/-22, size 120-24 line 3295 22:58:15 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r1, 0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0xffffffffffffffde, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000532bea8334a15550a89f1c9dbae4b800005d6d3cdd1c074c5546833bbee100000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYRESHEX=r4, @ANYRESOCT=r1], 0x27a, 0x0, 0x0}) 22:58:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000000)={0xf, 0xf0, &(0x7f0000000340)="b878c527ee6bd27c2d168f3bf6672a9e8f137f887fa2abb755ab76df3abc496818a76b3ddeefe5dfe2776c15dd1349267e7cf53d0950105d09b92f786c6fcd290225abbb78c86a860c4ef77b1ea115e441f9c61b11380a8b335ca328f4ce5935c084ff5fbbcbd56c83c7e28142fdf8ed5d5a8e2a1ddba30e4c0f403634d8da1e1193905b58944c782d393dcfef6eaddefdc93eaf7c850caed8ccf49ae557e1d8c310a626cbe10d344e3866648517f8ca9d8b232d507d3f777701a382b9b7decc98851d1e54e30a87aefb5edc84d8dd665a3c1827c9c7829e63311e1c9a3aac10d728894e01131ea0ecb69863d15de6b8"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163484000002100000000000000000000000000000000000100000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ec1975a40b5d8cfd51d8ce4d895b193c41c8a4e4d184d6a6564d0000000000000004418b3ddf345ae7099a053dba51e15362169429f73814d5611d43b891450a2de3259205d6aea8603923bc01c3b6b334325a5da521ac4e0aa4cc83c4801b955f0272b4641fb73ba8b604b10f543cef0161d4eeebf38c96b08926b974f206195c6b367b99cae8e6075e"], 0x0, 0x0, 0x0}) 22:58:15 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="902100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r4, 0x8983, &(0x7f0000000400)) quotactl(0xffffffffffffffff, &(0x7f00000003c0)='./file0\x00', r3, &(0x7f0000001700)="d6c2153985ef1195c8626a7b58dd7a18cf7306a491dffd908524bd91d5a1a68c46") r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) fadvise64(0xffffffffffffffff, 0x100, 0xce88, 0x1) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket(0x1, 0x2, 0x0) getsockname$packet(r8, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r7, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r9}, 0x80, 0x0}}], 0x300, 0x0) sendmsg$inet(r6, &(0x7f0000001680)={&(0x7f0000000000)={0x2, 0x4e22, @rand_addr=0x4}, 0x10, &(0x7f00000015c0)=[{&(0x7f0000000040)="a1108c1f8241c3da7367602ac94cf2c342ba104628cb0bc78e136f0742c5683be7c753ecf60a832e14af6aca", 0x2c}, {&(0x7f0000000240)="c9707d241113b55f3c13ad543f3e11c45acdc25ec1cd62ed5b455faf75c3a8fc8b5e3335a045489c7a565d8e9c6efdf6c7216ca9a26df129dcc676475c9cb2bcd9e4cb2ba56c0a485c4308e9f8472700b9c3b43a1b98054aa270cffea7d45574217a508361f7a40ac96ac9ad064ae1737a53eef306df1e40065f20a507076663c99bcf99980d7faca237e42e31c8eebc91252e627c1a373f7c8c", 0x9a}, {&(0x7f0000000080)="d14eae1806", 0x4}, {&(0x7f0000000100)="da3b9764923cc668945c17e927ef4cee39ccc2d6dfe7931b1481fe9c333b4ff61017a90d23cce65b3799adbf3ef9e380b1e1d1e3f18a80", 0x37}, {&(0x7f0000000300)="6ca86908411522148b01c34040945343540aa9791fbe488f8ccdb82d769a5ec4bc776f94c513904701a28385aa3a1b1d0d47535aa7748761d75ef5048e9469cddc22fe2e9c3be5b2bf3417106a8381236a3ba2766d4676c83b38186d42d88c971198038a6bc12c8128835b1501c202d402a7a67ce74358ebb37f7bccd6c969a1c1291b58a527ed508312d5675dd0f596ad88563138c48b710af8821c8308d52e1435549ff4977071d6ba92bb6aa09a1bb61526c0", 0xb4}, {&(0x7f0000001740)="3ee8219b7a0d20e9ea3c8b77029264e68e61cdc2c335187bce83c87f1a45310bc011b6b02cbc3c4d8d5969eae5a113c138b5dd719131b8b5e413c2f187aeda816e820eb0d715edc0dd0cf20b9ffd5a6d89a7d1c755cfd0084f9f0eb9be2bc28f5da54b85cf263e84b3bb9bbbbb0b2d49481e86d8e191dd585f8eae32f61bcfc48f20ed68135d953d4976e1e7e1da9592a00ccbd3dd8f9e0824f97d328b4d1e7ca88c329c783b33cf74e7adf5b2b6dda48c1c5b1ef1f255a4cf53bd9511818fc94b8874859ef5d2f860567761cbb0af", 0xcf}, {&(0x7f00000004c0)="e0b5c89d9e7224cb8efaf9b728c62cd00b15da2dfc8eec79197389dbabc87185dd2079f2220cbc8bd27d0c28ec605510b8f106ccf636a2fd416188994d9c31da17065356f59be15166c5140b9a2c2984735548eaa4ff3fb11e2a693131d19cc16b0a6eeff0fe25037c3dd515897c7f5d33061ec107ac57ddeb8132023f14fe1698381e18aeae918b1fbb5a2d10baf2df08dddb7c6f32206d1b1792ad053375c85ba11fb667a57058f606fe27c237874c37bb9a9b9ce28a07a945fa0c1efe6e6cfca65e56fbc2ea82ed2ce76e9d43b94e6e952fea09b4dbca618b766384fe55531f005275cd638674a16f3307a95073dc0d8e77247e9027157105259d4f48f7c122d3495a6d428d256907a8cd5232c1de01fcd3d5e5f2cdcb3f155bd0151dcbbb6475e2b74ffbbc89b5ff254910c3d9dc085e44e32dc4822ad14846476104ce98e945891765f9c00dbe6ee3b01da9b2339c1adb55fd9b18c895beb0c78b15f8004edcf60914c057e4d90b7bed430639f99261a01b7846305ec708afdf0d0c980266083533f65c4c4b755cf309bcd2d068b73253d52ed46fea95e2f9424fab35ff00f1c81808e635b3d202a5f37ac8f6abe0d670a38ce6bfb58a01c60fde726444888549f40487c72c1b6b7dafe98f8f9f24b28b7118ed49985c6e9a697c4e1acf3c2f723cdd1453d825cf141d354c542524284ff2838622b23731cdd9532f1f991b914232bf394c3242bb4e4424282a899e7a32d809a038a8f42e96c9babb451e743e4549b7ccd3a760d1b6689be9fb5a596c9adc3482860aa831a7b27bac3c140fd8d22b91237740bfe3cad611ac8d421e873a5c0fc54f376f8a1e92ec517092e965b779c82266a6c38e75d98db7e504152809f2980039715863e627b5b58b171a0b53c22735d203dcd4309b40631c50f46cd52b69985a8dadfdf540a6edace86f0a8949700f26d5afa9ee946e7830a85448db6d17479853de3b33d6c5168a62b54ec660a1b2e93cf26016508b5dcf974ba74750a15c65b3ad4d6ebcc4e7a528d743ca3a20aa796954b79bab246f2d23ac18ace16ffe826ff0b77d1a51aa14afc743dfb697f4df18b836598f10db7b5755b62dde154941f6783cc86c429294262ffdd12e9af32225d5db9c340c740ab4b3a4294efe92973533d7353a67f13c1a5aace2673fbbf7287adc395102ee8949a387fc51bcb838e945e5811a1e086eb01567e2a89e9deab93e185771c5ae2f728ebc3b9d6b96eea6bb1e5e8bf758734a79f8df59ee5589ef707eacf6ea8e9194755fef8086aa5fa44b221c91a00efc05957d833a2529a619fb90ad13ea582049024a6087e488d7bb9360717aaa67797e844b52ef2d6f2c715f592876ddff101cc356693fa7d211b144a13f245c246036a080da3eadeda8da0fa0572a8e94505d5b2b18f80e8f940e4c4ef9ea57596e2d157530b4c7a4b1547196abf7e24856f58537e66b9d57a969197f453701751f04dc9eaa3266dd765c61f5ecb1fbd232b9d9ba6fea1ce48c7f9370451882264346e326e00663526abd0447f46a86bb166143aa9e66ee626d2e5947b58c802288a4dae5babb8b08eb7aa49429a64348910d2b4840eb48d645dfe7d5e1122c0bcda4b0d405f2693f3d4f787187fa74f2b2ccb714d414dc745f3120173027a327a3a06c488a81a4feea1f8816f92e3e2e511a8dd0da9300746016a31a239a645bea09aebac429a94b2e9a49093aff32906c8ea78e3eebf067e084d54580de2b69162b28161991747ad5ee86743d8088797555a276ac44d7077b55d705e1fd183b7cbf68e4748908356544b83be268638701c376f1e248fb60f78f90a56c710e6daa0c434c98881e87939cc930d0d194d10d6bac23ef4b8ecb9023aacfb2b099a1fa0afca3f58f94954de1372f1b6a87af49f05f8f074f05e6c15b74816245149a6adea52261365acd7a2664b2d6c567fc79dd5b08c4cf05ccfe63b76c006c39d86fc10afc76dadf6bfc1bbb830aed8636bf8148da23048401747126adabefebb10d0d78997b14cfd39cd90d596833162c70462768994639dce7300409301736adde66826f787830eb2e9f2efb8be84994cd79c6ea5830bf98f2eab9a8953157a5dae68686e72c407a565002813c6a6dbcfd8c8a1897a03cd41e2011a206de8f847e0bd326b1d16d7d2076e58518cc5538847f0ac96b5911e0f0f9a529b58cd0dc06860fc9e00fb727d256e8b91c4a701e896d62ad8b405a2f38d73e09552cf6f507aeeb87629c3936a5a0c402fa4144e9ff5636149c031f29a39a2f311972c3f6dd5f659043cff4b63a33f12079458d6b8ff0158c8dff8d033793a5aaead83b8701567c053a2aac7b296059a31efc3e6b91487c7ae793be6ceb8f8b019c8c14ca7da3a728e18656efbe78b81a1732aa021250b816ff69763c02f621c2e5e9569ed04b2ce124254f25578cc42db07360c8ba09afc25bc04f76ca15750f0db7f416387e4dcbdcc16ffde76a5c41a20a230a7191fa5b9bc4a1a0ab766833a9df92105d69d415993b9e26f3a6360ad0450ce09f0bdbadbab146ce93c39108207d274042333acef215a5407b3a02df28e71c3c6aad144eb4d17798aba79c699748b3864ab2847b3f00ba301dbe4c7b8adda66b4aaa2498cb39a3b48c7da6a5ff127cc1a9673aab9ea438846d5bd511997df9c5ba545048d83f30eb46cbd85e9187b23877d33cae14ac8621a001c4757c7ea948f2ad7a6b51c8f53d9fd4300b53b79e39768eec71097b280c4d22bea66b243b5ebadc32af78e66d174a33fa1a602bcc15e0b8721a4c5937f06267a9f8884de6cf7b2b53f1b12af14d890ff9c599e94bd08ac506269c3b2c4b9286997ffd94eeb497805870d061c3e36e0d1708308ebb3118ea2a766f6a983e7ab9d0d167bf0c025785d26e5cd3188557f8b0672107f2ea47217b5426eb9c746ec2bf1cf16912f4b9081d92feb1ad972b35e29811808cf722f134fc7af44bcde8ae28d9d30504b012d5cb1c1b7bd4d9512e615259196224761dd0d56938b6c32a7102bf71544b0040b330a505b085297d13858a9e6a59004bca1d3158906602422f84f5a801a63ca6d980c8ee6fdbbef9de0b19a27274b1f6de34dc078aff9bde63d62a4d98a19d8faca3897528a5cca67c53d8182f1b19bd206c767f6c9da74b3b537360ee975c05f6440019da5d6f84081293d0c4d4e726f8318e1b5ea61bade2b217c1d855dd19063fedb95ba817db1d87360b125e6c573fa939f72650815c27282e3adb90ce81d1012ae0e6a79b349b7cb5babd5edd4e8467f693abf96f121b2661db82d0adf4f6e3d7157561678ae3d2cdd4e6804a7206d4fa546eae9402887684a2358bfe881c4ccfc01c95f74351e1d2b86615621ae7ea6458baa1c8808838329866fa023052ca8a86b0074a87bb7a233c99958e347a8223baaaf0006380f3ae71bba6c4ae5f18d202cf2812a9df981c3d5c88f0ee2a55c0c8a8a0f97d455a95f748debe5b1a76ff15ab3e8b188409d53dc9594a05ca58412eaead13287c8eed5512f4d66d0d6845b5af58e372239ae4fa12260e2f41a459ac9ffbfe70487e8f12790cc794a0638356119b45efddee06cf6012cb6b05784969e268f53999c4f35a477119488aee2120643e9bb55642895a07f07186f4eb4d8417d70a03de930503a18dda09a275182185f9827e0be1c04a26525a72fb1d801341c1f4ee2362d061c29a17cbca77a55b17511ca11990a7125d66a3e8b392bc3a595a0fb113224892c5686de8ec564738703ff9c030ef5a3a8a504123aca6f0752324750d46d86c8d4e8d4e97510c81d468421c354518042efeb2c9b6e25b93c74e9c11c0d2b86c21410c9bc5ba47713b9d81f127df98b4ae596d54db2bf0e038cc6e69fd1b437b2a88ca99fe36705df1b3d72b26ad062c57af133fa18b3ec0d51cb19b12f71842e5a14ecce8b00992c9885ef5dc7b622001862a03a5c97d6b0d56ad79a9c6083b9f70fea2780e8eed720eae0f728d72dd2276612f39b5006d8ebd0c89d708c9a277f163f567caf40528e2865c12157163c9d888b3d23a309176c7a1a6653122a3989f046b61b2e9d6dcbb589c1276596ee2c02ff15774046fcbab99ad43ca48cb82a32be774e9dd72a3e2f48faa2dc9dd06f0a2b7f24fe2e9f231e05115e692cadd0b3745380783bb66d78baf59df13ac520d99ff556c4c60ef83fc44a4abcabb39b9fc3ae503b21cb05c45e062a2a471d237a42782b01e9f2bdd6601796011301aa95b9da7a6b676914017f625783f7f14bf17fe1480592b08e2b33aab195c78e7fe74c19fba5d4190fd2e5a7aaa13559e6d913df73d70d23a6981dc3a36115969e044851d1cc992164be2c6fdb39c4505f8ba046cd150bc9b1f22d78b017ac8f0174dce3ca2fab61de6a17fac71ecc4b49d0093370c23a1a424e0f7a590a583ddd59f1d5435bd87a3120d90845338f203ab6b7071d9fb52b844b09236d669b4b654da777c469624d309474e038553a2d27215b1dc6037628a7becf76d3e33cd7e93cbab596768036fecb35e5df6a6dcf12f66aa40568896fd27cb79d2bcb0756fec2564cacc11a778409f9e5e3553dd189f5de4ee78bfed750a6bf6f484ea37363ba48c13d8f8570f6bd6263268bb4cbb6beb7f494d962c9ab5b5243cfde4cccea10eae5020012e934afee980c41e8a769ac72aa4fb4d248f2c0eee2c32163497ab0957f73eaeab6fbc5aa9bbd3ebc0b2d63420b10dfc015f85b5dfe1402ec7cecf92b83adc2e4170734a4884922dd1780357ee597b63d0d2ce81b376c5b4d265036ae843419eed290319bc7307b1a60a07d845e6d2a1cbdd508cb7578d8fd762024de47fffc76e616754231fa8b48c2b1783132d7cb324e2e0921e57cd28cb9436687c7cd1655f4411d7ff0ddea1fca506479de689f9dfcb1092199080993f7cf59bc75d292c645156c3ddf02c2a93369ede7cd9cf3bdc5211ede368a601d5814487d2cecceb63cf6a991524be61f027d8f297dcf6c2eb88f0bdeb0dc4339857f3b02486cd09fd0325650e0450aa37d967a1631a9c81f1b18f8fa3944b7f574473d5ac2d5717fe80d50c7090d1a4e86b3cd28b0816deda88d5bdd30acd0405690e74dcc667848d41767bda5720c04286e6cea6399408362323aef662e10a15d0ecc5f6a8b6bdf3ce0028fc5e8a1b5240f7406125b413d956abdf54f384601a874e8df661af64b717bf16896af3d394d01c06bab5cfbc638d833edf249a70a4a478e5c0b62833d10b835f3f8f4392dc6994c99f89a0720a8424097c8fb2627ed245249cd3a3109cf2d8a1176cc8729debe7660ca1597ce5a902e8f9b459e0e0e710165bc26ff40fe59960f169bc49d34896f66332052e76debb610754578be084f2844bfe44fa31d73c4f1ae1b4a124c8bd9ef07a0e640724cf9f37cab4c61923fecc6c302b43fa31512eedd9e82898f6a258c325ed448d08ebcb00f57b08da2310c9e664006dee455ffcef3cc519bf70548dbe295d931f43f79ab8d83ced8fe495941fc73ac29b81220c2fbb806b81b097176af1f6db4c20dcef552f74beb3fe494f38a0d4608396b1549b27df4513f1bc6f3e045eb1c43dcc9ff8ca98baa26462d54097e3102cd6d8ccc371526ce8a8fb663f3c19f9059f8d37d6054316f8e0d37c0de1288d9c0d9de17c8341596c86ab8a0a6e746feeed7e8ff8a5fca0d49f38cbe50c69c7dd4dfd2508a168e60bf86a2444d87694d6ef78b8b7bf9187de0ab012723497657387b5ba6fe6f55331e7cb906ad5f8", 0x1000}, {&(0x7f00000014c0)="6a55df9a7bf41d1a6385fb1aa773b65de7ad8f64f547fcb8027ba53b6b08960b1f349794dabda9dc7e74268f115113f7a201f0bf576c2fb316a7a5dc26ebf5de024a", 0x42}, {&(0x7f0000001540)="5e70b22078148b335a9745a8069f098273c6f685f8afbb492b742b11c5a17a3ad8b0f4854445c109f45b212c4d8026d35d2af0d1d4584e7faee95953855e682be4ae22659835a689ecf33ab9a7f6198bdb418833090ed59f1a335085cf2fa47c683cd56ef20ef6f90dc705c78a9560", 0x6f}], 0x9, &(0x7f00000001c0)=[@ip_pktinfo={{0xffffffffffffff81, 0x0, 0x8, {r9, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}}}], 0x20}, 0x6008005) fchdir(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000009d2b7a3800000000000000000000000000000010000000000000e302080000000000000000000000000100"/76], 0x0, 0x0, 0x0}) [ 801.676239] Dead loop on virtual device ip6_vti0, fix it urgently! [ 801.686888] binder: undelivered TRANSACTION_ERROR: 29201 [ 801.687525] Dead loop on virtual device ip6_vti0, fix it urgently! [ 801.687895] Dead loop on virtual device ip6_vti0, fix it urgently! [ 801.693359] binder: BINDER_SET_CONTEXT_MGR already set [ 801.693368] binder: 5897:5903 ioctl 40046207 0 returned -16 [ 801.747570] binder: BINDER_SET_CONTEXT_MGR already set [ 801.766961] binder: 5905:5910 got transaction to invalid handle [ 801.792536] binder: 5904:5908 ioctl 40046207 0 returned -16 [ 801.811328] binder_alloc: 5907: binder_alloc_buf size 529128 failed, no address space [ 801.827090] binder: 5905:5910 transaction failed 29201/-22, size 0-0 line 3014 [ 801.848692] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 801.867128] binder: undelivered TRANSACTION_ERROR: 29201 [ 801.874107] binder: BINDER_SET_CONTEXT_MGR already set [ 801.880961] binder: 5870:5872 ioctl 40046207 0 returned -16 [ 801.887595] binder: undelivered TRANSACTION_ERROR: 29201 22:58:15 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r3, 0xc018620c, &(0x7f0000000000)) r4 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r3, 0x0, r4, 0x0, 0x1003, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r5, 0x0, r6, 0x0, 0x1003, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r7, 0x0, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000480)='/dev/full\x00', 0x20000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r8, 0x40046207, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r10, 0x0, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x84, 0x0, &(0x7f00000002c0)=[@free_buffer={0x40086303, r1}, @decrefs={0x40046307, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000240)={@flat=@weak_binder={0x77622a85, 0x1, 0x2}, @fd={0x66642a85, 0x0, r10}, @fda={0x66646185, 0xa, 0x1, 0xb}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}, @clear_death={0x400c630f, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @acquire={0x40046305, 0x1}], 0x9b, 0x0, &(0x7f0000000380)="91853104e81627a5f329382d5304d73bc3bf7ec5f38bf124b88e63cc94ddd68759f85ccbde93e28add31ae1126dbdcdee45539f2fe46412888e0414a969b4affaa0d6c0b22d66dad499999e53fda438eafd397c437d079f0760c209fe9765e3261f668fc55f9adf25e0605ab6c0afb93cfad48f29754c29ccdf4f11733bc1b87b385c999892b9ba7ad91542d2121b568b21219ea4a0b2eb6539618"}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r11, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r9, 0x0, r11, 0x0, 0x1003, 0x0) accept$inet6(r9, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f0000000040)=0x1c) r12 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r12, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 801.906826] binder: BINDER_SET_CONTEXT_MGR already set [ 801.912929] binder: 5905:5910 ioctl 40046207 0 returned -16 [ 801.941678] binder: 5907:5911 transaction failed 29201/-28, size 4096-525027 line 3137 22:58:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 801.995143] binder_alloc: 5925: binder_alloc_buf size 4840 failed, no address space [ 801.995610] binder: undelivered TRANSACTION_ERROR: 29201 [ 802.047789] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 802.089217] binder: 5925:5927 transaction failed 29201/-28, size 4096-739 line 3137 [ 802.113370] binder: 5929:5932 BC_FREE_BUFFER u0000000020ffe000 no match [ 802.120985] binder: 5929:5932 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 802.121480] binder: 5930:5935 got transaction with invalid offset (4294966837, min 80 max 120) or object. 22:58:16 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newsa={0x160, 0x10, 0x713, 0x0, 0x0, {{@in=@loopback}, {@in6=@rand_addr="02ed4d73062b85e8a45dfa2e6a347805", 0x0, 0x32}, @in6=@mcast2, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_aead={0x70, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x120, 0x60, "e5ded35713882b9ed9bc5c5a1c66b92f789b133cc773ecd14dfa9409c75a3dcd1a150600"}}]}, 0x160}}, 0x0) socket$key(0xf, 0x3, 0x2) 22:58:16 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000600)) setsockopt$inet_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f0000000100)='tls\x00', 0x4) r5 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 802.121538] binder: 5930:5935 transaction failed 29201/-22, size 120-24 line 3199 [ 802.146461] binder: undelivered TRANSACTION_ERROR: 29201 [ 802.158411] binder: undelivered TRANSACTION_ERROR: 29201 22:58:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) ptrace$peek(0x1, r1, &(0x7f0000000040)) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 802.261429] binder: 5953:5954 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 802.262040] binder: 5929:5932 got reply transaction with no transaction stack [ 802.262048] binder: 5929:5932 transaction failed 29201/-71, size 80-24 line 2922 [ 802.294285] binder_alloc: 5947: binder_alloc_buf size 4840 failed, no address space 22:58:16 executing program 2: openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x0, 0x0) socket(0x1, 0x3, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c476828c7e4f1cd80"], 0x9}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) creat(&(0x7f0000000080)='./bus\x00', 0x0) tkill(r0, 0x3b) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) syz_open_dev$mice(&(0x7f0000000300)='\x00\x00\x00\x00\x05\x00\a\x00', 0x0, 0x400) syz_open_dev$mice(0x0, 0x0, 0x0) creat(&(0x7f0000000180)='./bus\x00', 0x4) creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) creat(&(0x7f00000001c0)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$packet(0x11, 0x3, 0x300) r5 = fcntl$dupfd(r3, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, r0, 0x3, &(0x7f0000000240)="a199f7e2f222243683d3db7d63024ff41196000049e42b47dbebf5e34e529bcf057eaeedc746e6a2272f5c53967b614ae8faed30345fd1c496163fa10c242fcc55a301886264ccaf1a9403ac7862db6e66") ptrace$cont(0x7, r0, 0x0, 0x0) 22:58:16 executing program 0: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x400, 0x1) r1 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) getdents(r1, &(0x7f00000002c0)=""/200, 0x1fc4971b52dcc626) getdents64(r1, 0x0, 0x0) [ 802.319784] binder: 5953:5954 transaction failed 29201/-22, size 120-24 line 3199 [ 802.321487] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 802.321531] binder: 5947:5957 transaction failed 29201/-28, size 4096-739 line 3137 [ 802.348754] binder: 5929:5943 BC_FREE_BUFFER u0000000020ffe000 no match [ 802.356717] binder: 5929:5943 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 802.367198] binder: 5929:5943 got reply transaction with no transaction stack [ 802.376572] binder: 5929:5943 transaction failed 29201/-71, size 80-24 line 2922 [ 802.388502] binder: undelivered TRANSACTION_ERROR: 29201 [ 802.403951] binder: 5953:5972 got transaction with invalid offset (4294966837, min 80 max 120) or object. 22:58:16 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) writev(r3, &(0x7f0000000500)=[{&(0x7f0000000000)="87880907f484da65081387ac69b146fe734b0621488fbce3018ad19b23b5bf94ff5e54f2868f2758821e079f33711d324164f8095e4beb4945e334f4488e2752fc2cd88a2ae9b217acbb36477e8dfd55a84ed4455c0522a3af210d9c61349601e8a68a776c7974dcc406c97d2425086f1252860e4b4dde994fdbf62e9a471314b5b2b2a44ca054bb38c8f48bcd6695c529b0bcf72b785968ea29bd0665e8ad48e3400f28f0b53569a7", 0xa9}, {&(0x7f0000000240)="bd56b037b9320792cb571f07dd73d52d338933d1a6fe6a38501cf3382ec63a6fdce760e54ae5eca638847fe302fee6d2c50a53c7d9133537a0bbfa1b18063169812b5c138610167a15820cff1bd7", 0x4e}, {&(0x7f00000002c0)="b1ecddd68ff37b9441329c1a13f3defb32628ac4a39c10928a8d14cb93026978398e79671757cfe5e6ef22c495d8ee1a4743f1d8a85f3c28206b0b382c5bf362e8", 0x41}, {&(0x7f0000000340)="2c83db010e719b2c329f99c81de04be21823718f873143b1388694514a22e5d5d36af64bfb2a0ea2cc9f01363662a88b2252636889f4fefdf6a5eb9136d37d4e5ab30df2adbe2bd7736fa39d3454dbe57ec4305f95beba5c32729fe5c347dc1dc52ea2a7bede16bf14b3d31c4235b533c99939f93e5776e314ce1fd26fac82af299888660d2bdf6201c7fa4d510e", 0x8e}, {&(0x7f0000000400)="de5e56c24e71c92a935b7f0496abd78886ef199cee4ae5a05ccd3835a714c305dedd073e5357d4f2d643a728fe97033ce48c93a1ea1d7254de4c3b36819e4c7c6a743717f6dd5faaf9cd1c93b6b237e3eab1e580c318d045263fc9f6d51e67c2249cd901574a2b5975f3ae5ff407a08b1c55f4625fb4d15702329437b81580adf8bd8bf21925803ea5378897c767d3ec2017f56aec395738e5ef4698499530dbf5b38607df2b987367c3b6f5cb6206df15d8f28fe2761d0495d85caf6814e247641159dd", 0xc4}, {&(0x7f0000000100)="0c68b731c4875008be08ef1911ad", 0xe}], 0x6) 22:58:16 executing program 0: r0 = socket$packet(0x11, 0x4000000000000a, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0x100}, {0x80000006}]}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000380)={0x16, @empty, 0x4e23, 0x3, 'rr\x00', 0x6, 0x1, 0x38}, 0x2c) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) ioctl$int_in(r1, 0x5421, &(0x7f0000000080)=0x2cd6) lsetxattr$security_smack_transmute(&(0x7f00000001c0)='./bus\x00', &(0x7f0000000300)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000340)='TRUE', 0x4, 0x0) r2 = socket$packet(0x11, 0x8647001217dbf231, 0x300) fallocate(r2, 0x0, 0x7, 0x2) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x40082406, &(0x7f00000000c0)='/\x00') sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000600)) ioctl$UI_END_FF_UPLOAD(r4, 0x406855c9, &(0x7f0000000140)={0xd, 0x100, {0x54, 0x4, 0x7, {0x7, 0x2}, {0x76b3, 0x401}, @const={0x2, {0xdee, 0xda8d, 0x1, 0x200}}}, {0x51, 0x6c6a, 0x4, {0x20, 0x1ff}, {0x1, 0x5}, @period={0x5a, 0x8001, 0x6, 0x2, 0x7fff, {0xc7, 0x3, 0xac0, 0x8001}, 0x5, &(0x7f0000000040)=[0x9, 0x3, 0x6e, 0xffc1, 0x9]}}}) sendmsg$sock(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000d80)="74cc6faabccdea5048e1c84dd1528131c01f1bf3d596b18ade0a864209d3226a1661f3f323a8325b0935da75380bc21a4e81d911a98a7cdfa91c213a767d495df15707ee61a6d780a6b282c4eaaa26a2874ca53da7fcbb99d4a0162bfa70872a9ef4cf401f7e35aebf6db5ac0d4913a6c55a729a2bd57ca3d2a359fd0bb4ff8286751ebf92ba55c276123aee91c6d4033afb51a8ce641db0d28b2b796e6784a795aa00ab08cfb9c3be2cd58cafe7fe71e42e87d327445a54e96423b47a54869065861c5dec86d22b0485c17c9adcdf7dac0d1455561af153da25dd27f524cb9a010000801fa4d243363aebc60000000000889992b2c02b20cda7376f99570c01902110de698c45edb29f8dc820f11abda85d46841ae2888132f37f4f3af5cfcdebecddc8ddb687828338105b3d986256c7790e7cd125f4ff8b427ef9b2dc816db5f7ee89792df5e6a97cc18c41e771fbe74251c3b0f4affe2d8dbe0cd3e46b445008c3aa3b8c1b59e48eb83b7fb8b162a27559dc3085f8a589c70a", 0x17b}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}, {&(0x7f0000000840)="f46cbd20fd4b1cbce1a13485b90f59ea6f6ff7d1d49d49638713fdb1f9948a1c0b6f3fe3d61a2acf22d1366859278aeff3d7877b013f83663b0b10f2a41ede88514b50e870f171bf281675932c38887237a754b1bd142f633071c6621340274ad26fec3bca58a92c7a867327e91084834ea6e49a916be86a997789b25ceec3a9ff834cf36c1ffc120777c2f6d1216b5b23985b4d7df305bf6cdf43cc3b319f76429b45aa7ce56ebeb46a5d2968b8abe4ec5436fdd6b685ce3c63ca248d995177ac0d4bdc074e70f32c4e750b11fb6a240e770da692e8015ee679bc9a3bf1a852b280f5f673ac8f9fe986ee48fb7aeb7062de7224aad9966d454cc69a96", 0xfd}, {&(0x7f0000000640)="c97bead89525da49a6e9e27830e41ac4aa53b96bf12be3495b331e23ee0c4747d34977d8bf41ab9f082d981f820fa784fd2274ad3944d71110286a211b65db461de7cd29323b", 0x46}, {&(0x7f00000009c0)="9a97b4714716eac6000e39ae06bb1893e3abdb1c3bc5439ded8ec8258984d920fd5c16aa0e08751b24f01dfbe9739d021138fe06f497c78c21c8c2aeb603c16ad31d42ed3f239652eced63555f131fba39d3cb2bac97a366e5b3aacf5705ae4ae9bfece85d6c15f38cf83738cbd3d0648ceb04dceb7d968e12f6be4a7cf42dcaf8fc9ec5a4c44ce73338ead1d78e9054becf951dd58c56d458f90d69dad1bea60ac98f3ffc14fd9d7d0b984911e3d4e82eb41ec3236ac6f6460e4fb7", 0xfffffdb4}, {&(0x7f0000000c80)="8b392db9b7a4ffb8f4184472a38d4021e56db1c33c4b2b363aa62702ccc4c13a65eca09de9ea4a69debbb41b0862798f28174adb11b105f136e0410359c1f3cc0e1eebe2490039a3806968aaefe814e21ed9596058b3450a5784210b84cbc39cbac76865ea762634b394bf62656fed0bed1daf55aa352b13e45b08c63726b9956e3879922591e38b9f149cca01321d3ecc7bc5c261cbc774e2a2d45e54c61f7f7b73cf36d8a4840a611f70c28644573456e45d5d154c2491f993061d31a561fa74b519767f976d2084bf629f28ae1a5e000000000000000000", 0xd9}, {&(0x7f0000000b40)="ec0004b4f2e2d401670b36080a3bf16c4bd32510a73f84e0a1cb3d72ad882932e78da5", 0x2f}], 0x8, 0x0, 0xfe98}, 0x0) 22:58:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x4) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) setsockopt$inet6_tcp_int(r2, 0x6, 0x10, &(0x7f0000000040)=0x38f92ed0, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) [ 802.415082] binder: 5953:5972 transaction failed 29201/-22, size 120-24 line 3199 [ 802.428703] binder: undelivered TRANSACTION_ERROR: 29201 22:58:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$BLKRESETZONE(r2, 0x40101283, &(0x7f0000000000)={0x3, 0x1}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:58:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) lsetxattr$smack_xattr_label(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64IPOUT\x00', &(0x7f0000000140)={'$$,('}, 0x5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0xfffffffffffffff0, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/6, 0x6}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 802.506726] binder: undelivered TRANSACTION_COMPLETE [ 802.510052] binder: 5989:5993 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 802.510111] binder: 5989:5993 transaction failed 29201/-22, size 120-24 line 3199 [ 802.511290] binder: BINDER_SET_CONTEXT_MGR already set [ 802.511298] binder: 5977:5994 ioctl 40046207 0 returned -16 [ 802.511700] binder_alloc: 5977: binder_alloc_buf, no vma [ 802.511738] binder: 5977:5994 transaction failed 29189/-3, size 0-0 line 3137 22:58:16 executing program 1: clone(0x2000000024000300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sync() r0 = memfd_create(&(0x7f0000000040)='/dev/auts\x00', 0x0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x2000005, 0x11, r0, 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0xfffffffffffffffd, {0x4000001}, 0x0, 0x0}, 0x0, 0x8, &(0x7f0000000000)) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip_vs\x00') creat(0x0, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x0) syz_open_procfs(0x0, &(0x7f0000000700)='ac\xbaeate\x00>\x95\xf4AJ\xe8\xef\xcb\xebc\"\xa3&K\r\xf8\x10\x81Y\xbe-\x92\x931\xcb{\xf9\x9f\xa3Ro9r\x99s\x95N\xe6\xa6\xcf1\x8a\x8cT\x97:3\x8c(a\xb5\x8f\xed\x13T@\x17\x1b6\xda\xa8\xa2\x9c \xc8\x1cvE\xb1T\xd2\x9a]\x9c\x9d\x13\a\xa2\x9a\xb0K\xd2d\x1eg\x8e\xc6\xc0\x94\x0e\xb0l\x95*\x82\xbfHb\x1c\x83\xc3\x85`\xdc\x9a\xffS\xcf8\x92r\xcb\\\x06kG\\\xd1\xab\xd8\xeb\x8f\x92\x93\xac\xb1\x98\xc7\xd5:K.\xd50c\xbf\x04\x00M\xc2\x8f\x15%#SW5\x8b\xd3vF\xd8w\xf5\x02\r\xb5\xedLc\x89\x97\x1a\xa9\x05\xb1<\xf8\x95wUd\xd9\x1a\x00\xcd\x92\xa1\xac\x15tTZl.\xcc\xb8!l\v\xb6\xe5;\xd1\x9a\xd6\x8a\x7f\'\x9c\xb5$\xc1T\xa1\xec\xec\x15{\xc5\xc0H\xd7\x03\xbd\x93\xad\x15\xb3<\b,\x12\xfb\x81\x06t\xab\xab\x85\xdc\xf7\x15>.c\xf2\x7f\x02\xbc\x1e0\x7fX\xc1F|h\xaf\xde\x11\xac^\"\xc6\xf3^n?*<\x1b\xcb\nxS4-\x94\x9eF#\x18=\x15\x9d\xbfl\x1d\xfe\x99\xeb\x8c&!\xc9\x95z\xa1\xf3\x1e\x80&{') r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r2, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r2, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x276, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f0000000280)=""/35, 0x23}, 0x100) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) fcntl$setownex(r2, 0xf, &(0x7f0000000140)={0x1, r3}) 22:58:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/udp6\x00') r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/policy\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000007f) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000200)) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000078000000000000001800"/52, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="00000000001aa6918425ae6fae0040008a00000000ef3000d6c4009714b01c5fb192929c64b515c1d4f300000000f37e3eefe4f95a5e2ce6d2bb928e76b7031032aeee0e84c119c6f4124df2bc80df95343cdb0c00a5486f73cfe336d97f2a75433aa2cbec371eefb798b5b8d89c6e85062cb99488c4353f4b9268cb80680ea3d72464b135caf17e703fe3c5f7920f416ab4b08a2ad657916a4513d3148e1525e7c9a8c4cbb14b846ae366b2bc98070c4277c2180a3708f9b41c27bba9ae57dcbb50037456fb52566d0b5929e59dbf44acd096bde505087a27dc1698e90a8c4966cc5a38352841cd"]], 0x0, 0x0, 0x0}) ioctl$RTC_IRQP_READ(0xffffffffffffffff, 0x8008700b, &(0x7f0000000000)) [ 802.512549] binder: BINDER_SET_CONTEXT_MGR already set [ 802.512557] binder: 5989:5995 ioctl 40046207 0 returned -16 [ 802.513145] binder_alloc: 5989: binder_alloc_buf, no vma [ 802.513184] binder: 5989:5995 transaction failed 29189/-3, size 120-24 line 3137 [ 802.555578] binder: BINDER_SET_CONTEXT_MGR already set [ 802.555586] binder: 5997:5998 ioctl 40046207 0 returned -16 [ 802.556381] binder_alloc: 5989: binder_alloc_buf, no vma [ 802.556420] binder: 5997:5998 transaction failed 29189/-3, size 120--16 line 3137 [ 802.562606] binder: BINDER_SET_CONTEXT_MGR already set [ 802.562615] binder: 5997:5998 ioctl 40046207 0 returned -16 [ 802.647529] binder: BINDER_SET_CONTEXT_MGR already set [ 802.663435] binder: 6009:6012 ioctl 40046207 0 returned -16 [ 802.674805] binder_alloc: 5989: binder_alloc_buf, no vma [ 802.677357] binder: undelivered TRANSACTION_ERROR: 29189 [ 802.677496] binder: undelivered TRANSACTION_ERROR: 29189 [ 802.677757] binder: undelivered TRANSACTION_ERROR: 29189 [ 802.677890] binder: undelivered TRANSACTION_ERROR: 29201 [ 802.678087] binder: undelivered transaction 3563, process died. [ 802.715861] binder: 6009:6012 transaction failed 29189/-3, size 0-0 line 3137 [ 802.735931] binder: undelivered TRANSACTION_ERROR: 29189 22:58:16 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) connect(0xffffffffffffffff, &(0x7f00000000c0)=@tipc=@nameseq={0x1e, 0x1, 0x0, {0x0, 0x4, 0x4}}, 0x80) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000700)='/7\x02\xe8\xa4\xef\x9e\xc8e\xd5n\x89\xeb[<\x18-\x14\x8d8\xbf\xfe\x83\x19\xf3(\xd7y\x14h\xcf(f\x06I:\xa4\xea\xcb\b\x81C\xdd\xcc\x00\x00\x00\x00\xf9\b1h\xbam\xa4x\xb1:\xcf\a\x94Z\x7f\xc8\vy\xf2F\xf4\x9d\n3\xd4\x9a[\xee\xaa\t\xbe\x90\xabU3\xd3[y\xd1d^We\xa9\xcb\x86a\"\xba\xb7\xcd\xcf\x88\x9eqO|\x9f\xcf\r\x86\xf4\x15@\x82w\xa8\\\x8c^a\xbe\x991l\\\x16\xd4\xd53\xdd\x9e\x00\x01:\xac\x14^\xf6\xb6\xb1^\xaa\xfa\x02x\x8aV\x87\xe3\xfb\xef\xd0\xb7({,\xf4\xa2cl`\xdc\xf7\xe2f\xad\xaa>\xd4Ts\x10\xb9V!\x91uGTy\xde$X\xff\xb1\xf3={\xb7\xe65\xb6\x1a\x99q^\xc2\xfc\xb0\xc09\x85\x03\xf1]\xc54;\x8d\x01\xec3#\x8f%5\xef\xfe\xc5\xdb\xd5\xb7\xe0\xdd\xec,rV\x82!\xa0', 0x0) pwritev(r3, &(0x7f0000000380)=[{&(0x7f0000000680)='d', 0x1}], 0x1, 0x4081806) sendfile(r1, r3, 0x0, 0x20020102000007) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0xfffffef3) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000200), 0x4) clone(0x2502001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$FUSE_DIRENT(r5, &(0x7f00000003c0)=ANY=[@ANYBLOB="9427aff21d3b29ff427f2564000000"], 0xf) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_genetlink_get_family_id$tipc2(0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) nanosleep(&(0x7f0000000280)={r6, r7+30000000}, &(0x7f00000002c0)) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/policy\x00', 0x0, 0x0) recvfrom$unix(r2, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930212) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$setperm(0x5, r9, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r9}, &(0x7f0000000540)=ANY=[@ANYBLOB="656e633d6f61657020686173683d7368613531322d6176783200000000000000000000000000000000000000000000000000000000000000000000000000000000b872e56dea726300"/85], 0x0, 0x0) r10 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$setperm(0x5, r10, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r10}, &(0x7f0000000800)=ANY=[@ANYBLOB="656e633d6f61657020686173683d7368613531322d6176783200000000000000001000000000000000000000000000000000000000000000000000000000000000b872e56dea726300000000000000000000ec6879834e952845811b12037f8c8947eed21287d3c14d9bee68615e3b47384ef191a57946ae729fb895160e8a70c2132c1abbd5ef"], 0x0, 0x0) r11 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$setperm(0x5, r11, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r11}, &(0x7f0000000540)=ANY=[@ANYBLOB="656e633d6f61657020686173683d7368613531322d6176783200000000000000000000000000000000000000000000000000000000000000000000000000000000b872e56dea726300"/85], 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000300)={r9, r10, r11}, &(0x7f0000000400)=""/201, 0xc9, &(0x7f00000005c0)={&(0x7f0000000340)={'crc32\x00'}, &(0x7f0000000500)="28828bcae16b0a3501bf8a5c61742fca0316ffc42d1c47a271e0c5e2ebd0f1f273547f21b7a52c9b8b8e7e20dc522ab6de27b930aef214d78152f26b9b42b4888ffcfa6d54523fefa6433bc9c86dd42a69987f5782f92f1106", 0x59}) write(r8, &(0x7f00000001c0), 0xfffffef3) ioctl$VT_RESIZE(r8, 0x5609, &(0x7f00000001c0)={0x3f, 0x7, 0x5}) ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) 22:58:16 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r1) add_key$keyring(0x0, 0x0, 0x0, 0x0, r1) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r1) keyctl$revoke(0x3, r1) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r4) add_key$keyring(0x0, 0x0, 0x0, 0x0, r4) r5 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r5) add_key$keyring(0x0, 0x0, 0x0, 0x0, r5) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r5) keyctl$instantiate(0xc, r4, &(0x7f0000000000)=@encrypted_new={'new ', 'ecryptfs', 0x20, 'trusted:', '', 0x20, 0x7ff}, 0x2b, r5) r6 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:16 executing program 2: openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x0, 0x0) socket(0x1, 0x3, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c476828c7e4f1cd80"], 0x9}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) creat(&(0x7f0000000080)='./bus\x00', 0x0) tkill(r0, 0x3b) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) syz_open_dev$mice(&(0x7f0000000300)='\x00\x00\x00\x00\x05\x00\a\x00', 0x0, 0x400) syz_open_dev$mice(0x0, 0x0, 0x0) creat(&(0x7f0000000180)='./bus\x00', 0x4) creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) creat(&(0x7f00000001c0)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$packet(0x11, 0x3, 0x300) r5 = fcntl$dupfd(r3, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, r0, 0x3, &(0x7f0000000240)="a199f7e2f222243683d3db7d63024ff41196000049e42b47dbebf5e34e529bcf057eaeedc746e6a2272f5c53967b614ae8faed30345fd1c496163fa10c242fcc55a301886264ccaf1a9403ac7862db6e66") ptrace$cont(0x7, r0, 0x0, 0x0) 22:58:16 executing program 1: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x208000, 0x0) ioctl$TUNSETNOCSUM(r0, 0x400454c8, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r1) r2 = open(&(0x7f0000000000)='./bus\x00', 0x40000141042, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0x323) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r4 = dup2(r3, r3) pipe(&(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) clone(0xa6185f00, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 22:58:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$EVIOCSABS2F(r2, 0x401845ef, &(0x7f0000000300)={0x7fffffff, 0x5, 0xffffffff, 0x1, 0x7, 0x6}) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000280)=0x401) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000857f00000000000000000000000000efff000000000000000041e1a8d920c900ffe58fad008ba8c60000000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8011a000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x24, r5, 0x100, 0x70bd25, 0x25dfdbfb, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x2}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x40005) [ 803.012162] binder: undelivered TRANSACTION_ERROR: 29201 22:58:17 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@loopback, @in6=@rand_addr="7e03dd700ef70d50939cf100174a8df3", 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x0, @in6=@dev, 0x0, 0x0, 0x0, 0x5}}, 0xe8) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r1, 0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_buf(r1, 0x1, 0x3d, &(0x7f0000000000)=""/122, &(0x7f0000000080)=0x7a) lsetxattr$security_evm(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.evm\x00', &(0x7f0000000140)=@sha1={0x1, "cd6672d91808168d7f1bf909742564b93e0e7e0f"}, 0x15, 0x3) [ 803.062552] binder_alloc: 6043: binder_alloc_buf size 4840 failed, no address space [ 803.085813] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 803.096763] binder: 6043:6047 transaction failed 29201/-28, size 4096-739 line 3137 [ 803.110359] binder: undelivered TRANSACTION_ERROR: 29201 22:58:17 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f0000000080)={'icmp\x00'}, &(0x7f0000000100)=0x1e) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) readlinkat(r2, &(0x7f0000000140)='./bus\x00', &(0x7f0000000180)=""/9, 0x9) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000010000000000000e3020000000000000000000000000000000000000000000000000000000000004e40866e523dacc446cefbccef1b0fa3a796df4956c1baa63078959553"], 0x0, 0x0, 0x0}) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FIGETBSZ(r5, 0x2, &(0x7f0000000240)) 22:58:17 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket(0x1, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r3, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r5}, 0x80, 0x0}}], 0x300, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r6, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r6, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r6, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$inet_IP_IPSEC_POLICY(r6, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) r8 = socket$packet(0x11, 0x2, 0x300) r9 = socket(0x1, 0x2, 0x0) getsockname$packet(r9, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r8, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r10}, 0x80, 0x0}}], 0x300, 0x0) r11 = socket$packet(0x11, 0x2, 0x300) r12 = socket(0x1, 0x2, 0x0) getsockname$packet(r12, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r11, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r13}, 0x80, 0x0}}], 0x300, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x18, &(0x7f0000000400)={@dev, 0x0}, &(0x7f0000000440)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@mcast1, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}}}, &(0x7f00000006c0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000780)={{{@in=@broadcast, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@local}}, &(0x7f0000000880)=0xe8) getsockname(0xffffffffffffffff, &(0x7f0000000a80)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000b00)=0x80) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000b40)={{{@in6=@remote, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@remote}}, &(0x7f0000000c40)=0xe8) r19 = socket$packet(0x11, 0x2, 0x300) r20 = socket(0x1, 0x2, 0x0) getsockname$packet(r20, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r19, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r21}, 0x80, 0x0}}], 0x300, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r22, 0x0, 0x0) getsockopt$sock_cred(r22, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r22, 0x8933, &(0x7f0000000c80)={'team0\x00', 0x0}) r24 = socket$packet(0x11, 0x2, 0x300) r25 = socket(0x1, 0x2, 0x0) getsockname$packet(r25, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r24, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r26}, 0x80, 0x0}}], 0x300, 0x0) r27 = socket$packet(0x11, 0x2, 0x300) r28 = socket(0x1, 0x2, 0x0) getsockname$packet(r28, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r27, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r29}, 0x80, 0x0}}], 0x300, 0x0) r30 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r30, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) getsockopt$inet6_mreq(r30, 0x29, 0x1b, &(0x7f0000000d80)={@mcast1, 0x0}, &(0x7f0000000dc0)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000e00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000e40)=0x14) recvmmsg(r1, &(0x7f0000004dc0)=[{{&(0x7f0000000ec0)=@tipc, 0x80, &(0x7f0000003440)=[{&(0x7f0000000f40)=""/228, 0xe4}, {&(0x7f0000001040)=""/4096, 0x1000}, {&(0x7f0000002040)=""/246, 0xf6}, {&(0x7f0000002140)=""/4096, 0x1000}, {&(0x7f0000003140)=""/143, 0x8f}, {&(0x7f0000003200)=""/131, 0x83}, {&(0x7f00000032c0)=""/146, 0x92}, {&(0x7f0000003380)=""/159, 0x9f}], 0x8, &(0x7f00000034c0)=""/113, 0x71}, 0x5}, {{&(0x7f0000003540)=@isdn, 0x80, &(0x7f00000035c0), 0x0, &(0x7f0000003600)=""/207, 0xcf}}, {{0x0, 0x0, &(0x7f00000049c0)=[{&(0x7f0000003700)=""/200, 0xc8}, {&(0x7f0000003800)=""/4096, 0x1000}, {&(0x7f0000004800)=""/1, 0x1}, {&(0x7f0000004840)=""/176, 0xb0}, {&(0x7f0000004900)}, {&(0x7f0000004940)=""/82, 0x52}], 0x6, &(0x7f0000004a40)=""/55, 0x37}}, {{&(0x7f0000004a80)=@can={0x1d, 0x0}, 0x80, &(0x7f0000004d00)=[{&(0x7f0000004b00)=""/175, 0xaf}, {&(0x7f0000004bc0)=""/212, 0xd4}, {&(0x7f0000004cc0)=""/21, 0x15}], 0x3, &(0x7f0000004d40)=""/128, 0x80}, 0x8}], 0x4, 0x2000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000004ec0)={{{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000004fc0)=0xe8) accept$packet(r1, &(0x7f0000005000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000005040)=0x14) r36 = socket$packet(0x11, 0x2, 0x300) r37 = socket(0x1, 0x2, 0x0) getsockname$packet(r37, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r36, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r38}, 0x80, 0x0}}], 0x300, 0x0) r39 = socket$packet(0x11, 0x2, 0x300) r40 = socket(0x1, 0x2, 0x0) getsockname$packet(r40, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r39, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r41}, 0x80, 0x0}}], 0x300, 0x0) r42 = socket$packet(0x11, 0x2, 0x300) r43 = socket(0x1, 0x2, 0x0) getsockname$packet(r43, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r42, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r44}, 0x80, 0x0}}], 0x300, 0x0) r45 = socket$packet(0x11, 0x2, 0x300) r46 = socket(0x1, 0x2, 0x0) getsockname$packet(r46, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r45, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r47}, 0x80, 0x0}}], 0x300, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000005140)={0x0, @in={0x2, 0x4e21, @loopback}, @xdp={0x2c, 0x8, r47, 0x39}, @ipx={0x4, 0x6, 0xe23, "be6b68e6b613", 0x1}, 0xff, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3, 0x5}) sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000005e40)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000005e00)={&(0x7f00000051c0)={0xc0c, 0x0, 0x400, 0x70bd25, 0x25dfdbfc, {}, [{{0x8, 0x1, r5}, {0x130, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xb83}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xfff}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r7}, {0x254, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x200}}, {0x8}}}]}}, {{0x8, 0x1, r13}, {0x134, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r14}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x20}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r15}}}]}}, {{0x8, 0x1, r16}, {0x40, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}]}}, {{0x8, 0x1, r18}, {0x13c, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8}}, {0x8}}}]}}, {{0x8, 0x1, r23}, {0x1dc, 0x2, [{0x34, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x4}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r26}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r29}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r31}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x7, 0x8}}}]}}, {{0x8, 0x1, r32}, {0x84, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r33}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8}}}]}}, {{0x8}, {0x1f0, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfffff95b}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r34}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r35}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x4c000}}, {0x8, 0x6, r38}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x401}}, {0x8}}}]}}, {{0x8, 0x1, r41}, {0x12c, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r44}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r48}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x6af}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xff}}}]}}]}, 0xc0c}, 0x1, 0x0, 0x0, 0x4000}, 0x10044000) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) r49 = creat(&(0x7f0000000100)='./file1\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r50 = add_key$user(&(0x7f00000003c0)='user\x00', 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$join(0x1, 0x0) keyctl$setperm(0x5, 0x0, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r50, 0x390}, &(0x7f00000001c0)=ANY=[@ANYBLOB="98be3463750d", @ANYRESHEX=0x0, @ANYPTR=&(0x7f0000000140)=ANY=[]], 0x0, 0x0) ioctl$TUNSETCARRIER(r49, 0x400454e2, &(0x7f0000000080)=0x1) gettid() pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r52, &(0x7f00000001c0), 0xfffffef3) read(r51, &(0x7f0000000200)=""/250, 0x50c7e3e3) r53 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r53, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0xc0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KDDISABIO(r52, 0x4b37) r54 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r54) ioctl$TIOCSIG(r49, 0x40045436, 0x6) r55 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r55, 0x8200) r56 = open(&(0x7f0000000040)='./bus\x00', 0xc5ea57797c87b812, 0x0) ioctl$FS_IOC_RESVSP(r56, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x40000008}) fcntl$setstatus(r49, 0x4, 0x40000) ftruncate(0xffffffffffffffff, 0x0) ftruncate(r55, 0x81ff) 22:58:17 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) ioctl$FS_IOC_GETVERSION(r3, 0x80087601, &(0x7f00000000c0)) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r1, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x5, 0x803, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) r6 = fcntl$dupfd(r1, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="02030000100000000000000000000000010014000000000005000600000002000a0000000000000000000000000000000000000000000001000000000000000001001500000000000200010000000000000000000000000005000500000000000a00010000000000fe8000000000000000000000000000ff0000000000000000"], 0x80}}, 0x0) 22:58:17 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getuid() pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000000)={0x401, 0xb372, 0x1, 0x9e, 0x80000001, 0x7}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140), 0x15d, 0x0, 0x0}) 22:58:17 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) rt_sigpending(&(0x7f0000000040), 0x8) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)=ANY=[@ANYBLOB="000000000000000051ffffffffffffff00000000f6000000d904000000000000"]) ioctl$LOOP_SET_DIRECT_IO(r4, 0x4c08, 0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r3, 0xc018620c, &(0x7f0000000000)) [ 803.434352] binder_alloc: 6062: binder_alloc_buf size 4840 failed, no address space [ 803.444182] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 803.454269] binder: 6062:6065 transaction failed 29201/-28, size 4096-739 line 3137 [ 803.464012] binder: undelivered TRANSACTION_ERROR: 29201 22:58:17 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x800) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 803.504092] binder_alloc: 6074: binder_alloc_buf size 4840 failed, no address space [ 803.513213] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 803.522256] binder: 6074:6075 transaction failed 29201/-28, size 4096-739 line 3137 [ 803.531180] binder: undelivered TRANSACTION_ERROR: 29201 [ 803.564321] binder_alloc: 6080: binder_alloc_buf size 4840 failed, no address space [ 803.572635] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 803.583132] binder: 6080:6081 transaction failed 29201/-28, size 4096-739 line 3137 [ 803.598451] binder: undelivered TRANSACTION_ERROR: 29201 22:58:17 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x200, 0x0) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f00000001c0)={0xffff, 0x4, 0x6, 0x0, 0x0, 0x2}) r1 = request_key(&(0x7f0000000000)='.dead\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='[trusted\x00', 0xfffffffffffffffb) keyctl$get_security(0x11, r1, &(0x7f00000000c0)=""/150, 0x96) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) delete_module(0x0, 0x0) 22:58:17 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) socket$inet6(0xa, 0x3, 0x6) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 803.698471] binder_alloc: 6087: binder_alloc_buf size 4840 failed, no address space [ 803.706927] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 803.716643] binder: 6087:6089 transaction failed 29201/-28, size 4096-739 line 3137 [ 803.726310] binder: undelivered TRANSACTION_ERROR: 29201 22:58:19 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = dup2(r0, r0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000280)={0x2000}) fcntl$setsig(r1, 0xa, 0x3a) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) write$P9_RREMOVE(r2, &(0x7f0000000200)={0x10}, 0xffffff9a) creat(&(0x7f0000000040)='./file0\x00', 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x0) bind$inet6(r3, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r3, 0x80) fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) shutdown(r2, 0x2) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, 0x0, 0xfffffffffffffdc6, 0x20000004, &(0x7f0000000280)={0xa, 0x4e22}, 0x1c) write(r4, &(0x7f0000000380), 0xfffffffe) openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x400000, 0x0) recvfrom$inet6(r4, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880), 0x1c) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000000)={'lo\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000140)={'lo\x00\x00\x00$\x00\x00\x00\x00\x00\x00\b\x00\x00\x11', 0xff}) r6 = accept4(r3, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) r8 = syz_genetlink_get_family_id$fou(&(0x7f0000000180)='fou\x00') r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r9, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xe6) socket(0x1, 0x2, 0x0) sendmsg$FOU_CMD_DEL(r7, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r8, @ANYBLOB="00012abd7000ffdbdf2502000000080001004e23000014000700fe8000000000000000000000000000bb0400050008000a004e22000014000900fe80000000000000000000000000001008000b00", @ANYRES32=0x0, @ANYBLOB="0200050008000800ac1e0101000001004e2300001400070066e329c7949daacfcde122c7862fe9b0"], 0xffffffffffffff75}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) sendto$inet6(r6, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) 22:58:19 executing program 4: r0 = dup(0xffffffffffffffff) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000000)) fallocate(r0, 0x8, 0x4, 0x4) r1 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$clear(0x7, r1) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x80) renameat2(r2, &(0x7f0000000100)='./file0\x00', r3, &(0x7f0000000180)='./file0\x00', 0x6) r4 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) fsetxattr$security_evm(r4, &(0x7f00000001c0)='security.evm\x00', &(0x7f0000000200)=@v2={0xf, 0x0, 0xb, 0x1, 0xc5, "35a6cc5912baee67576e1540c2b103e97f40d79de443c737d7caf30a6d81824716563bdd80400cf4cd73af380db605cf7ef425d211f71f51ea3ec87b724d75019f96e11bdaf9d7716dd0d84698497ed9c108dc1448b587e8610671d328e293b042827754326848bd0113f0f51ee19c0682ef0f228583d249580b0147170c727725d7f21eab190a9067811f2219a0de1cda7f6d23923fce4ba085e6528cf6996b7be4413392beff6a34adcbf2ed3349187c600261701a29c9334ad78d4d64b34959d5a128ee"}, 0xcf, 0x2) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/pfkey\x00', 0x40, 0x0) write$P9_RFLUSH(r5, &(0x7f0000000340)={0x7, 0x6d, 0x1}, 0x7) r6 = dup(0xffffffffffffffff) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r6, 0x8983, &(0x7f0000000380)={0x7, 'hsr0\x00', {0x5}, 0x7}) r7 = fcntl$dupfd(0xffffffffffffffff, 0x0, r2) ioctl$UI_GET_VERSION(r7, 0x8004552d, &(0x7f0000000400)) ioctl$KDFONTOP_COPY(r0, 0x4b72, &(0x7f0000000840)={0x3, 0x0, 0x8, 0x3, 0x5e, &(0x7f0000000440)}) r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000880)='/selinux/enforce\x00', 0x8000, 0x0) ioctl$EVIOCGKEY(r8, 0x80404518, &(0x7f00000008c0)=""/176) r9 = syz_open_dev$evdev(&(0x7f0000000980)='/dev/input/event#\x00', 0x295, 0x2) write$binfmt_script(r9, &(0x7f00000009c0)={'#! ', './file1', [{0x20, '['}, {0x20, ']'}, {}, {0x20, 'syz'}, {0x20, '/selinux/avc/hash_stats\x00'}, {0x20, '/selinux/avc/hash_stats\x00'}, {0x20, 'security.evm\x00'}], 0xa, "2a666ca1697a0090ae4c72aeed296c114d1ef17314b76824fd4f266aa17dbc59bf0c38c6aae8adf7b1faccce5202373775b7859541f5fde50650b946ff1e53161dcb4a6751773115c0871285cd26ef2b5cd80b673339f069194551f79159185c2109d0a56bb024ac5690a5380cf097d9a0dee52541684648917af565bc9690074d80ea7adb2312b1bf0a49f160da63cefc9f2ccd170f158f7452cd3629de460475013152df1b0ccac89bf38eab189755c91b34859c3c63470a22d05acf88d582305f461d0397fd2ec77a86c7"}, 0x120) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000b00)=@req={0xf8, 0x30ab, 0x10000, 0x8}, 0x10) timer_create(0x0, &(0x7f0000000b40)={0x0, 0x33, 0x3, @tid=0xffffffffffffffff}, &(0x7f0000000b80)=0x0) timer_gettime(r10, &(0x7f0000000bc0)) rmdir(&(0x7f0000000c00)='./file2\x00') ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000c40)) prctl$PR_SVE_SET_VL(0x32, 0x3b3c0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000cc0)='/dev/ptmx\x00', 0x60001, 0x0) getrusage(0x0, &(0x7f0000000d00)) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000dc0)={0xf2, 0x8, 0x6, 0x401, 0x10, 0x1e, 0xc7, 0x4, 0x7fffffff, 0x5}) 22:58:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast2}, &(0x7f0000000040)=0x10, 0xc00) r3 = socket$netlink(0x10, 0x3, 0x9) r4 = fcntl$dupfd(r2, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0) getpeername$inet(r1, &(0x7f0000000200)={0x2, 0x0, @multicast2}, &(0x7f0000000240)=0x10) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0xe1, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_RX_RING(r3, 0x10e, 0x6, &(0x7f0000000140)={0x7, 0x65, 0x0, 0x2222}, 0x10) ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000040)=0x101) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, &(0x7f0000000000)='yam0\x00') 22:58:19 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x4000000000802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffe], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffd5]}, 0x45c) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet6_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000040)=@gcm_128={{0x303}, "d3c3e44369c7a2c5", "917a04f946865d85f5bc8a9f0e3402d0", "49a85088", "40e2b9395993c8cc"}, 0x28) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r3, 0xc0096616, &(0x7f00000000c0)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) r4 = open(&(0x7f0000000140)='./file0\x00', 0x2, 0x20) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000180)={{0x25, 0x8, 0x325}, 'syz0\x00', 0x29}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x0, [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x45c) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$TIOCNOTTY(r5, 0x5422) 22:58:19 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket(0x1, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r3, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r5}, 0x80, 0x0}}], 0x300, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r6, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r6, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r6, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$inet_IP_IPSEC_POLICY(r6, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) r8 = socket$packet(0x11, 0x2, 0x300) r9 = socket(0x1, 0x2, 0x0) getsockname$packet(r9, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r8, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r10}, 0x80, 0x0}}], 0x300, 0x0) r11 = socket$packet(0x11, 0x2, 0x300) r12 = socket(0x1, 0x2, 0x0) getsockname$packet(r12, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r11, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r13}, 0x80, 0x0}}], 0x300, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x18, &(0x7f0000000400)={@dev, 0x0}, &(0x7f0000000440)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@mcast1, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}}}, &(0x7f00000006c0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000780)={{{@in=@broadcast, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@local}}, &(0x7f0000000880)=0xe8) getsockname(0xffffffffffffffff, &(0x7f0000000a80)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000b00)=0x80) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000b40)={{{@in6=@remote, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@remote}}, &(0x7f0000000c40)=0xe8) r19 = socket$packet(0x11, 0x2, 0x300) r20 = socket(0x1, 0x2, 0x0) getsockname$packet(r20, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r19, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r21}, 0x80, 0x0}}], 0x300, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r22, 0x0, 0x0) getsockopt$sock_cred(r22, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r22, 0x8933, &(0x7f0000000c80)={'team0\x00', 0x0}) r24 = socket$packet(0x11, 0x2, 0x300) r25 = socket(0x1, 0x2, 0x0) getsockname$packet(r25, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r24, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r26}, 0x80, 0x0}}], 0x300, 0x0) r27 = socket$packet(0x11, 0x2, 0x300) r28 = socket(0x1, 0x2, 0x0) getsockname$packet(r28, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r27, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r29}, 0x80, 0x0}}], 0x300, 0x0) r30 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r30, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) getsockopt$inet6_mreq(r30, 0x29, 0x1b, &(0x7f0000000d80)={@mcast1, 0x0}, &(0x7f0000000dc0)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000e00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000e40)=0x14) recvmmsg(r1, &(0x7f0000004dc0)=[{{&(0x7f0000000ec0)=@tipc, 0x80, &(0x7f0000003440)=[{&(0x7f0000000f40)=""/228, 0xe4}, {&(0x7f0000001040)=""/4096, 0x1000}, {&(0x7f0000002040)=""/246, 0xf6}, {&(0x7f0000002140)=""/4096, 0x1000}, {&(0x7f0000003140)=""/143, 0x8f}, {&(0x7f0000003200)=""/131, 0x83}, {&(0x7f00000032c0)=""/146, 0x92}, {&(0x7f0000003380)=""/159, 0x9f}], 0x8, &(0x7f00000034c0)=""/113, 0x71}, 0x5}, {{&(0x7f0000003540)=@isdn, 0x80, &(0x7f00000035c0), 0x0, &(0x7f0000003600)=""/207, 0xcf}}, {{0x0, 0x0, &(0x7f00000049c0)=[{&(0x7f0000003700)=""/200, 0xc8}, {&(0x7f0000003800)=""/4096, 0x1000}, {&(0x7f0000004800)=""/1, 0x1}, {&(0x7f0000004840)=""/176, 0xb0}, {&(0x7f0000004900)}, {&(0x7f0000004940)=""/82, 0x52}], 0x6, &(0x7f0000004a40)=""/55, 0x37}}, {{&(0x7f0000004a80)=@can={0x1d, 0x0}, 0x80, &(0x7f0000004d00)=[{&(0x7f0000004b00)=""/175, 0xaf}, {&(0x7f0000004bc0)=""/212, 0xd4}, {&(0x7f0000004cc0)=""/21, 0x15}], 0x3, &(0x7f0000004d40)=""/128, 0x80}, 0x8}], 0x4, 0x2000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000004ec0)={{{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000004fc0)=0xe8) accept$packet(r1, &(0x7f0000005000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000005040)=0x14) r36 = socket$packet(0x11, 0x2, 0x300) r37 = socket(0x1, 0x2, 0x0) getsockname$packet(r37, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r36, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r38}, 0x80, 0x0}}], 0x300, 0x0) r39 = socket$packet(0x11, 0x2, 0x300) r40 = socket(0x1, 0x2, 0x0) getsockname$packet(r40, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r39, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r41}, 0x80, 0x0}}], 0x300, 0x0) r42 = socket$packet(0x11, 0x2, 0x300) r43 = socket(0x1, 0x2, 0x0) getsockname$packet(r43, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r42, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r44}, 0x80, 0x0}}], 0x300, 0x0) r45 = socket$packet(0x11, 0x2, 0x300) r46 = socket(0x1, 0x2, 0x0) getsockname$packet(r46, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r45, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r47}, 0x80, 0x0}}], 0x300, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000005140)={0x0, @in={0x2, 0x4e21, @loopback}, @xdp={0x2c, 0x8, r47, 0x39}, @ipx={0x4, 0x6, 0xe23, "be6b68e6b613", 0x1}, 0xff, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3, 0x5}) sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000005e40)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000005e00)={&(0x7f00000051c0)={0xc0c, 0x0, 0x400, 0x70bd25, 0x25dfdbfc, {}, [{{0x8, 0x1, r5}, {0x130, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xb83}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xfff}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r7}, {0x254, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x200}}, {0x8}}}]}}, {{0x8, 0x1, r13}, {0x134, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r14}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x20}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r15}}}]}}, {{0x8, 0x1, r16}, {0x40, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}]}}, {{0x8, 0x1, r18}, {0x13c, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8}}, {0x8}}}]}}, {{0x8, 0x1, r23}, {0x1dc, 0x2, [{0x34, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x4}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r26}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r29}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r31}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x7, 0x8}}}]}}, {{0x8, 0x1, r32}, {0x84, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r33}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8}}}]}}, {{0x8}, {0x1f0, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfffff95b}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r34}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r35}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x4c000}}, {0x8, 0x6, r38}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x401}}, {0x8}}}]}}, {{0x8, 0x1, r41}, {0x12c, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r44}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r48}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x6af}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xff}}}]}}]}, 0xc0c}, 0x1, 0x0, 0x0, 0x4000}, 0x10044000) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) r49 = creat(&(0x7f0000000100)='./file1\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r50 = add_key$user(&(0x7f00000003c0)='user\x00', 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$join(0x1, 0x0) keyctl$setperm(0x5, 0x0, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r50, 0x390}, &(0x7f00000001c0)=ANY=[@ANYBLOB="98be3463750d", @ANYRESHEX=0x0, @ANYPTR=&(0x7f0000000140)=ANY=[]], 0x0, 0x0) ioctl$TUNSETCARRIER(r49, 0x400454e2, &(0x7f0000000080)=0x1) gettid() pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r52, &(0x7f00000001c0), 0xfffffef3) read(r51, &(0x7f0000000200)=""/250, 0x50c7e3e3) r53 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r53, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0xc0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KDDISABIO(r52, 0x4b37) r54 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r54) ioctl$TIOCSIG(r49, 0x40045436, 0x6) r55 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r55, 0x8200) r56 = open(&(0x7f0000000040)='./bus\x00', 0xc5ea57797c87b812, 0x0) ioctl$FS_IOC_RESVSP(r56, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x40000008}) fcntl$setstatus(r49, 0x4, 0x40000) ftruncate(0xffffffffffffffff, 0x0) ftruncate(r55, 0x81ff) [ 806.055897] binder: 6104:6110 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 806.073442] binder_alloc: 6108: binder_alloc_buf size 4840 failed, no address space [ 806.086677] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 806.089311] input: syz1 as /devices/virtual/input/input395 [ 806.103078] binder: 6104:6110 transaction failed 29201/-22, size 120-24 line 3199 [ 806.111922] binder: 6108:6112 transaction failed 29201/-28, size 4096-739 line 3137 [ 806.129372] binder: undelivered TRANSACTION_ERROR: 29201 [ 806.136568] binder: BINDER_SET_CONTEXT_MGR already set [ 806.143089] binder: 6104:6118 ioctl 40046207 0 returned -16 22:58:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = socket(0x11, 0x800000003, 0x8) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f00000014c0)="12cb96df", 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) bind(r5, &(0x7f0000000280)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$sock_inet_SIOCSIFNETMASK(r6, 0x891c, &(0x7f0000000040)={'lapb0\x00', {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000140)={{0x107, 0x0, 0x0, 0x112, 0x0, 0x0, 0x0, 0x0, 0x8}, "0529"}, 0x22) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x1000000e2) splice(r2, 0x0, r4, 0x0, 0x10005, 0x0) r8 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0}) [ 806.152467] binder: undelivered TRANSACTION_ERROR: 29201 [ 806.160301] binder: 6104:6118 transaction failed 29189/-22, size 120-24 line 3014 [ 806.186752] input: syz1 as /devices/virtual/input/input396 [ 806.195029] binder: undelivered TRANSACTION_ERROR: 29189 22:58:20 executing program 0: eventfd2(0x0, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/policy\x00', 0x0, 0x0) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000080)=""/7) ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f00000000c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000580)=0x6) write(r2, &(0x7f00000001c0), 0xfffffef3) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f00000002c0)={'filter\x00', 0x4}, 0x68) r3 = socket$inet6(0xa, 0x400000000001, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000640)={{{@in6=@local, @in=@empty}}, {{@in=@loopback}, 0x0, @in6=@local}}, &(0x7f0000000600)=0xfe16) ioctl$RTC_VL_READ(r2, 0x80047013, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000004180), 0x11f, 0x40000) setsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, 0x0, 0x0) r4 = dup(r3) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a40)=ANY=[@ANYBLOB="0210040007000000002000000000000008001200000000000000000006000000e7ffe8000000000000000000000000000000000000000000cd006ef795a63b19298b6e28198740e6fe7a33ab3c119d5059d8bf7de10b38ab04ceee0f528a22e0ead8edf3fa7a0926e9dc47b62d379d04cadc8f7ce4acc476e53dd7f4395d3a2db614b959e93fdc27afdeb76141e95296ca7211c6d9133273474fbc379d8340b2cd2057c273d4b235c885f0015c7faf3dfb14ee1591e377523afcb638deeddfa90d690592e742ba381e08148e991636866c6e16e4677e205200000000000000000a6ca5cfb983688989f18cb5360df5c6021cf3bc6ea569246bd9f754ff1e381dcf8c84b0b4f3fa1b95348753e629a6dd4d455cc366feb3b91e2f9ce3661c1f142ca0293cec14e7b9ecaef6c4f6e89d698f31533df308f179969c27ff1b5f704a2019349fae8ae89048100fa2113e459407d5912f00000000000000000000000000000076700d538c6c6d0809e2851722095388c8bf829e6125c6b28d73abff4c608abde625ffffff7f1baa1ef8da4db0063b3f39dc8defe21cdaf8be038f77f8a7111152f78e1d7593abc2e46f8d3fe805ac5b752c9aed653549851c126db97ec5b4e62f20ecf4db9a6e616c6efed1192d062bcd8806e93dba1ec2f7721a08b14f5f17109d8f0e5a3af2c57260e15554e0f93bf828262d051dfae08600070f0b78a3939ec44bd7b4285ecd7041981ea90c207ac05ef93dec0dbd99611794bc26812b831eb28e7b69bc67573b32ccf52b6776887669bd4420ec107ef56631d7c965bcaeaff28f86771fd6211e99f3adfbb58b9872f9f07913c3a34dc681c51bf88fce2bd5f78b0f78978610d08f3c1acde9f960847a27d39c582407e93e636d0976ee904184ba39b850924fded5b374b362bc047d25ab068703a4e8fe1807aaea4e4a4ccbc4bad65d5f91e6c398d88ff17dc67c7ff6bd6d776b7adec35fcd4fa6ddff57869d32f92e97f47da9c89e8cecd0ee00005027dff9b5ae35df81f632969f40309077a3eb2ab2c520df2f3845e3323342839e4f22d03bfa5f8afbfd2795335403592c61e13f7fb17bf67292d18013807d9db7993aa2691baf2a2f4effdcf093380fdfec203b10f3bbd267035dad4e92ba831ccf87270ec5083b400f093601ec6f0cae8e25df93af448818ee381c9d2eb09c3d61355b35778edd9181c336e2085580f58e438fa8b1f05b7079007c1b8dd1d612f893f7798131941ce0fb30df20e56dfe84646a2b7b0cef154f6393eb7a020b40eea4462d094d9873a1e6a19f20194894d14e36a464fa5ebcb9f552bd484d917e244196c64a6b30f74ed8d37bc6fa54e4a0135b987c3d30ea06fc8858d1dce594c9bde06360d741ac4da14dc4a74df6f0ca502d9e4fba790d0a31de20562d8700305154e55cd05e4644d413d462cf327c3b22f765de97a6c24b1911fb2111309acabe64b0c42ee8aaa11a311a1c19ef5389cd00f353a17d23605ca20d33b10b53f2832d18c6e072d92fa3b2923595882bce541a7c0ff588517438eb04cfc75c056dec9481307b6220716bb76b48dd7ceca8f21cfae3b52cd60c5b451fc0c0f58d5f05b010eef5063e921d5039f3715322e1f84edc48113024985625e1c141c3a8e1dd75789b6583a81e7ac49ad4755d93741918aa0920811b0582b4e121efc89138b20a18ffe576b84ffd3dcfa99a653facf5223f74686ecb818ab95eb0fac0c9f576250be7587a4050eb6b6ff5c312fd6b974e066afd471ba12b8c491de42641d46f360108fe1d941f5eab1c61ae59500f286b6ed982fcdafda67d4cbe47b725275a1989f564d91180725bca7db01252909f272cefaab623651686f26e497bdea38ca3ac08be35b9c234abf2e3a60b1772ea9168256e6cf336129d520d60917ef89e14930b48fd3a644defdd357952025133a050633ca794aedff6e1e67fdb0383141f7613974c68b78a59597c083f6b9190f0468c59bbbebb2e7f88cf974d6fbf2abf0d"], 0x437}}, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000380)=0x83, 0x1fb) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) r8 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/context\x00', 0x2, 0x0) ioctl$FIBMAP(r8, 0x1, &(0x7f0000000180)=0x81) r9 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r9, r9, &(0x7f00000002c0)=0x202, 0xdd) 22:58:20 executing program 4: openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) pipe(&(0x7f0000000640)) memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) eventfd2(0x0, 0x0) pipe(&(0x7f0000000640)) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') eventfd2(0x80000002, 0x800) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0xbe38, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='fF/4\x00') r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) socket(0x11, 0x800000003, 0x0) dup(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)) socket$inet(0x10, 0x3, 0x0) socket$key(0xf, 0x3, 0x2) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) syz_open_procfs(0x0, &(0x7f0000000200)='mounts\x00') clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x0) r3 = syz_open_dev$mice(0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="f6808094f4c4b5ef03504a20eb67edd604b903b0c1332776f5a1edc4c5688ec1d15ce8cab1041b56b92c956c0b27dfacbfe8a46a3031640d60ffc38d7922476ed99aef23bea806e66f83aa45a603564fee71c41df782614d7c60e9f05a5e61bafaa5f912d07d24555500031636cd89d7902002db82db98f69cb067378f7feca13cd6e8bdb41baaa2bf18100b8579f79b72088cf19b04f2f5bc30b41cf0"], 0x4}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 22:58:20 executing program 0: socket$inet6_udplite(0xa, 0x2, 0x88) r0 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) r1 = creat(&(0x7f0000000100)='./file1\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = add_key$user(&(0x7f00000003c0)='user\x00', 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$join(0x1, 0x0) keyctl$setperm(0x5, 0x0, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r2, 0x390}, &(0x7f00000001c0)=ANY=[@ANYBLOB="98be3463750d", @ANYRESHEX=0x0, @ANYPTR=&(0x7f0000000140)=ANY=[]], 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f0000000080)=0x1) gettid() pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0xc0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KDDISABIO(r4, 0x4b37) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r6) r7 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r7, 0x8200) r8 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x40000008}) fcntl$setstatus(r1, 0x4, 0x40000) ftruncate(0xffffffffffffffff, 0x0) ftruncate(r7, 0x81ff) 22:58:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x101000) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000100)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010006081000418e00000904fcff", 0x58}], 0x1) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x11004000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r3, 0x0, 0x70bd25, 0x25dfdbff, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x1, 0xc330, @l2={'ib', 0x3a, 'nlmon0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8000) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r3, 0x300, 0x70bd2d, 0x25dfdbfe, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x4}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x58800}, 0x40080) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$TIOCSSOFTCAR(r4, 0x541a, &(0x7f00000003c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$ION_IOC_HEAP_QUERY(r5, 0xc0184908, &(0x7f00000004c0)={0x34, 0x0, &(0x7f0000000480)}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, 0x0, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) write$P9_RSETATTR(r6, &(0x7f0000000500)={0x7, 0x1b, 0x2}, 0x7) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000ffff34feffff00a8da00000000"]], 0x0, 0x0, 0x0}) lsetxattr$security_selinux(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:restorecond_exec_t:s0\x00', 0x28, 0x1) [ 806.698904] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket 22:58:20 executing program 0: socket$inet6_udplite(0xa, 0x2, 0x88) r0 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) r1 = creat(&(0x7f0000000100)='./file1\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = add_key$user(&(0x7f00000003c0)='user\x00', 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$join(0x1, 0x0) keyctl$setperm(0x5, 0x0, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r2, 0x390}, &(0x7f00000001c0)=ANY=[@ANYBLOB="98be3463750d", @ANYRESHEX=0x0, @ANYPTR=&(0x7f0000000140)=ANY=[]], 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f0000000080)=0x1) gettid() pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0xc0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KDDISABIO(r4, 0x4b37) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r6) r7 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r7, 0x8200) r8 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x40000008}) fcntl$setstatus(r1, 0x4, 0x40000) ftruncate(0xffffffffffffffff, 0x0) ftruncate(r7, 0x81ff) [ 806.768636] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket [ 806.787430] binder: 6156:6161 got transaction with invalid offset (-504675853926360, min 40 max 120) or object. [ 806.798155] binder: 6156:6161 transaction failed 29201/-22, size 120-24 line 3199 [ 806.832512] binder: undelivered TRANSACTION_ERROR: 29201 22:58:20 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = dup2(r0, r0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000280)={0x2000}) fcntl$setsig(r1, 0xa, 0x3a) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) write$P9_RREMOVE(r2, &(0x7f0000000200)={0x10}, 0xffffff9a) creat(&(0x7f0000000040)='./file0\x00', 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x0) bind$inet6(r3, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r3, 0x80) fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) shutdown(r2, 0x2) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, 0x0, 0xfffffffffffffdc6, 0x20000004, &(0x7f0000000280)={0xa, 0x4e22}, 0x1c) write(r4, &(0x7f0000000380), 0xfffffffe) openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x400000, 0x0) recvfrom$inet6(r4, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880), 0x1c) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000000)={'lo\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000140)={'lo\x00\x00\x00$\x00\x00\x00\x00\x00\x00\b\x00\x00\x11', 0xff}) r6 = accept4(r3, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) r8 = syz_genetlink_get_family_id$fou(&(0x7f0000000180)='fou\x00') r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r9, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xe6) socket(0x1, 0x2, 0x0) sendmsg$FOU_CMD_DEL(r7, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r8, @ANYBLOB="00012abd7000ffdbdf2502000000080001004e23000014000700fe8000000000000000000000000000bb0400050008000a004e22000014000900fe80000000000000000000000000001008000b00", @ANYRES32=0x0, @ANYBLOB="0200050008000800ac1e0101000001004e2300001400070066e329c7949daacfcde122c7862fe9b0"], 0xffffffffffffff75}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) sendto$inet6(r6, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) 22:58:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x4}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x15c, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:58:20 executing program 0: socket$inet6_udplite(0xa, 0x2, 0x88) r0 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) r1 = creat(&(0x7f0000000100)='./file1\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = add_key$user(&(0x7f00000003c0)='user\x00', 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$join(0x1, 0x0) keyctl$setperm(0x5, 0x0, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r2, 0x390}, &(0x7f00000001c0)=ANY=[@ANYBLOB="98be3463750d", @ANYRESHEX=0x0, @ANYPTR=&(0x7f0000000140)=ANY=[]], 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f0000000080)=0x1) gettid() pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0xc0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KDDISABIO(r4, 0x4b37) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r6) r7 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r7, 0x8200) r8 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x40000008}) fcntl$setstatus(r1, 0x4, 0x40000) ftruncate(0xffffffffffffffff, 0x0) ftruncate(r7, 0x81ff) 22:58:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:20 executing program 1: socket$inet6_udplite(0xa, 0x2, 0x88) r0 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) r1 = creat(&(0x7f0000000100)='./file1\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = add_key$user(&(0x7f00000003c0)='user\x00', 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$join(0x1, 0x0) keyctl$setperm(0x5, 0x0, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r2, 0x390}, &(0x7f00000001c0)=ANY=[@ANYBLOB="98be3463750d", @ANYRESHEX=0x0, @ANYPTR=&(0x7f0000000140)=ANY=[]], 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f0000000080)=0x1) gettid() pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0xc0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KDDISABIO(r4, 0x4b37) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r6) r7 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r7, 0x8200) r8 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x40000008}) fcntl$setstatus(r1, 0x4, 0x40000) ftruncate(0xffffffffffffffff, 0x0) ftruncate(r7, 0x81ff) [ 807.097181] binder: 6177:6183 ioctl 6609 0 returned -22 [ 807.105456] binder: 6180:6184 got transaction with invalid offset (348, min 0 max 120) or object. [ 807.123454] binder_alloc: 6177: binder_alloc_buf size 4840 failed, no address space [ 807.136490] binder: 6180:6184 transaction failed 29201/-22, size 120-24 line 3199 [ 807.150542] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 807.165427] binder: undelivered TRANSACTION_ERROR: 29201 [ 807.179077] binder: 6177:6183 transaction failed 29201/-28, size 4096-739 line 3137 22:58:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000010000000000004e30200000000000100"/76], 0x0, 0x0, 0x0}) truncate(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffff7) [ 807.229604] binder: undelivered TRANSACTION_ERROR: 29201 [ 807.300491] binder_alloc: 6200: binder_alloc_buf size 360287970189644520 failed, no address space [ 807.368968] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) 22:58:21 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x4}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x15c, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:58:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r3, 0x0, r4, 0x0, 0x1003, 0x0) ioctl$TIOCSBRK(r3, 0x5427) r5 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xffdd2116, 0x0, &(0x7f0000000140), 0xfd70, 0x0, 0x0}) setns(r5, 0x0) [ 807.413485] binder: 6200:6202 transaction failed 29201/-28, size 288230376151715840-72057594037928675 line 3137 [ 807.449003] binder: undelivered TRANSACTION_ERROR: 29201 [ 807.501063] binder: 6204:6206 got transaction with invalid offset (348, min 0 max 120) or object. [ 807.522320] binder: 6208:6209 unknown command 0 [ 807.527348] binder: 6208:6209 ioctl c0306201 20000200 returned -22 [ 807.538167] binder: 6204:6206 transaction failed 29201/-22, size 120-24 line 3199 [ 807.563597] binder: undelivered TRANSACTION_ERROR: 29201 22:58:23 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) close(0xffffffffffffffff) truncate(&(0x7f0000000240)='./bus\x00', 0x800) r2 = open(&(0x7f0000000540)='./bus\x00', 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet(0x2, 0x6, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r3, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) ioctl$FICLONE(r3, 0x40049409, r0) lchown(&(0x7f0000000080)='./bus\x00', 0xee00, 0x0) lseek(r1, 0x0, 0x2) sendfile(r1, r2, 0x0, 0x8000ffffffff) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)=ANY=[@ANYBLOB="000000000000000051fffffffffffffff900000000000000d904000000000000"]) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6) write$binfmt_elf64(r5, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r5, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) setsockopt$inet_int(r5, 0x0, 0x6, &(0x7f0000000140)=0xfffffffc, 0x4) creat(&(0x7f0000000700)='./bus\x00', 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x14, &(0x7f00000000c0)={@mcast1}, 0x14) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000180)={@initdev}, &(0x7f0000000280)=0xc) lseek(r6, 0x0, 0x3) 22:58:23 executing program 4: 22:58:23 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) setrlimit(0x5, &(0x7f0000000180)={0x6bc, 0x2}) r2 = socket(0x1, 0x3, 0x0) ioctl$sock_ifreq(r2, 0x8932, &(0x7f0000000100)={'syz_tun\x00', @ifru_settings={0x1, 0x0, @fr_pvc=0x0}}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000780)={0xdc, r3, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x88, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x8, @local, 0x5}}}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb9a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8}]}]}, @TIPC_NLA_NET={0x40, 0x7, [@TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x101}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6825}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40004110}, 0x20008010) sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000040)={&(0x7f0000000200)={0x108, r3, 0x800, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}, @TIPC_NLA_NET={0x28, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xb704}]}, @TIPC_NLA_LINK={0xb0, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe94}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdb}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x176e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x4004801}, 0x4000) sync() ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:58:23 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) signalfd(r0, &(0x7f0000000100), 0x8) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:23 executing program 0: r0 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r0) add_key$keyring(0x0, 0x0, 0x0, 0x0, r0) r1 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, r0) add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)="54dab5e429f83380f155845d2677c5099f9cf8896eb800655f929a9b92d5285a90cda3f3abedaafe7c69e6e038c7dc55aed1b30f06598db84b01aa3b815bb066359c7b518b943a6c02fe40ea8e136dd3d773bbb38ed38d4fc93e79d91ae1eda51fc29e", 0x63, r1) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) keyctl$session_to_parent(0x12) r3 = dup(r2) ioctl$sock_inet6_tcp_SIOCINQ(r3, 0x4c81, 0xfffffffffffffffe) 22:58:23 executing program 2: ioctl$BLKSECDISCARD(0xffffffffffffffff, 0x127f, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) socket(0x11, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000640)={{0xa, 0xfffe, 0x7, @loopback, 0x8}, {0xa, 0x4e21, 0x0, @remote, 0x3}, 0x0, [0x0, 0x8, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x3]}, 0x5c) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0)={@local}, &(0x7f0000000300)=0x14) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfb120eb7) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e24, 0x6, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000140)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x1d2, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setxattr$security_evm(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='security.evm\x00', &(0x7f0000000400)=@ng={0x4, 0x6, "04d33acc18"}, 0x3, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x40, @empty}, 0x10) r3 = open(&(0x7f00000000c0)='./bus\x00', 0x14102e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x180000f, 0x11, r3, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) fdatasync(0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000080)='task\x00') mknodat(0xffffffffffffffff, 0x0, 0x0, 0x0) 22:58:23 executing program 4: [ 809.579192] binder_alloc: 6219: binder_alloc_buf size 4840 failed, no address space [ 809.597152] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 809.613721] binder: 6219:6221 transaction failed 29201/-28, size 4096-739 line 3137 22:58:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:23 executing program 4: [ 809.624345] binder: undelivered TRANSACTION_ERROR: 29201 22:58:23 executing program 0: [ 809.675729] binder: 6220:6235 got transaction with invalid offset (4294966837, min 80 max 120) or object. 22:58:23 executing program 4: 22:58:23 executing program 4: [ 809.751641] binder: 6220:6235 transaction failed 29201/-22, size 120-24 line 3199 [ 809.769203] binder_alloc: 6240: binder_alloc_buf size 4840 failed, no address space [ 809.797909] binder: undelivered TRANSACTION_ERROR: 29201 [ 809.819622] binder: BINDER_SET_CONTEXT_MGR already set [ 809.829677] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 809.843769] binder: 6220:6235 ioctl 40046207 0 returned -16 [ 809.858295] binder: 6240:6247 transaction failed 29201/-28, size 4096-739 line 3137 [ 809.899980] binder: undelivered TRANSACTION_ERROR: 29201 22:58:23 executing program 1: 22:58:23 executing program 0: 22:58:23 executing program 4: 22:58:23 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl(r1, 0x0, &(0x7f0000000040)="e91d909a4d93b2ce4df9b873b21af215c0872dcaee2f413b0d11e7ea8c65e92eff67f5c4bfc81ed5c820b08bfcce667caf") ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f0000000000)) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r3, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='maps\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x78, 0x0, &(0x7f0000000480)=[@dead_binder_done, @dead_binder_done, @enter_looper, @exit_looper, @increfs_done={0x40106308, 0x3}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000240)={@fda={0x66646185, 0x7, 0x0, 0x14}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/31, 0x1f, 0x2, 0x1}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000002c0)={0x0, 0x20, 0x48}}}], 0xbe, 0x0, &(0x7f0000000600)="e8ce248232dc3c8e7125d0679b6d837ba7d6e093ebf97becf4b25e36cff15b64ad1f482853bd491ca3e22dadb4e2378c96d3757553e66e286698f007eac4aeddadd54e9dc7dbe87100c72d5bc3c63531359dcf5f955d07821d401c08296ed856f77b57ab611fd5d548db38ba7b3a00c1b9f23f61f6e805f1732b8a4c579208f994da98a569bbbddbc1099ed5194296776b3505f8a8498a9ee4e257ee74b01b122023f978663812c1364e630d3c44d2f327d86e7e6eac37a4fbde7abcfea1"}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r5, 0x0, r6, 0x0, 0x1003, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16, 0x0, 0xfffffffffffffffd}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}}], 0x166, 0x0, 0x0}) 22:58:23 executing program 5: seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x200, 0xa0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) clock_adjtime(0x0, &(0x7f0000000240)={0x5, 0x1000, 0x5, 0xffffffff, 0x6, 0x1, 0x3, 0x80000001, 0x9, 0x1ff, 0x3, 0x5, 0xffffffff, 0x7c9f16b8, 0x5, 0x101, 0x1, 0x4, 0x9, 0xdbe, 0xff, 0x84c9, 0x4, 0x1000, 0x5, 0x6}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 810.018918] audit: type=1326 audit(1575327503.916:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6260 comm="syz-executor.5" exe="/root/syz-executor.5" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45d4ba code=0x0 [ 810.068190] binder_alloc: 6260: binder_alloc_buf, no vma [ 810.080028] binder: 6260:6268 transaction failed 29189/-3, size 4096-739 line 3137 [ 810.099807] binder: 6258:6261 got transaction with fd, 9, but target does not allow fds [ 810.111663] binder: 6258:6261 transaction failed 29201/-1, size 104-24 line 3241 [ 810.120440] binder: 6258:6261 ioctl c0306201 20000080 returned -14 [ 810.129583] binder: undelivered TRANSACTION_ERROR: 29201 [ 810.139331] binder: BINDER_SET_CONTEXT_MGR already set [ 810.145213] binder: 6258:6270 ioctl 40046207 0 returned -16 22:58:24 executing program 2: 22:58:24 executing program 0: 22:58:24 executing program 4: 22:58:24 executing program 1: 22:58:24 executing program 3: umount2(&(0x7f0000000100)='./file0\x00', 0x0) r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) finit_module(0xffffffffffffffff, &(0x7f0000000040)='.\x00', 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000000000000000000000000000000e3000000000000852a7470000000020000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00'/37], @ANYBLOB='%\x00'/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 22:58:24 executing program 4: 22:58:24 executing program 0: 22:58:24 executing program 1: 22:58:24 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) setrlimit(0x5, &(0x7f0000000180)={0x6bc, 0x2}) r2 = socket(0x1, 0x3, 0x0) ioctl$sock_ifreq(r2, 0x8932, &(0x7f0000000100)={'syz_tun\x00', @ifru_settings={0x1, 0x0, @fr_pvc=0x0}}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000780)={0xdc, r3, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x88, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x8, @local, 0x5}}}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb9a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8}]}]}, @TIPC_NLA_NET={0x40, 0x7, [@TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x101}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6825}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40004110}, 0x20008010) sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000040)={&(0x7f0000000200)={0x108, r3, 0x800, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}, @TIPC_NLA_NET={0x28, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xb704}]}, @TIPC_NLA_LINK={0xb0, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe94}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdb}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x176e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x4004801}, 0x4000) sync() ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:58:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000580)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, {0x306}, 0x10, {0x2, 0x0, @broadcast}, 'veth1_to_bridge\x00'}) r3 = socket(0x18, 0x0, 0x3) connect(r3, &(0x7f0000000000)=@nfc_llcp={0x27, 0x1, 0x2, 0x4, 0x31, 0x80, "15d0f8f238b5c51bbef4ca856c7afc4d0e0c940e5c816a36d1ca9a9028ee9f5f437d803c8623c65c3cb58ff542be1975c07b0c0a481fc5c440b52091f575d0", 0x2c}, 0x80) setsockopt$sock_int(r1, 0x1, 0x1e, &(0x7f0000000040)=0xfffffffffffffffc, 0x4) clone(0x20003ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = socket(0x0, 0x80, 0x5) r5 = open(&(0x7f0000000500)='./bus\x00', 0x8141042, 0x80) close(r5) r6 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x6, 0x105082) r7 = memfd_create(&(0x7f0000000000)='}#*nodev\xee\xb8em2N,\x00', 0x0) pwritev(r7, &(0x7f00000000c0)=[{&(0x7f0000000480)="a8", 0x1}], 0x1, 0x80ffe) ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r5, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffed6) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendmmsg(r8, &(0x7f00000002c0)=[{{&(0x7f0000000080)=@nfc={0x27, 0x2}, 0x80, 0x0}}, {{&(0x7f0000000100)=@x25={0x9, @null=' \x00'}, 0x80, 0x0}}], 0x2e1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r10, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r9, 0x0, r10, 0x0, 0x1003, 0x0) fcntl$setstatus(r4, 0x4, 0x2400) pipe(&(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r12, &(0x7f00000001c0), 0x526987c9) getsockopt$ARPT_SO_GET_ENTRIES(r5, 0x0, 0x61, &(0x7f0000000740)=ANY=[], 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000680)='lp\xff\xbf\xfco\xd5\xaa\xfe\x1d\x15\xe2\x95Q\x87\xa4\'\xd0\xd8\xe3\xa1\x83\xf2A/\x80x\xe9\x11\x05\x8dOS\xdb\xc7`J\x94X\xbd\x9eXg\x7f\xfdQu\xcd<\xbfi1\xd4\xbbb\xe2\xf3,^\xbc\xbb\b\x8d#%\";+\xb8\xc3\x9ea\xde\xd2,S\xa1\x14\xbd\xe9\n3-\x88B\x1f\xa5\xba\xfc\x9fTZW\vG\xe4\x1a6\xdf\x14o.mU\x94t\x90P\x84\x7f\x16\x89\xf7S\x8e\x12U}[\xa6\xe7\"`\x14\xdf\x04z:', 0x80) read(r11, &(0x7f0000000200)=""/250, 0x50c7e3e3) sendfile(r6, r5, 0x0, 0x80005) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000003c0)={0x0}, &(0x7f0000000340)=0xb84699fd) syz_open_procfs(r13, &(0x7f0000000180)='ne\x8f/p\x00\xc9\xfc\"\'_\x8f\x93\f\xb9\x00\x00') r14 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r14, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r15 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fcntl$dupfd(r11, 0x0, r15) 22:58:24 executing program 2: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000300), &(0x7f0000000340)=0x4) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(r1, &(0x7f0000000480)=""/200, 0xffffffffffffff90, 0x2) r2 = getpgrp(0xffffffffffffffff) fcntl$setownex(r1, 0xf, &(0x7f00000000c0)={0x0, r2}) syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/4\x00') r3 = socket$inet(0x10, 0x3, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff}) read(r4, &(0x7f0000000200)=""/250, 0x50c7e5e2) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x4, {0x7fffffff, 0x4, 0x40, 0x2, 0x8, 0x4}}) syz_open_procfs(0x0, &(0x7f0000000000)='syscall\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) ioctl$sock_ifreq(r3, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', @ifru_flags=0x4}) [ 810.411242] binder: 6276:6281 got transaction with too large buffer [ 810.442935] binder: 6276:6281 transaction failed 29201/-22, size 120-24 line 3295 [ 810.498387] binder: 6288:6291 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 810.503939] binder: undelivered TRANSACTION_ERROR: 29201 [ 810.514597] binder: 6276:6300 got transaction with too large buffer [ 810.516486] binder: 6288:6291 transaction failed 29201/-22, size 120-24 line 3199 [ 810.532142] binder: undelivered TRANSACTION_ERROR: 29201 [ 810.557698] binder: 6276:6300 transaction failed 29201/-22, size 120-24 line 3295 [ 810.569637] binder: undelivered TRANSACTION_ERROR: 29201 22:58:24 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x21}, {0x80000006}]}, 0x10) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r3, 0x8004745a, &(0x7f0000000600)) write$P9_RWSTAT(r3, &(0x7f0000000140)={0x7, 0x7f, 0x2}, 0x7) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r4, 0x0, 0x1003, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) r6 = socket(0x1, 0x2, 0x0) getsockname$packet(r6, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r5, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r7}, 0x80, 0x0}}], 0x300, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f0000000100)={@local, 0x45, r7}) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast2}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 22:58:24 executing program 0: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/policy\x00', 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)=0x1) fchdir(r1) personality(0x4100001) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00'}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x13, 0x0, 0xfffffffffffffff8) openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x8000, 0x0) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000300)='fou\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00002dbd7000ffdbdf250100000014000700ff01000000000000000000000000ffffac1414bb08000600e000000108000600ac1e0001"], 0x4c}, 0x1, 0x0, 0x0, 0x20000010}, 0x4000) r3 = open(&(0x7f0000000000)='./bus\x00', 0x40000141042, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0x323) r4 = creat(&(0x7f0000000380)='./bus\x00', 0x0) r5 = getpid() sched_setscheduler(r5, 0x5, &(0x7f0000000040)) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000540)=ANY=[@ANYRES32, @ANYRES32=r3, @ANYBLOB="000000000000010000000000000000000002001e0000000000000000", @ANYRES32=r4, @ANYBLOB="000000000500"/28]) r6 = open(&(0x7f0000000240)='./bus\x00', 0x0, 0x0) r7 = socket(0x10, 0x80002, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x1b, &(0x7f00000001c0)=0x7fff, 0x4) bind$netlink(r7, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) setsockopt$inet6_opts(r7, 0x29, 0x3f, &(0x7f00000000c0)=@routing={0xde, 0x0, 0x0, 0x1f}, 0x8) write(r7, &(0x7f0000000140)="2600000022004701050000000000000005006d20002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r7, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000b4bffc), 0x4) sendto(r7, &(0x7f0000000340), 0xac, 0x0, 0x0, 0x0) write$tun(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="0102fff87d7ce34471831e9c34d1b24faa77b9cf223e0f79b58b2ce4570357851d1849e515dffc90cf8a9c16403d5a1d72b9e820624a2572c210b61bc4705f9251e363760d6affa7a84d8eaa4f8a269e76bcbfd7748343c6c93d5ab866d89f652c034deedde9c994289df63f47cc46a0ef7df0c1c8373a6eb8a5c7f62fcbbc1cb7de50cb4a1b9c956d7a89bad734a337b8242b67c97f7894f206578eecaab4318d00561001ba1d146599cba698f2b54d6a92c1c0cb40f335923be084e75eeed90fc3ad11a9838dc97ec2def1d600ee69a3a5b885c650f2708883f9b61006d1f36cef1f8f3050440ec391451e52c4dcdb673fce1445624262629469c501432093405a37f7060b7edaf82413a0c95363953c255f3a96d004f1de470ca1cc7d9cb4532db4dfe055fc18ef48b8eed78eb4afb190bf6e781af1e65e80f2d93026d0"], 0x1) recvmmsg(r7, &(0x7f0000000780), 0x3ffffffffffff81, 0x2, 0x0) sendfile(r3, r6, &(0x7f0000000140), 0x8fff) 22:58:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040ffffffff000000000000000000000000000000000000000000000000000000007800000000000000c4fdffffffffffff", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a68770001000002000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a6873000100"/88], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="0000000000000000280000000000000015feffff000000005a36955eab63a3c507997f881204f884e501210065338ea3ba09c97c2c26903f5ad4c562b1aaaf0d085d000e17cb3cc7585c6c6f599140b058c9c73f49712d8a4c9bb8c4fa747c89e0177180689eca166786470dfb71"]], 0x0, 0x0, 0x0}) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x2c86c1, 0x0) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000040)) 22:58:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_GET_KEEPCAPS(0x7) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="634840000000000000000000000000000000000000000000000000000000000000e710000000000000e3a0c22626de9b68ee6f17280902000000000000009100"/87], 0x0, 0x0, 0x0}) sendmsg$DEVLINK_CMD_PORT_SET(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8904080}, 0xc, &(0x7f0000000100)={&(0x7f0000000480)={0xfc, 0x0, 0x800, 0x70bd2d, 0x25dfdbff, {}, [{{@pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, {0x8}}, {0x8, 0x4, 0x3}}, {{@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0x4, 0x2}}, {{@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x4, 0x2}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x14, 0x2, '0000:00:10.0\x00'}}, {0x8}}, {0x8, 0x4, 0x3}}, {{@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0x4, 0x1}}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8010}, 0x400) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) setsockopt$inet6_MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x4e23, 0x3, @loopback, 0xfffffff8}, {0xa, 0x4e21, 0xff, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}, 0x9}, 0x400, [0xfffffffa, 0xc0f, 0x400, 0x1, 0x40, 0xffffffc1, 0x85ee, 0x800]}, 0x5c) [ 810.813310] binder: undelivered TRANSACTION_ERROR: 29189 [ 810.813814] audit: type=1326 audit(1575327504.716:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6260 comm="syz-executor.5" exe="/root/syz-executor.5" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45d4ba code=0x0 22:58:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) getpeername$netlink(r1, &(0x7f0000000040), &(0x7f0000000140)=0xc) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) 22:58:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='\x10\x00\xff\a\x00\x00\x00\x10\x00\xd5p\xadg', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = dup(0xffffffffffffffff) r2 = accept4$packet(r1, &(0x7f00000000c0), &(0x7f0000000140)=0x14, 0x80800) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) write$selinux_user(r1, &(0x7f0000000000)={'system_u:object_r:sendmail_exec_t:s0', 0x20, 'unconfined_u\x00'}, 0x32) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) [ 810.888223] binder: 6315:6317 unknown command 4212835 [ 810.891647] binder: 6314:6320 got transaction to invalid handle [ 810.891655] binder: 6314:6320 transaction failed 29201/-22, size 120--572 line 3014 [ 810.892045] binder: undelivered TRANSACTION_ERROR: 29201 [ 810.893234] binder: 6314:6321 got transaction to invalid handle [ 810.893242] binder: 6314:6321 transaction failed 29201/-22, size 120--572 line 3014 [ 810.893564] binder: undelivered TRANSACTION_ERROR: 29201 22:58:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000e4e7a142178fa1e300000000000000"], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) [ 810.916723] binder: 6322:6323 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 810.916789] binder: 6322:6323 transaction failed 29201/-22, size 120-24 line 3199 [ 810.917141] binder: undelivered TRANSACTION_ERROR: 29201 [ 810.920579] binder: 6322:6324 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 810.920636] binder: 6322:6324 transaction failed 29201/-22, size 120-24 line 3199 [ 810.920942] binder: undelivered TRANSACTION_ERROR: 29201 [ 810.965347] binder: 6330:6331 got transaction with invalid offset (4294966837, min 80 max 120) or object. 22:58:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0xffe4, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/31, 0x1f}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 810.965688] binder: 6330:6331 transaction failed 29201/-22, size 120-24 line 3199 [ 810.965817] binder: undelivered TRANSACTION_ERROR: 29201 [ 810.974502] binder: 6330:6332 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 810.974560] binder: 6330:6332 transaction failed 29201/-22, size 120-24 line 3199 [ 810.975177] binder: undelivered TRANSACTION_ERROR: 29201 [ 811.024618] binder: 6334:6335 got transaction with too large buffer [ 811.024679] binder: 6334:6335 transaction failed 29201/-22, size 120-24 line 3295 22:58:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) signalfd(r0, &(0x7f0000000000)={0x200}, 0x8) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00634040000000000000000000000027c28f55dc78c4cd0000000000000000000000000000000000008c33941cf00d8ad49aba000000780000000046d5a0f7cffb589059b532190000001800000000000000d6a6591e405e6dfe07e92191cbc961240105eaeff6789189627b5ef1de36d75ddbacd7b9568726bba1b03648de811d2879a607179e661acb14557d7cb6f13554b2de9a9e80568b78c0b54dbb9305023df28ce377a90aefb8313d8b13dae0e989a61a322df52bc07ed74eedd401b0f17732a3b51f2e1867277120fc321521c19eef7ea686a54fffaf61403f6f5f30b86f872b5483810b3a486e6b938eeb03cc50fafa75179780b5492a06daf958437365d95123f628a4daf60064e4d1c645ea8018c29d0ecddf56b0a197d41e9e31cfe412c33697d930914a73be4458553eccd7c680e48f008c499ecb84f2845440b12de4d0213bb093f5cd0de3964a8b5303a781738f49d762d7e99017c0571d4e6c0e6c17fc1ee8c93fbfe3d339471e4bad54d9b11f40c6a4b7a76c463aa3b5996583d5b0d53a25c28745da1dfca2b758fc735546", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, 0x0}) 22:58:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000580)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, {0x306}, 0x10, {0x2, 0x0, @broadcast}, 'veth1_to_bridge\x00'}) r3 = socket(0x18, 0x0, 0x3) connect(r3, &(0x7f0000000000)=@nfc_llcp={0x27, 0x1, 0x2, 0x4, 0x31, 0x80, "15d0f8f238b5c51bbef4ca856c7afc4d0e0c940e5c816a36d1ca9a9028ee9f5f437d803c8623c65c3cb58ff542be1975c07b0c0a481fc5c440b52091f575d0", 0x2c}, 0x80) setsockopt$sock_int(r1, 0x1, 0x1e, &(0x7f0000000040)=0xfffffffffffffffc, 0x4) clone(0x20003ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = socket(0x0, 0x80, 0x5) r5 = open(&(0x7f0000000500)='./bus\x00', 0x8141042, 0x80) close(r5) r6 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x6, 0x105082) r7 = memfd_create(&(0x7f0000000000)='}#*nodev\xee\xb8em2N,\x00', 0x0) pwritev(r7, &(0x7f00000000c0)=[{&(0x7f0000000480)="a8", 0x1}], 0x1, 0x80ffe) ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r5, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffed6) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendmmsg(r8, &(0x7f00000002c0)=[{{&(0x7f0000000080)=@nfc={0x27, 0x2}, 0x80, 0x0}}, {{&(0x7f0000000100)=@x25={0x9, @null=' \x00'}, 0x80, 0x0}}], 0x2e1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r10, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r9, 0x0, r10, 0x0, 0x1003, 0x0) fcntl$setstatus(r4, 0x4, 0x2400) pipe(&(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r12, &(0x7f00000001c0), 0x526987c9) getsockopt$ARPT_SO_GET_ENTRIES(r5, 0x0, 0x61, &(0x7f0000000740)=ANY=[], 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000680)='lp\xff\xbf\xfco\xd5\xaa\xfe\x1d\x15\xe2\x95Q\x87\xa4\'\xd0\xd8\xe3\xa1\x83\xf2A/\x80x\xe9\x11\x05\x8dOS\xdb\xc7`J\x94X\xbd\x9eXg\x7f\xfdQu\xcd<\xbfi1\xd4\xbbb\xe2\xf3,^\xbc\xbb\b\x8d#%\";+\xb8\xc3\x9ea\xde\xd2,S\xa1\x14\xbd\xe9\n3-\x88B\x1f\xa5\xba\xfc\x9fTZW\vG\xe4\x1a6\xdf\x14o.mU\x94t\x90P\x84\x7f\x16\x89\xf7S\x8e\x12U}[\xa6\xe7\"`\x14\xdf\x04z:', 0x80) read(r11, &(0x7f0000000200)=""/250, 0x50c7e3e3) sendfile(r6, r5, 0x0, 0x80005) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000003c0)={0x0}, &(0x7f0000000340)=0xb84699fd) syz_open_procfs(r13, &(0x7f0000000180)='ne\x8f/p\x00\xc9\xfc\"\'_\x8f\x93\f\xb9\x00\x00') r14 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r14, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r15 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fcntl$dupfd(r11, 0x0, r15) [ 811.024877] binder: undelivered TRANSACTION_ERROR: 29201 [ 811.035890] binder: 6334:6336 got transaction with too large buffer [ 811.035955] binder: 6334:6336 transaction failed 29201/-22, size 120-24 line 3295 [ 811.036634] binder: undelivered TRANSACTION_ERROR: 29201 [ 811.076826] binder: 6315:6317 ioctl c0306201 20000200 returned -22 22:58:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000e9ffffffffffffff000000000000000010000000000000e30200"/76], 0x0, 0x0, 0x0}) [ 811.094780] binder_alloc: 6340: binder_alloc_buf size -7715186417347989472 failed, no address space [ 811.113551] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) [ 811.122717] binder: 6340:6341 transaction failed 29201/-28, size -7767711000656084992-52524583308095516 line 3137 [ 811.144446] binder: BINDER_SET_CONTEXT_MGR already set [ 811.149997] binder: 6340:6341 ioctl 40046207 0 returned -16 [ 811.150010] binder: undelivered TRANSACTION_ERROR: 29201 [ 811.152413] binder: 6346:6347 transaction failed 29201/-28, size 4096-739 line 3137 [ 811.152605] binder: undelivered TRANSACTION_ERROR: 29201 [ 811.187376] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=28265 sclass=netlink_route_socket 22:58:25 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000580)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, {0x306}, 0x10, {0x2, 0x0, @broadcast}, 'veth1_to_bridge\x00'}) r3 = socket(0x18, 0x0, 0x3) connect(r3, &(0x7f0000000000)=@nfc_llcp={0x27, 0x1, 0x2, 0x4, 0x31, 0x80, "15d0f8f238b5c51bbef4ca856c7afc4d0e0c940e5c816a36d1ca9a9028ee9f5f437d803c8623c65c3cb58ff542be1975c07b0c0a481fc5c440b52091f575d0", 0x2c}, 0x80) setsockopt$sock_int(r1, 0x1, 0x1e, &(0x7f0000000040)=0xfffffffffffffffc, 0x4) clone(0x20003ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = socket(0x0, 0x80, 0x5) r5 = open(&(0x7f0000000500)='./bus\x00', 0x8141042, 0x80) close(r5) r6 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x6, 0x105082) r7 = memfd_create(&(0x7f0000000000)='}#*nodev\xee\xb8em2N,\x00', 0x0) pwritev(r7, &(0x7f00000000c0)=[{&(0x7f0000000480)="a8", 0x1}], 0x1, 0x80ffe) ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r5, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffed6) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendmmsg(r8, &(0x7f00000002c0)=[{{&(0x7f0000000080)=@nfc={0x27, 0x2}, 0x80, 0x0}}, {{&(0x7f0000000100)=@x25={0x9, @null=' \x00'}, 0x80, 0x0}}], 0x2e1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r10, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r9, 0x0, r10, 0x0, 0x1003, 0x0) fcntl$setstatus(r4, 0x4, 0x2400) pipe(&(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r12, &(0x7f00000001c0), 0x526987c9) getsockopt$ARPT_SO_GET_ENTRIES(r5, 0x0, 0x61, &(0x7f0000000740)=ANY=[], 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000680)='lp\xff\xbf\xfco\xd5\xaa\xfe\x1d\x15\xe2\x95Q\x87\xa4\'\xd0\xd8\xe3\xa1\x83\xf2A/\x80x\xe9\x11\x05\x8dOS\xdb\xc7`J\x94X\xbd\x9eXg\x7f\xfdQu\xcd<\xbfi1\xd4\xbbb\xe2\xf3,^\xbc\xbb\b\x8d#%\";+\xb8\xc3\x9ea\xde\xd2,S\xa1\x14\xbd\xe9\n3-\x88B\x1f\xa5\xba\xfc\x9fTZW\vG\xe4\x1a6\xdf\x14o.mU\x94t\x90P\x84\x7f\x16\x89\xf7S\x8e\x12U}[\xa6\xe7\"`\x14\xdf\x04z:', 0x80) read(r11, &(0x7f0000000200)=""/250, 0x50c7e3e3) sendfile(r6, r5, 0x0, 0x80005) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000003c0)={0x0}, &(0x7f0000000340)=0xb84699fd) syz_open_procfs(r13, &(0x7f0000000180)='ne\x8f/p\x00\xc9\xfc\"\'_\x8f\x93\f\xb9\x00\x00') r14 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r14, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r15 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fcntl$dupfd(r11, 0x0, r15) 22:58:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x400) write$selinux_attr(r1, &(0x7f0000000100)='system_u:object_r:modules_object_t:s0\x00', 0x26) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634876656d88d3e995b22ea84000000000000000000000000000000000000000f6ffffff0000000000000000000010000000000000e3020000000000000000000000000000000000000000000000ae5ffb7e73aa1f3590"], 0x0, 0x0, 0x0}) [ 811.711293] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=28265 sclass=netlink_route_socket 22:58:25 executing program 1: umount2(&(0x7f0000000100)='./file0\x00', 0x0) r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) finit_module(0xffffffffffffffff, &(0x7f0000000040)='.\x00', 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000000000000000000000000000000e3000000000000852a7470000000020000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00'/37], @ANYBLOB='%\x00'/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 811.885316] binder: 6373:6374 got transaction with too large buffer [ 811.893292] binder: 6373:6374 transaction failed 29201/-22, size 120-24 line 3295 [ 811.903267] binder: undelivered TRANSACTION_ERROR: 29201 22:58:26 executing program 0: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/policy\x00', 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)=0x1) fchdir(r1) personality(0x4100001) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00'}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x13, 0x0, 0xfffffffffffffff8) openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x8000, 0x0) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000300)='fou\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00002dbd7000ffdbdf250100000014000700ff01000000000000000000000000ffffac1414bb08000600e000000108000600ac1e0001"], 0x4c}, 0x1, 0x0, 0x0, 0x20000010}, 0x4000) r3 = open(&(0x7f0000000000)='./bus\x00', 0x40000141042, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0x323) r4 = creat(&(0x7f0000000380)='./bus\x00', 0x0) r5 = getpid() sched_setscheduler(r5, 0x5, &(0x7f0000000040)) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000540)=ANY=[@ANYRES32, @ANYRES32=r3, @ANYBLOB="000000000000010000000000000000000002001e0000000000000000", @ANYRES32=r4, @ANYBLOB="000000000500"/28]) r6 = open(&(0x7f0000000240)='./bus\x00', 0x0, 0x0) r7 = socket(0x10, 0x80002, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x1b, &(0x7f00000001c0)=0x7fff, 0x4) bind$netlink(r7, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) setsockopt$inet6_opts(r7, 0x29, 0x3f, &(0x7f00000000c0)=@routing={0xde, 0x0, 0x0, 0x1f}, 0x8) write(r7, &(0x7f0000000140)="2600000022004701050000000000000005006d20002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r7, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000b4bffc), 0x4) sendto(r7, &(0x7f0000000340), 0xac, 0x0, 0x0, 0x0) write$tun(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="0102fff87d7ce34471831e9c34d1b24faa77b9cf223e0f79b58b2ce4570357851d1849e515dffc90cf8a9c16403d5a1d72b9e820624a2572c210b61bc4705f9251e363760d6affa7a84d8eaa4f8a269e76bcbfd7748343c6c93d5ab866d89f652c034deedde9c994289df63f47cc46a0ef7df0c1c8373a6eb8a5c7f62fcbbc1cb7de50cb4a1b9c956d7a89bad734a337b8242b67c97f7894f206578eecaab4318d00561001ba1d146599cba698f2b54d6a92c1c0cb40f335923be084e75eeed90fc3ad11a9838dc97ec2def1d600ee69a3a5b885c650f2708883f9b61006d1f36cef1f8f3050440ec391451e52c4dcdb673fce1445624262629469c501432093405a37f7060b7edaf82413a0c95363953c255f3a96d004f1de470ca1cc7d9cb4532db4dfe055fc18ef48b8eed78eb4afb190bf6e781af1e65e80f2d93026d0"], 0x1) recvmmsg(r7, &(0x7f0000000780), 0x3ffffffffffff81, 0x2, 0x0) sendfile(r3, r6, &(0x7f0000000140), 0x8fff) 22:58:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="0000b901b0ce759581cd00000000000035feffff00000000ad2b5a403f226e3d8cc1153a326b0cfba239d3b25d0954c99a0eee00000000000077c7a61c70849cf49df4fec2c7bc3215f1ede992e1b2cfdfbf951fa675b537caa1c36152e77a8dddaa09768479e52f666e602a5dc251add1a2e0c236f0d5559f788f5bb3458caf1a798d421245a9ca033311dae7631be9ee5643a123fe31859d1e3c48fda55e3b0525f43a3dc1470947f6a463676a43f095aa"]], 0x0, 0x0, 0x0}) 22:58:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = dup(r0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r2, 0x400, 0x70bd2c, 0x25dfdbfb, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @l2={'ib', 0x3a, 'rose0\x00'}}}, [""]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000580)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, {0x306}, 0x10, {0x2, 0x0, @broadcast}, 'veth1_to_bridge\x00'}) r3 = socket(0x18, 0x0, 0x3) connect(r3, &(0x7f0000000000)=@nfc_llcp={0x27, 0x1, 0x2, 0x4, 0x31, 0x80, "15d0f8f238b5c51bbef4ca856c7afc4d0e0c940e5c816a36d1ca9a9028ee9f5f437d803c8623c65c3cb58ff542be1975c07b0c0a481fc5c440b52091f575d0", 0x2c}, 0x80) setsockopt$sock_int(r1, 0x1, 0x1e, &(0x7f0000000040)=0xfffffffffffffffc, 0x4) clone(0x20003ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = socket(0x0, 0x80, 0x5) r5 = open(&(0x7f0000000500)='./bus\x00', 0x8141042, 0x80) close(r5) r6 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x6, 0x105082) r7 = memfd_create(&(0x7f0000000000)='}#*nodev\xee\xb8em2N,\x00', 0x0) pwritev(r7, &(0x7f00000000c0)=[{&(0x7f0000000480)="a8", 0x1}], 0x1, 0x80ffe) ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r5, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffed6) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendmmsg(r8, &(0x7f00000002c0)=[{{&(0x7f0000000080)=@nfc={0x27, 0x2}, 0x80, 0x0}}, {{&(0x7f0000000100)=@x25={0x9, @null=' \x00'}, 0x80, 0x0}}], 0x2e1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r10, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r9, 0x0, r10, 0x0, 0x1003, 0x0) fcntl$setstatus(r4, 0x4, 0x2400) pipe(&(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r12, &(0x7f00000001c0), 0x526987c9) getsockopt$ARPT_SO_GET_ENTRIES(r5, 0x0, 0x61, &(0x7f0000000740)=ANY=[], 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000680)='lp\xff\xbf\xfco\xd5\xaa\xfe\x1d\x15\xe2\x95Q\x87\xa4\'\xd0\xd8\xe3\xa1\x83\xf2A/\x80x\xe9\x11\x05\x8dOS\xdb\xc7`J\x94X\xbd\x9eXg\x7f\xfdQu\xcd<\xbfi1\xd4\xbbb\xe2\xf3,^\xbc\xbb\b\x8d#%\";+\xb8\xc3\x9ea\xde\xd2,S\xa1\x14\xbd\xe9\n3-\x88B\x1f\xa5\xba\xfc\x9fTZW\vG\xe4\x1a6\xdf\x14o.mU\x94t\x90P\x84\x7f\x16\x89\xf7S\x8e\x12U}[\xa6\xe7\"`\x14\xdf\x04z:', 0x80) read(r11, &(0x7f0000000200)=""/250, 0x50c7e3e3) sendfile(r6, r5, 0x0, 0x80005) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000003c0)={0x0}, &(0x7f0000000340)=0xb84699fd) syz_open_procfs(r13, &(0x7f0000000180)='ne\x8f/p\x00\xc9\xfc\"\'_\x8f\x93\f\xb9\x00\x00') r14 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r14, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r15 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fcntl$dupfd(r11, 0x0, r15) 22:58:26 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000e4e7a142178fa1e300000000000000"], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) 22:58:26 executing program 1: clone(0x2000000024000300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000040)={0x0, 0x7530}, 0x10) listen(r0, 0x0) r1 = accept$inet(r0, 0x0, 0x0) r2 = memfd_create(&(0x7f0000000180)='&wlan0%*(\x00', 0x0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x5, 0x11, r2, 0x0) r3 = memfd_create(&(0x7f0000000080)='procGPL\\wlan0nodevposix_acl_accessmime_type,,*\x00', 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0xfffffffffffffffd, {0x4000001}, 0x0, 0x0}, 0x0, 0x8, &(0x7f0000000000)) syz_open_procfs(0x0, &(0x7f0000000140)='net/dev\x00') prctl$PR_SET_DUMPABLE(0x4, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='net\b\x00co\x00') pipe(&(0x7f0000000440)={0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r6, 0x0, r7, 0x0, 0x1003, 0x0) ioctl$sock_FIOGETOWN(r6, 0x8903, &(0x7f0000000340)=0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r10, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r11, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) r12 = gettid() ptrace$setopts(0x4206, r12, 0x0, 0x0) tkill(r12, 0x3b) ptrace$setregs(0xd, r12, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r12, 0x0, 0x0) r13 = gettid() ptrace$setopts(0x4206, r13, 0x0, 0x0) tkill(r13, 0x3b) ptrace$setregs(0xd, r13, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r13, 0x0, 0x0) r14 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r14, 0xffffffffffffffff, 0x0, 0x0) r15 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r15, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) getresuid(&(0x7f00000003c0)=0x0, &(0x7f0000000400), &(0x7f0000000480)) r17 = syz_open_dev$sndtimer(&(0x7f00000004c0)='/dev/snd/timer\x00', 0x0, 0x400) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x0, 0x0}) getresuid(&(0x7f0000000580), &(0x7f00000005c0), &(0x7f00000025c0)=0x0) r20 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendfile(r20, 0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r21, 0x0, 0x0) getsockopt$sock_cred(r21, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r21, 0xc0502100, &(0x7f0000005800)={0x0, 0x0}) r23 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000005880)='/selinux/enforce\x00', 0x240800, 0x0) stat(&(0x7f00000058c0)='./file0\x00', &(0x7f0000005900)={0x0, 0x0, 0x0, 0x0, 0x0}) r25 = gettid() ptrace$setopts(0x4206, r25, 0x0, 0x0) tkill(r25, 0x3b) ptrace$setregs(0xd, r25, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r25, 0x0, 0x0) r26 = getpgrp(r25) r27 = gettid() ptrace$setopts(0x4206, r27, 0x0, 0x0) tkill(r27, 0x3b) ptrace$setregs(0xd, r27, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r27, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000067c0)={{{@in6=@ipv4, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@initdev}}, &(0x7f00000068c0)=0xe8) r29 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(r29, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, 0x0, r30) r31 = gettid() ptrace$setopts(0x4206, r31, 0x0, 0x0) tkill(r31, 0x3b) ptrace$setregs(0xd, r31, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r31, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r33, 0x29, 0x23, &(0x7f0000000dc0)={{{@in=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000300)=0x25d) sendmsg$nl_xfrm(r32, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="900100001400000429bd7000fddbdf257f0000010000000000000000000000007f0000010000000000000000000000004e24ffc14e210101020080b000000000", @ANYRES32=0x0, @ANYRES32=r34, @ANYBLOB="ffffffff4f000000400103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000064d63a690f12f5c4578fbe90c614a204dab8a0ecd3983cc109492a021b47835b923377517db10373472e53fe8979dd1b76158ccd36ed115711a9c0e2b4cd07fb1babf080f253802f7f66d4487628343fea938f9178096fcf0cfdf716de5cee477c1a6289bddfcd829fb05df0da28ffd2121d6cbc127f8ce0f2df074ab897ad4d79d4d2108a7bc0700eee1cb18b3ac3b9f67c936d0ee732655bf1bfd71cb2384f4351c895aa678993b6c14b1ceee09094f603d679257a29daa0142ff7ef239a35bb6bce35d33d04f1dac7986eee2640a87a2b49aa2cca8f9985974b824ee3ee9dd5cea9bce59292a3e06f3d9e8af8b070d522c000000"], 0x4}, 0x1, 0x0, 0x0, 0x4800}, 0x20044) r35 = getegid() r36 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r36, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) sendmsg$netlink(r5, &(0x7f0000006980)={&(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbff, 0x400000}, 0xc, &(0x7f0000006700)=[{&(0x7f0000000640)={0x2dc, 0x2f, 0x20, 0x70bd2b, 0x25dfdbff, "", [@nested={0x198, 0x62, [@generic="f6c8cbd70650d27bab8d47ce656415d815ef81d26ca57307fde127020d28374b7cf18d6892959baf072e334e5d032437e3a21ac03456c30d4d316eb45bf3c27a0caf9ea55d418ccd399c9852ed1d5f60e51dd6ac19d2c23d509ad8c409cecb6f43eab39c85de71c01bb1a8458e84fadd99e50f0996b6dca463f920", @typed={0x8, 0x41, @pid=r8}, @typed={0x14, 0x3f, @ipv6=@local}, @generic="3441279680cfc776d07b8d9b0d11f61d2ee9a667ac43239e3e0dca3c902b6353a286da5e05954ce7ab9f601499eacbf34108c042c6e7e486df2d042c269cba561da31a7b131ac80d1ea89f095162c56891e3aa573b0b69b0919c66feedf08ed321a2bcc8aa501dbf24d2febbc4241443755f24a2f515e6c1e3da0eea4c2ea481ec7459dd0215106eae7e31299ce24569cf41266c33f29d2ee0567a2bd7dde563407d2edd1b365339330aa6b4f26e52", @generic="c6414dee14e8e8bc8d400fe85d2bf2f393ff45aef657129290b5d950f2e1bd44a28844c7ee0460307503846ccfdd4d3ac50e3eefd33c6e715df5678c18310e1613", @typed={0x8, 0x57, @u32=0x5}, @typed={0x4, 0x10}]}, @generic="6a2e75b1a19ed673d024f22730539dea8269bc90f18f62476f5dd258a18f6b1364aefdff962f6744090269f661126b477022b6873785f3f94884ccd93c50136f1005d1eb260c6f59bfe72e1f6fad17fb926a4954232c8764cdab3397ffe539e396a125cca6d292a3b25f7be4b154f3bb7ce2a8883c78a651f1bf11060a64b2d446561421", @typed={0x8, 0x5, @uid=r11}, @nested={0x18, 0x19, [@typed={0x8, 0x50, @u32=0x7}, @typed={0xc, 0x16, @str='net\b\x00co\x00'}]}, @nested={0x90, 0x5d, [@typed={0x14, 0x68, @ipv6=@ipv4={[], [], @rand_addr=0x9}}, @generic="acb04c5ceb", @typed={0x8, 0x6d, @u32=0x174}, @generic="0ba515a65ceab36b43a01715c090f90064d63055af9027f67d3fb70332d63a29596513cadd2235409a4aca3fb0ebe7afe738caaea16f9f0cfcd90ce98438b85dcc19bc486862d98476d38f83316bb5bddbb920f81b63b6dab53342ce361fe31144f5620af6f40d243fc5"]}]}, 0x2dc}, {&(0x7f0000000940)={0x1b4, 0x28, 0x200, 0x70bd28, 0x25dfdbfd, "", [@typed={0x14, 0x2f, @ipv6=@mcast1}, @nested={0x190, 0x26, [@generic="09cedc787314d8ca1648700c0b52b405cde158ab040b7f913e8bfeccf009310ea9d99c992476e3906c3ffbef9384ff7c0ea5ae667d26bf21edbbd353e7742795f032833c976705aca5a8f5b2d780bd35340381bc5f9246d9f612da7ea77c98a78aca0da51b160fa6c8ff5bcdb38caaffec4bce443b8ac239e72e48fa408ad617001ae61ef3816aef72411f88ebf3c23301734e3de08e8d24770e382633bbf4d203762f70bbfabedaddb73ff248c446ea5292469fff0e3817c77bbdd7c4e5114f5b8ea227610844d2c0897733ca8908bd038c0f3223ba1f2bb7a05042dd5a7d05d981f72930dc49b3a621de4f7756705069b4362c6b", @generic="f6340c8576f677d5654ad63e17ce5e575358fda4e6473d68d875bfbea5235d7f0590cdc2d7b2c5c5c98eccf4a4a0daa04de700deaf8fd1ade2126b55fd3667cf24adbb2c14a87760b71c77d287e245f98abd8461f9fbb7d3f777853dbb394657cdfe516235b2dcb3f5b0b63d981ce6ec061c13e47ef5494de2bc348073c10393d92bc419c2b33caadf77cc63f9a6387808a47a8f9afd"]}]}, 0x1b4}, {&(0x7f0000000b00)={0x1430, 0x1c, 0x2, 0x70bd25, 0x25dfdbfe, "", [@nested={0x1e0, 0x6e, [@typed={0x8, 0x4, @pid=r12}, @typed={0x4, 0x15}, @generic="366c0808e6811530f5e30e4bc65bc4b3f758a4f61e8fd75c910d2bc3ecd99ac811c2f8a0f7066051632fcc34cc40ddc269feb430763a2eed35380a05b75e9067d35fd85d122d842eba2f765cf7a4608f523486ec1985b36e494fae4fe4b29ac7ae2d0688722eccd856453cbaf60e225292729e52957b17e7f1a3359771aec6c8f1e0d1604934f4ac6fbb5d584ee9b1d9bd99e4b45223470b737ac1b6a47c216b3db1a1d025bad497bd1078412cc16c33ef959fd6d59394d43f6f29c5fd4ed4e4db03b012", @typed={0x8, 0x77, @pid=r13}, @typed={0x8, 0x3a, @u32=0xfff}, @generic="868f964ab3ef57d5c1a84cfdbb84f13ed759fd571614f18a7b296961af3964af08fabfc18411af6310a44e6ebda87548fcb957a095c52c41054b9afc643791aebaee07b4c50a964339a3f2769b23bbeb5e3756d1f5ff61389d48f2c6f9ed370b", @typed={0x8, 0x6e, @u32=0x25}, @generic="c01fa5a122aed1dad3360a471f1e0ea44c73f200a4b5e3c196f76109ae153e7ab1b6b16c9d27b9681d7ef769a0aab7cef2940e25d8cf1521b0c2e2aa7b3509b02b9ddfa5513745920946c22c3d71adcbb31501b83372222b839ef6a2c59ae002cedae3184b4c50c6d15a6b755b9827c2d472ed9f80da066cc433ae47700bf321a8e044544aa5", @generic="d6ff28ddae988fcfcb11bf"]}, @generic="150bf8abaf60662fd777d581c5f92f409bc63b2c846c6ece846b78468fb2cec9aee2f88d3b94624601d0ab60f39de716b59cc776919d221757ed9cf6f0385212428133b13bfc5e3813fe5c68348e525fc5ac8db3d21282a249b69bd2c75316159c5e23e9168e3d66e3356cd5cda1864ee0354e4e4eedfad5d09595863ffa22ac82decde1f823670959e5bafd72c86bb7464761e8a5e633af6fa801e2812cd6fc1998b64b992bc74f88d2fb145b0fd6a590c556a20bd7def117c8b8c4ea1e2bd05a7416dffd507e6bfe85b451a94c91f918eee70722ab5f121df115d1168c8c8691695d07c90ae0303aeaa746a0ee25575845e96fba95e261ec988cfede851f0b6a7321f5d57450b777d37bcb0da5b36b4095f61aea3a5398b8497d461d6974e059324763255eb9b66bc0a3042e5c78135cf059700e5b70e5a78db22233354fc77cd8a34f6970598b915ef8fea419cd3dd7421359bf445de4c8aa490f578c64130812aa4937c3515afc470db2e6b9de923f06c0d2237b3e4561a2f7f1e77c0596f32fa40bf7c335f78f28352b4c6c3c27f81cdb311889d222f760998007080ba55a39bdfc0c60d192e6c679f7e1e26573450b5fb039d136b257b627906c7015a646bf5a207587d464b1366e59e798ef05a3917f5dff1b5e23b87177b4f65e2f53901050f1b637eadac3d3a2826e3d45f4a40f60c7a774c1ae23cef9cd1e700446081b2893eaf09f928d8977314f16cab214b0354d3246221c6b8dd434ff7fc8deeedf8c99e0841b5667932c95916ab93ab1b39ebcbfbd857c8bddae43840962e4d78f9ea0e01a4f918d88d2066dd9fcbed252d8cb2d1808e95b5c6fb8e007fce248d0eec2b92674355c9d2b0e0887cdffda433e2fb5a691d6c6748d9c64b5828c753794fb6785c140160c02eb8fcf93bb33bba535a819da8de42b1e26649f7f7ea92cce162e76c2e62154c8ce0e5a68d152e8ec8f0f8e031b488198414af8f802d268f5763e76371ae8c48cf431f2bff6db940da80d6f5da5fa47bdad54094572e3707278816724b808726eea7d6115769af1f8f5d8e9e75983c5b623af453a5f8d5b5bfaf26fc34a811ee254dcf415950c5ebd336bc8e1b65b454e614f7be625272a90339eb1b220a11fdf7d809179e0cdd6e7ae44409638477c6442211ef04aa30fba68c79feec06732244e32aa60bb2ac1ff5936c37b3b291987b18b8de46631f447ad407ecf7fbcd7287c5d93723c783eebd8fc0dbe2d7ed9e449777d67263221a7638d6f5dfc966979bbf9ddc9de7dcea7a257d86a69cdc82f3620de970f93d60a0ea601a56cebdd29c33f31dc56c1bc858d5b8b5b8b906a63205b736e70e3fc31245261e9ff6256347efa288b3708923b18f17dbc99bce0b574713689b22580a0056b4366eccd2f730a1a90313e8fbea28b0254891c18a2f276f2890770af57ed0556a97ccd1ffdbc970614b87f6bec0b95cb29221b01a9ae4fc5f29a5c54667f33ba3f2d93edc99f36fa3f808ab6a788904efdd46a9219d4d5dcb0e40af11ec89de62e1a5a0ce9ffd27f6713955a04d662dc884e128e60ff42bf36f169d65254ea49d55508c5a14bd6c7563ff81767427af3639a3b0d900b27fc2572601c04d7cb5d176325c0aa6e76b331b718dad1de662113ebe8da45acfdc55bc2a16e1b6e88bca769f8f1a0ce9c0f1c9c69626ba23826aeeb00c85b950aca3b142426af7e3eb3cfc0b729bc786ca7287248b4222ce6cbe437af73f0f398347cb5006f9c8ea39eb3bdd2a6bfcb454305f2bc6ecab6481e46d14a17ec56d7a9990fdb6a5dd5d002c53aaa71e17001d05a5a59589be7fd9359c5c54fb83e0790fe168be861624a0c03430bdf8e9de04185e876f1620f8ca218e527dbab77f34040b164fb29200af773b5dddd01035137f1267efbea14a087cd889d1fc20caf17bac7a0f0b5ffc8d1a0d3cf3171b5dc37d4ccfdc79485bfb22b8cb04e14039b52ae7c6723a89ae02ca6833c5aec0e8cb87606403703b31c0bf350aaa224ed9094a47c5b279539a50510d3521bfe94dea82617ec626d75a54b38e2931278515a29f383ce5eaa18e2b6f62ea7d7f0d7f29d3c788c6312887b4c72fc3e910d05f0e90e4fa56a5c86b95628e0ce18edabec76fd5a32ce173fe67b081c8b9bd5f5ec23db15859378d95c4ac3b2bd2741b0950885f0d198efea315b5e50ca14d501cc753fcb3e5689bf3a5e7c58271b833738301b361f1d247954c7c89dffeb95020f17cb380ef691677ad00904b3574eb69184717e41239db5225e8190ce7fcf77f6da3e61d5d6e9ef6a4a039ba89bdc5a12c3d039328cfb4acaf1f3bbd478e0c07bced231216446c740ffe0be797aee4afddad339330fab38e9dd001015562fc1ea3c9d80f75effa0994a264e5c93a2f76df8a839d760fdf8162e542262b31b415315998fed3fb758bf7aa141a8355d4f18b069ec9a35a0240c4651313b38e318d418109d95913adde593af98bce9ff84b822a1272a7648c2a8cd4111bb13c5eb7148389fc94e3d9ffc8de5010e2b69710508c04577f135b1000a35c37b18bc4b7ad11caa1780162e9e011b167a868d41a8f4e787806182708b1e952ccc170e1c6bb4e51ba5bbabc81807859b43bfb6da46150987a6d8add986c0a2531c9fad255f2b944de89ef96eb7e8982c01aff0d148513598ba71bee683c40fc8ea60d9e3ea11da5b2293ef4656ce34ff9b6216c00200b749228473d36a58e4079924f1e18a3d8c37345c2fb5305d93dded165980f8dc621c7be2739f2767d3c36e1ea0510f27bf48298d5fc6cab6012354d468f77928e1975681c4760aea065190bc38f8a2c72dd01043d08050b2c98e8c27476fd14a1e50d5994456e9d9e3593be1d690185d9ffd4fbfb0edc8b8a0942dbaa8a493975f250136c3e2eb346f7913867cc39bf98c8ea322091867f638dd9b6bf0afe9b74aa90d2909927a10fe5aa7888c7e2ab7438df2dce73cc6b3ff6344bac3fb93690f18eabcfa91442123103618b5a2fd212a8f1b1fb2092449735f7b5d4f432ee51b65e5d8892ac916386340d6b0bc46871c73ee4331f844001d36e36e9712130647f979460d430d1f6b34ea306526d8ce38c540b4ebeda4735c985fe8da8366fcbccd5bd2125213b1ee615cbd8e505b373e37f365d1dee92b027b5e4a78b315df60f2d525d82ab8be71d69b3495e3c64b5903fb9d490576eba980cc7e0735d3750060e0bb7bb95e51c3dfe4bbe831ac6ecb16afd439dea10f273fedddd84388c096765d4db8c61c1cdb034748fbfbb92c264c64b88e835d8d7618ae71d6957404e627c34346165eb82873167f83c4c7fa55e03a4806ef2529a8ba44a60c45a0ccde6e043a9e8f0908c5bb770aa53443cb08d866275cf61f2922313ba08abaabbe66a28050d0b2145a0dee7738a9ca154b9033e6fc07272be52cb3eace1859b02e0f9cd471b4bc17d92cea4ef28b02c6f921ecb4250e254a92bbaef4a10bab3be256df9eed8e72ae46c779370d0d3aaefa4aa56c5440c93aacddef104d8fd7a190cff8a8b14b55a2f9f3eddc382e63c4ef3b8385c56b2ff8edbd0c39b1f598e47d957c876e71b35d5bf343a5bd6092735fad35bd0f71ac16f22fb1f63e3ce10d0e8b47f82274614575d2955e8e2fe76b4809c003bd13827d1e3f2fd8af3f75249bc37dce282f996d64df06d4e669785ca1d5f66a94c497c92846b49b5def550fe64b2a797f9ff0c80883e49c1a3725a23fc92d2eb4286748aa9cf2751fae38cca3f00a0f2a0a482b8ea336b8b76425b3374c0ac48a6937a94d37a95a67e7928260f49d5cef8e81382940d33b764c4311f4bb0178bcae7b70163d71a412ee1e6cd6110ca8afb752476ea3f2c7a94408cd657171fe50f6b2bb22a542d687503b20ca5f2f7df57e0adf730f1ec6c109d55fbd03be3cdaa98f55c030d75b734a41690ce8b5c99308794e6421a73d9fd7cd661c42d530735c1626baf3522b7f41c68f2f2d0808cf62855d04538c6e858e97184c467eacca005e8d47f131e0d64144c7cc3adfe5dbe7cb40eff4db646d9305c17e9fbf1a172da68517e4ab84dc1b3dee5d01b5b1e64d23e98c072b70848f9bc3dafcfaffb25d41fff04871c1745ebfe638b6277be67b448324aee33a711b6865f2f054c29ead67d5a1a751a78f4cd82a995f104d0ba1c7f0d1c14e29dd2caf8cd7402fe663deb4abe1e4847a47bbed0ff062c03c174cb78335d2b47b494732e975af783305a6d67c69a0de925163efc73407f2c1ce030b0cc9101d7a80526687b0fd452b841daaf00c26f9eddf1bba036e5ad830f096c06981aa7ecae676113b8bf89ddad8b9530c0a131548484b13b0bcfbe1c2bee50b5ced332b5f39baf0c0d9d5995c49999c313af464d9fd5c2f27e844ef2ff720a3578034cd6a0e3a0634024fc0a4510ae0b8fdfb2e8d5906778356fa262d8ccb8b01785a8968e46e8f9c9b93bfc522926415183dfe69ac659da94f22f51d7414a2b6d185a6fff15bca07eff9b9e48e68f862c35486937ae63f04296fbe7df2381bcbb4a87c381108a97aff8fc9a412a36aef37865cac18323b95d802b9ae8553a6bd2fc5809fb16d5e2cd81e9074657e95621f2747d4298213d5da7fbea33d4dd2651f9f5896f6771727133ecc7c2a06ac5844736a846213d4c67b4e5a34ba0655d330df626f39222dafbf70d395de6b06d7a7f24e91b804e2e84d97a14d912b00c1affcdabf8c511878212dfa31b971a12d02300ab3b075daba2009528edb54790f4059bb26e2d3bbec2ba781c9d987756387589040b450a4121db81953adca5944daa439cd65276c94c62b2b9989a2f246f5cb8609aaabfdbfc9a39b8e27a8ef6869a4ac83f7447ee9f0cdcec01ed2a1eaa703667d4135229642cede95cb5aa9e7579fb8f42780a7bda3e889d6ab98bd32b05f2d58544ef6077cb541aff2358cf6f762f6e03bb4f61692d2016c0cc7529605a187f4fd705397e3ff9977f0aa02b9100362b8ef91e705c52e425d51a522740c7147e8e3cfa1b087248cd71df2f67d19939c48b012a0ab06ab35be136eb137b7b45aaa2b26311d127fadeae196ee3ba95c6e98d8ebee5797c6cba6f467a76a618d8f2c227c184d8014efc835c47e6a3d1fab8b0516fc8bb86534d7ac854485363a469a429dd72a4704d7715f9af1f70e062276b7c68b2f0bba92f10d00d66357f0ed811978d72890a7eeea7e94ffdf7a202bbfc39a6cd7946200e527c4d92a5dcd7ea9e0266b672edffdc6e0c22a221f756e74b8486a25e502732fa0ab12a6e3862c12fa9f03fdb8c91516a1369a368d3ac812c7e3ea929a3b7b6442564ba533f6cba346d95e453887f07580af7d241caca17850c77842909ce327e0e80dc60e9797dd9e2f96117484ab34966d71d61c88a958f08c4aa14050c89e7a87e22e04763fb47beca878aebf5aba12ba2be1fd38530b1789530a3ba3f4126976f80e63f130971aebc1c8d7566908f4c6cdc709ba2386a339a42c8b4d911acee11dc2dda8a40e9ed9dd78da139aefdd0258756598aa80bd6f4c979b1a99b6dd667299ea5c97db7b99aed9c7ac08241c0dc2856032af7ad231f1f9568bd9a75b1fc2011085d3dc349e558ce0e7f1db39a0d41a8419f3607d9c13970eafa8d64e5526b27aafb522c55c5a87defe5520faf9f0ed4b1c5492396634c928e3629fb8937d8f02134472bdc5a2b43536caa30c31beb449df79c3e7c4c24e1307480f48229925288229e2ae735eba116f32af8189d06465c78bbe5d45ec39f9fe5a56", @typed={0x8, 0x3, @u32=0x1}, @nested={0x234, 0x8, [@typed={0x8, 0x77, @ipv4=@broadcast}, @generic="513082842d517c6a20360ad41ae4bd6b300912c6a9202901f186f719b3bbad163ad93951a3065644ea2b501824af0cc55f375579f054203e85e3230fd1ae5d8f39102abf42d5a6ef8d5e1749047a4ccca21cf558f570c76af1459f9253fc8cc4772413ef5e", @generic="7e720d45530e6cd98aff20bb10d9f2302a0df215be9e617e260b54cab336fe54c65a9be52108713f4d34b99d266de8518b654270f06320d05d47dd389e6d0b108fc47117cde134b773f7b02ed2080c299c3717361cf167e55c1c82c7895ae9532cf12d10cd28d17344b89a96f7e12a189943bc859fd25b942fb4eb92d9855e6143a5030f15fc8d678a2d5cfe5ba8e192792e02d2e6421120acb2d05c9e9d54c6b73cc23b25ac15ff896ddd23fd7d19f4adb1d3eefcfacdca323ea0a9a34850bf13660ba24e49281fed5762e2a99493a0e52b7c19b79f36eef463ae952e6b41c8b633a37dc9e46888703649", @typed={0xc, 0x95, @str='self,\x00'}, @generic="9b099a47c3598c81de3675010b9b170abf9e5f22ef8a9c68a8c4c9aeb2cfa804218d049ca0baf38ba3fe4a71a54aeb6275359cfe6ee3d838915078a206972a52124a940c70e356bd7a8db3719ffc09e64f4abe2901f6b9837d830a06a661b67d1e091256923c00e035762806f6fdeb3aa0d6e71b7ef726bf6850b9bc3e85a0774212a599cb4b827bd03f2512ec922b6c8866afcd900af68d40a071196d8346af64cd75f374d0d4f6924a1f86621715ca430a4a6ecfaf25b2f00606abf178afbf20059d7e839e2e9805"]}, @generic="8e"]}, 0x1430}, {&(0x7f0000001f40)={0x1ec, 0x1c, 0x10, 0x70bd25, 0x25dfdbfb, "", [@typed={0x8, 0x87, @fd=r14}, @nested={0x110, 0x0, [@typed={0x14, 0x5a, @ipv6=@rand_addr="30285109fea50bc7deb4b9727d715840"}, @typed={0x8, 0x6b, @fd=r15}, @typed={0x8, 0x6c, @ipv4=@remote}, @generic="30dc45f0e9ac5b1411a6803547bc87101a22f6dbaa2f1fc64096f34105f811ee0749e86907b480a341d2e3d3c81100ac8b5840b325d6bf44d76eb4676497903d4734819ed772c51f008743ff1d4c311b1fe2fc72602e8b01dd3bdc46acd7ab01a1409141acf71562d10ca1f63d726c570b3e922ce5f5d1e89ba1859ef0acdc0538435971132e98048c9ce5c7288ea6e4c27f64a2793c0260f607fa16e62717578dbb34c33b425763606bd3843b85bfcefc2a703b367896576d1d46d56631e3312689ed32c23381b6365c23b3e85f6ec8bff8616bc60a252adb25fa7b18288f526c8a40c4bae5ec"]}, @typed={0x8, 0x1e, @uid=r16}, @typed={0x14, 0x58, @ipv6=@empty}, @nested={0x98, 0x90, [@typed={0x8, 0x81, @fd=r17}, @typed={0x4, 0xe}, @generic="be76de7d361f4d81339a721bc3b4315c69d0e02f13146295db3e9e8372d67ff6b74fe2226460abd37130f50947b6b95112c059dbfffe438e0b00e357c6215797a3d368498bc0618b32744d117c03c04b71097e4c171d4a04b4972369962320a699aca95aef5a92bc7b719db4d44c020d0879cbdf3fdd2d695063af922c132b2c", @typed={0x8, 0x28, @str='\x00'}]}, @typed={0x8, 0x7a, @fd=r1}, @typed={0x8, 0x1c, @fd=r3}]}, 0x1ec}, {&(0x7f0000002140)={0x470, 0x19, 0x6637f51314d6f80f, 0x70bd28, 0x1ff, "", [@nested={0x390, 0x48, [@typed={0x4, 0x31}, @typed={0xc, 0x16, @u64=0x6}, @generic="a55a843921233fdf9b45d3f2059968c8ec5c0261ba3aaf73097e1af7b0d0ce76bcde6b6e941980a3d31223c2a84576a2b0a107952f6ba2b2c4e6a1fc3d3675072c08b9ed7c1a61d8af2dbdef79a2409436d010f9f446cd6a4000aa88e9edcd93445efb864ebe075b01fe97df3e90ee8bfe6c182fb4a7de58a244711f6f79efe2d6bc99becfd0f42efe7f69a756e11d190ab0fd3a5a94cd54bd6e4a71587deb5ee1b8c52f132bde795b1eaa89876d", @generic="53577380091149fe44344e18a9fa63fc6c60a888cba70d2ea111fa15378f37010252ded9301d873d0838a3f9a349ffa368c27e6003288101b57329b214492dd1363e0829c173ca530a579eec4d3fc20f82da01228f7540008cc7cfecbd1a99a82073adc87490c92060ffb8de7387f5aa9bff6a2b81547c6332a4cfed443c57a84a0e10a8c40bf56e581452f8e370ea26531b8024d4f5419c88a04dfeb551b9ec3c5092d84c9deba5f24b85fe4848a9107a046c3d226f4e28b6de28be093a4fc6dfd1174902ef63c5d2dec6f352f284673d0a9ca18a26d40ff1269483cf25c25306b1a30585", @typed={0x8, 0x78, @pid=r18}, @generic="76905506d7ab17ec29eb649df6a1a5b773f77c77c00aa429b8e3aaee8e3d723cb7df6e0a157dd5cdb416a76df13af365f98864b1e50aec5c4a24b74c53bd4ae30c875f1096519bcc1a46956bf8fc5474fe9498da42e2306646eb7289fc0cb463e4fb2864c2e6b05874d8be9f9e681cc406055fe34b3d947cd5c6810140a172436a7ca33c34968212cdba144e61abfdd09d2f7f909e5de92ae28ad9c3ab5b5ece3fdcc806e1356b731643614f338c7264f614707672b5172c393079e5501f6611340613dbbea7ec9579cd42ad8ff88c7ff72d314e6530c9a5c375e894860b", @typed={0x4, 0x16}, @generic="d751cb0cf42dbe675e3974feae53e7e8e95b7c3403879acfe62b65a219c081caac23d58cdb5495b272ed278244db869031b6df10ab2b67e8fccbfc55c95d082c541273792cd9e67203cc347f4fc4d2570c70a9859f0c79d84019b86e28a4d1a8a8c5c44c8e24c12f142839f01ff3656a975952eb0c5a4bf479648b20c0a1a506185f505bd1ed8d8ebd8716e9b8b4d6f854c508583ebc7b5b1bb9defe25fbe4eb72e6d33f229d38be0413832d3e0075f42ba2d46d88ba5fd0b37dece277aff99a20ddc1b7ca2970aaab73a20a303cf0a70b0d17871e3fe646e14d9a3031c3c3a65cbcd0067e073ffb69f9ab71129ad435e428423c42f6293bbf", @typed={0x4, 0x200}]}, @nested={0x4, 0x1c}, @generic="7a5b53032cbf84ac9c2f92fad680a141aa0a1e0fe144cad7c9bc197303a6a32456851637bf0548372e781598f3eaac4db68ebd0cbd23e94d2d2defa819241c325f70b8458b0ec4f619f803307a3ddaa187653d38ab8f0225bdb01f391aca233a3bad58ff8cd6e7c0981cde8fd6c9ac16fe74ac5d0f79affd14e1bef7cd5b714fc25b43d32e84dbf3a83cf1dd2aba3d48a9d8a540702a52e245c7f7f946e3d5733805d94aa9ee253a54e9f3bf3baeb06aeac6179ff076de84645d7f1b062679b1d9c91f843141a99959b4ad11"]}, 0x470}, {&(0x7f0000000540)={0x24, 0x37, 0x10, 0x70bd29, 0x25dfdbff, "", [@generic="a8d3da9fe0541d49ecdf3695eb38bb31e3fc22"]}, 0x24}, {&(0x7f0000002600)={0x31ec, 0x3f, 0x0, 0x70bd26, 0x25dfdbfd, "", [@typed={0x4, 0x95}, @generic="510cd4eefb498b20548c54a0221b3b07c624b492f37878bdac88b347047fbbb40d51db9abdaa2c443961abde025380657ec574706e90a3dbc44f83ef6ad3f4c6f61fb9ecae9b7f82d0b26d50c9d2be9f82f514fefa40a9b3d9d6b72a69f43171fa3457c1c62878537d48ae4bb4ac9b62cac6b721eaf25eae99ce238aee8cbc45d50797a24d2d123bc8e18aa5ec4346ab4709fb5e642ba2c0b117838b7cbcd077d814073f96", @typed={0xbc, 0xc, @binary="69aab74fb7ef1df9a7f39754bfa8ede41882ab73d38e654c514cfa48b2c446a781318d3a7093d10a2c648e2f300c167de8ad2693cf0ef5b6d46bff80326b8b2a4f5244759ac6f430b4aed5d34b6f6a359f8bb97f4597392f5d6429a8f94872f682e748350fad0f64165ae2f6d0f53d117cf6bd33b318cdecd5bc99a2cffbc70dd753dacb36edc1d6ecc8e6fddb70fc2a0107bf6f7f8e7d72e7a69c183f08ddd69b6a1b753f02e55b85ca08e0e66562c6a84ccfaba2bb"}, @typed={0x4, 0x5e}, @nested={0x14, 0x8e, [@typed={0x8, 0x74, @u32=0x3}, @typed={0x8, 0x4a, @u32=0x5}]}, @generic="e8228879a7837b1a0f575d07700ac23a1c6fae2c6549748a2be827d662836a7fba49dd9ebc838aa471a7f361275d2f8e24f9d6dc1cb6a234c8eef5e378acd80e3a77864e32a6848256319b77008733c2800ae8f28caf281ca4625fff5def9227f87d055835e07cf82523ae18d9b66fc2cc25820cda5c48c942daa043d10eba48293022c24ccc5c1ac95d86288a2df7fb444cf0cd2e8b26210e9f1b1fb5c7e207af6547f921e2c3fc1266a8bf72cc713ee8fc6df9ab3f090adc4050edaf037acf01bb6a0162f34e8328a73e0971888e06b0121ea80202a0698ccd01629f1b34c4a955506e0863d5c61ca769c65172a74fede8c35364f9cf4ba59db1dbbcad02ff623c35adf7a79fee9ea622fcf0e17acf8a9a90d94379411b9c056b5c02b0b47513f227d9955a7ae5856040e99c8bfbbefd03f72953691fed6e375f144c19bbde27f31c61cba872e709cf859731a5be14d71c012c3b76ec2fc95f2dfadc2b2af373988e736f49809ff5b8699e96ae250011effe9706af97e5a3dd726607f6b016b6637941b5c841614ced4d73d1375b0c952379d5869374de4b5697f7bc5b382360d27c21d945090fcf3432ea2eab7eb673aee57a64ad0c134f57dc438566fc26edbecfb8681574a89696c09584e932d7332b63634ad4e9d16a70dd4eb780eda5609208ef9e40131c604900b47a6c07098143f82069d071ac1af673a0b413499318d3e59ec36124d052650d306a391feaa5fe5574b6d47d3a58b91c62ffd63d009a927b773fa53fea676cb10e180aae81123af60cf3a669d073b1f40863a73e82d571659d783890f72ad9867b736fb6a88fe680f00bf350f9511912cb927e5fa7365f95a9afb690fc8727679d059e66476322c5f4bde3d4ab881c8ecc22012de049ef8eba1b9153088d973e9ac43684d40f8c4095f857fc094f41d1c61faa4696831c72ac7b0a15ca10e7ce987fef1eb92e48c509d00161ad712e3390dac0d2773479071a5ae0a53136fd6fb5f9f429c84b6fcbaa14b1dfb78336d991a43f315c0856edb030a6efb32ef198677cae7c31f25160377bc56121bc7c69b67b5c74b66fc83c19032ccc8413c2b6e56c2652318f85cc91ddcd6b0011a352bc34e40820a50f00b8680558a5e197c38dea8edced12b93b7d79e00fccb768ce50294dce57d663a9fe70c86d8578dd78467a0bf72b6a99c4c99747843695dbb54228766e18e5c4947797aae1eea0741603ac0c4dea42c739d923f0d22d02f2846a4eb9137a3a8bfb5a4e38c8590bc8062b571ebf2ae44118e1243a7fc240ecac8ab37f14acc72ced0b3e6a3f06d9d5d9026bdebe1db28548ad22683ade2a3de2aac4aae39152bcbc345350a15765dacdc93e00c1e36632100dc9f1c6490fa96477acaa0bdf2cc5b1817356122ba5d1aaaac9ff4cc680812b7443a4843b0ac6e954c3b5d2dc046e72397c84d43155ee679761fa13e7645443a0c60f3f1bdbef063b4c694c40f05f3d35a752760196d138d7a567bc3c4b09734a8c52d6c315bfe67b0ed7333d801ba8d9be8dfd7015b81d49bd3057509bce8412cee175877ceb7d2d59c39e0fff5037882abb18d69ba20c1f7c486014173b394a4b15e43aa8bcd615d9e90de77dbd3f787e62db399ab3019c74fc3a26b53097ef01b7083c0bffd069d396a0959b49de901ab431a99bc6681ffa6a28a492481df9ff8f64901feba06b80cb86f57c482ef764b365c10692dbe7492af147b317b1791827fc2973f4a7efcb6be00bd3f4ed2b9f1df954e04d4328ae317e1b6c6d5aa9d86f5f626c7797c9550f96cfe2f22ea77f586f9422d95e6844e16e0025c978433ade31465f897f4158337147606b6f9d816c4176194ba50030753297b0bc0a52e7860af9387063dd17d7c3c49239baa3f07b0505b5ae26622a8b08258ee053239f20afb9ec7f6f99a631e6c619d7e8873f9b65884a32d1ea53acf52e94cce1155596bc2979ee5f41048468062417f3a14fa4bbc6d26c4ac0a3b6d61fa0b83bb9598e2f92a269042ae9435411895e2f07b86e3d811983454a74cac20a2e601276d89eeac7855108919569830e6926bfb4a3e07e040535ee4c78ceb5c8bdb62151e836e167b48afc29a05da52bd2af72ffb2e08007f1791ffe0d8a96c54cecd511651edf39408cd8f7a7c3de46475979991418753838467903a8132c49542aa0500fb93799d2048423122773c1bde2fecb94dc3597212d53bd411917d7797179388f48b550207dc252aa3c555e5c613d7da8fab2afcbe21b2cdd639d4346bdadfe4875b70fcb9e02e917fc670c940119cfa7735104a85316d093b9194a1b5c78af967eb74178506e1e539fece68ed1018968cc9753fab2c504a8c0c1b410976180f42567d185b8e75898d7f3573a4892f94656fe454bbfb3c15a4193efe00d70fee92df5b96d97b19f0e13d9c15a65e83d32f075856a917184d9f67d9b49a3700bc9881b27c1db4bc83685b63386fc2fa0b4c3707c1bb5277125db835a5c6a9f73b7bb1d8b07c2e3f294ae20320e2b7df0c597c77b00a9acd362d067708e6552782978a99524d8b1facf2e09a99183220504757b3e2badeccd4d036f27d86e5c16f29005a98bc81d1e292225ebcb669c1856899c969e63a671842957c1ccb70b16ed075c1f2663ac703b7333803674652c56b70ad9e92a0646cb86fd8dd60d4454aed9bab18e27946f0404007ab68afaf91bd8f5d08d1e509f9486379ca29923e81072c6d0c35d8fdddc6b8553edca3b52fcf92b1c7fac1b11e4a1fd82378e6c3119f60febc4ba5859f24007acc6c894af9a4fb640eb3f81044c03426d8d3c7a3ed3ee19ee73c9d2750942fca2b33d44c0af854eed930b9cee7e0da556ecc1b5882fe35613e51fdf11b47aed0cb88c7157e2f53c370f4d0d58bd57b84e9220a1558eb05f4ccc083a423ce5ded1974d19f659a77daecb132529c885f7c65fb3d50a3be5dd2fc828d68d2af32f41d74b6e0ef77298f723abc72aa8bfe771d7a177023635c3dd23765b4e34626f9f1b45511f2e63409565a066548467bc88abd6c575e68e51dcde6d4d196e3e47ba6fd5d8d830e470dbdee1e4d6891cdc7aeb2fc38941d128154e5071fadbeae594fedf17cbe3c22291b3de8a6d4079afcb119bc884c8b309f6ba8196330e4bad9283515d13a56bfbb73edb8aec120b8b22093f782b2e51902e90595dd5a438e9d13f8fc5e20a6a4114a139cd7b35cbf70c3a14bd39e61656d4a57b6434c67264e09f7fbbfcde2d28a1d298e03a524869cd1a298a5a84d8aea9cec0ec1b6c961813b47b5dd3460336c9de3d8d1438ba8028740858e37e74ce3f8a16db5baf7fb87dc38e5489ceac61f8e5ef99fc68ae4d8bac76be26c915fe9fba079e5cd9c9f1f59c54923d99fdb1c386cf49bd1e9cd3fe046ebd7b98d8f8656e179b35838d104e0bcddbc9ea61cc7d8aca3a9b1cdd652028cbeccb68368efca4fbff0df8ae07a7e188481912de68c779f4c1f52432acb14c09f504d340e249f45f4fc5e074fae54076c71f3bd28df221c1c861b90bd9849fc8a60ced601c89ded34a8ff0138641ac0339940323211e4de1f9f25bdbd58c6a6378d555d13b05723116a9e7ba1fe5d67567ba321132d580c08c48d5c3f59c6e0bb0d5f2ee19ed5b2bf2d37a59f43096afd925a93a189ae950c5391faf04a54f2fb930c260f2a992b1b29757355c3365b9c80868cc61624a27055a6954d5a43f7817836d24bf4718c5004e7655ba06171ecda01b054c0decc7605bb3911784163eaa21edf84a7dccc11286a3fd6d6a4c1e6416221686c478934164bb7a537002e0d817aec79195a56157658e4c1f3d6b97dae33e012db2a76b26a8cce020df49598a7e4fd6bb8b3ed443f55794d1c7f69e28246714d548ea5bb4d32c9dfca5bc05ebaeae8daf6b5f6fda37a001c6495978a0d7f15d3bfa6ac3a9d3abcc8d7171708d7b662c39706ebedcd4dc4070d36b822f5b987862eee4fc9e5723968630809ff9306d3c08ed5716f39b94835579eecc1f5640eda557c8e61805df057cfe6f0eda07763a69a9f446256971098143351512c49b047494e3602ce8624e41974823f2ae1ebfa106ddaf5bcbcdcd347523fa75f5b196c592dff9ff5296e023d52fa2795278caaf1bced9e3cdf1cba5cbff7412f12523c228bb59d54b402425e173a501e38af15511db54eff0e373f716fe566aa6c310c076843e5dc013dcd7cbb32abda3f93ca0e7b945c8ff71bed5bd34dc96247c0099415b879261922b92d636b419c0fc6079435f859138603dec077398cfd60f7a0a3a369a0af7140622ee144543090e8059e0f56ad0a282b3746ef9b9899f59cef3b26430b3000788f1bcdc6186029b7ac1574e33c17fcc1e7cc7a748be3503fb2f29af2078ada66e08f44195d80db65d77842b1275081865472901a8a2de2b9858b68aed3981454695eca7adea6795d709e7c5fa0a13a38133180db0de25c0519521c76af8318fc26aa281d4d068e4ca8321bed2cc7aac8b10b98408c7238d9164986b9312037cf571f4fab9a4d45117cd54da6ef02c809d578a9b3cad6ab0ec54a038e1ae5845b917368f16dad8cb8357d83c858cd416cde2efe981cbd8a945498caf1aa07b918942ecfbdffd841dc77e65036e0e355eff96dff49acb3cd68325f2d7a0e94cb2b4adefe84caf7d9ea010af9b8eff994334438d85ee29810a3c32014b1c139d82a293bec88438d976145a3186a7250b94d950e85a0486ed1770c2abb30307ee1dc8c438cc93f66cc2b2668f99895718ae6cb7616ce26dca6af257e148d4e621d5a6d6b9998e23080a6408c77467c115c1b519016ed60883dff8c6eee364522eaa29b2b4b706e04b62c83eec38bb058cb5e43b586fa02b105689224b07d6d7ab80298980c85f103e5df63a58df90fc830cfd39a60a0c7d40d8c6abb1b40656537bc134a0ae8debcc2951f3314f94ad7c267a2e3a31050b8c6e911537d13bd823b439a3129263d344a25860176693e79247365441600ed022a8dfef39bfd8b94f5984e10985f57e562d2b950046c791ccbfaacbac4553f2738e5e1795eef94e12751b00f7b8439222beab23ec46141b845c585fc89a5ea8b4d90f56b5b91809b83727af869d73c5834e90b42231443c682c0ad037d09b6a05e7cced9d29a4816c1fd15bcba7b0ec7b4ac4d24d4c187768d54a15d072232e7dd7fe176df72868c99eb372f663f4d9a4fea1501521a5e31e4c26f05afc763ce34691f2ee0db068acfabdd97ded47aee16ecd0e4d5e7ddfef11c7528a296b3d3cd6b6adc546191142caa2e9e153f4741318e2ae71abbe1afad4afda41518cb2ab1dbe72ba9c47c63c3e901daf0f016def56f2b2d4099eb585aec5f2281a5a8661d507f1cbab78966387b82b4ffa04e2223a7533c9a8b00539ecb10f7c4633602e4281cccde1f520d685d7e15bc2202bbef7e536531a7bcd64e0580aea78831b3b680838d306e78fac0d9f445ba797e3c67b57755923c84e68b7cd07a32168b09b0773828bc21a91ee1ddaf9b983801908a6f87c882b293dc4a0635fe1bad131f6b77cc51e6a5fb6f90a6908dd55aafca49131309e151d34fca2ee9ccdfae9e2f014c14d0318299400e6105ebdedf3e3ff96ad218b7764c91719b11f455f5a1218d4c5af5622449fb495e880ec194c7447a1de7e222d072ed3f7e4a357b75c78540cded091d5fdecc4248663914831d815735cabaa75a2d47b207ae98c503a12c479793dbaaae04935ae3745bb872b98e3570f5fd15ca7fca261c15f35", @generic="bbe8e526e8d0fe0381fb2151bd0931ff8a7f35b31b628f714650b4121361ceac9a4f0d1d088ff29e829e836a9d4d4cc7be93c9209e66ee79d6e362e0a46977ba8ba56b9134", @typed={0x1004, 0x8c, @binary="c79c73c95253e75199e8873f0c76f4a866be8d6a817a3bb3dfa05a17244cf4f0a2db690c3285e313526a31a33cfe5fd5b4e8e7eab71ed56b2451753941bf6c3081c8e37e475491c00ab7482f5958f9cbcb834b4b2ff8d0e8e8757dc7f64bd65cdda713fb6f99ac75feabb9f30f48ca4b46b84b754b95d1cd876ada064c910076f55cf3f237b81c39ea15e0600785151fa6664ab95bde4ecf39f9f8d6d4fe1c809188c69b3889d05bfd00c26f26c4676f9a05d5a5ea6ee9c7454ba2b32ad08c5d9d9757d2a7eaf9d730d563a24abcdc1d49f2f0506328cbb0d76e632114cebe038c02e127a644774c4791ab85f7d3ad9dc58595cb16fc52018f0eb2dba94c9af401d83539e438160458fb151dc0facd015f936955be722a6d287b44495f3735eb8d9d11a7e64fde1b0bea8ad29b40885df8daae70f3c232f1b296c6d83a1fc4da2d29420bb205878d392bf596a1f15b73a30453a599d943ae9a0470cbb073609fc3480c76746dbd714b4756389928428dd9a3c67d5a2693b7de06880e9e0cec5c7d765660937f9273bb2337d5f02e821537425f0c1bcbb9024949d2ce53eb84abcdc8f1c21d24f56881593f5831e617f04640dfe9e0d83d66437eeddbbc9a0c084d192702ad1942e1abe8a35a0fa225983c6e282cd094ae1d5e9466abd422d1507af59c65f238a4eb2ac0fab45c2793387dcabd8b08f07a26848d4c33b090b704ad2557f172139fb3c2ef430f54ef0783da28c10538e7ba1125a9b91f4fbf844c3713afcbe42fb87b213b8ea5180cd185f8aba5a09a84d17d9f7687d71e63ff1c261878145e6c991654933a3050f5aa6946be5d75e8c9ac732510b88e3660cf230f17cda6f9812add9721437c42a41bc75d50b28ef1af209d11a55f7b858e18e46943aff9033e39e52210a9c40cfde2a14464610d7f69ebb6c4305c79955c5f03dd1ac1a761ac8bc4ba92792c274cb6502f181321bbee0ddeddff2035a30843f4985a3b4e828c4d3c11fc71fc2386e652c1998e72977fe6c94c86efefec10181af52f605fe5eccd99323ff56e30e94278b7c4aef8434008dde52397ceb278a724c04365f515d84b772646fc72f717ff510982cb42605cdae4ff65a26de0e14ca51a31fa68ef31bfebe7884c03dc2cddce3e276313f4afdf90e9855ca274d7105e87d9d24ce512d1190e4bfb7fabcb00c4a1bbe38f11b06d2924076ee47deae9ab427bf742adffce046f3b2e788803622eb6796d8b1823ee5358db6ba2b4778fa9656ff899ded0cb2c879c78fabb0deb10bf17b3a2bb362fec7ce8e8e4e3d0d80fca8770131206f625e2b9c7fe6af0d0030731c05a80a45a26c82a5e299f87ec79983b8f878e786059263438ba5ee6951c975ed8967516442c439a0a100910e263c917fa22f22af2a2ec845cdf1e6e25505d553b7b2a9fef17e3050e495ab5950f40a887cc1c39a88a37257bc9b5ca69ee65a02d45cd533f8ef51422b80d03204d6b3185795ba23e86cda2c0b21005798813425ecbfc9e4e1e7f4e342126ae7c57c3db8c554b989b0a50e339b9c9070f8d284465da3c5f3856a75a7eab0f62d0adeaf8ad56a3b06430186816c3d3846dc3d40380302a6811f3ae295a7d380d509942664552bad19e108ee68184ae86fd88540b10931db04d6aa20f74965dba291128382c110f554c847fb71939da8e3a1ece28fc58ddbe7a1c359a48fd5e3913e01ad4d8b9dbab82f2470ba7a0cdba4f4aca4bca8136af1572ff85afbd4876cbfe5f4757dbd4affc663ced5e170debb126c82a25798bdde0b6d348fdf13c7e71036a1efc9c28b663a9a95c3135961005c42853ca42bb2918868a585b1fd1f8be0148a1eeb0d21b8f518a6711463ff356e1e6f9a31df8426b8a0dbc92acc3281f6fb874a243b7c938815e75bd650b6826331c71d3d0965476812de8b2ec31712cd0d18d3a7ab387d65f9ca4cd76c30eb4da30b63a0db37d956396bbd5f6a4202a88f5ce6b7061ea53f87cfb2c36a915db8fc0a67939019a618795eb89f65bbfe484612657f5a5efc95bb69d8e1f625e7fcbcd0cc73dc27d7e708bee9b9624c33a7c9ac66aaa58abc3ea576413d001c168ca5a8860f0dccafedaceb3ae5c185d63b4bac2e4a85102db9d0e777f6bcb33878a1613ea1312049b784f25d242e7e5fb7cae383e38808102c3709a4767e20c8179352a787d4183dc2cd40785d0bd82899d00b8db58ba1b823ebac212b9056715565f203764c61647d2eb95771a57215720f9e11c9547eae4580e699bb11ae8787dc4f4f0cde2a6e01b866cbe171aa07867dca33ef00a3fdeada6a9b167b69a5f9170fed307cdf216cc73bf5dda79e45b1f0bb53096b0f1046205566de5fb1ea93eca5399670fb008d246b01c53e4266d9e6b4cfbc5d19da4b26bcfa453fd6a4c0cc9c7009454de4571b534499d81320b6ac47a626bed26ad96d8a1b16e1b92870e7f1af69512699f7113b1e24bde515aab319fda1ac27bda8cc14f375de215e5b7bfca5502589e6c7eac830edd26f445afc24225f9685e881b2f695facd12104caa4ab911cf6fb9e385eb897a6a1f6ed9c4e0de45428c47524387ba8538b0ccd54e9ca391207d08d82c369805a2fd166759db7fc0b13c27d84c04aac840609481f4b1e5ba77328a1b7a00b5ad72f8cece39bc190188346508a77b7a254271f65a0bba6e5f91a22c5690501c8835f759ca8325faea6225d44a13484069cced0c54219afd228d81c7c111e9802300e1b8d61b36d97513147316748041527bc0b5a89103f1d9219471fd29b1dbcd5c52a3b1d9a0341b31c2b3de21583aa0cac360c3c20ff8815e883894351ae98568f461a7dddeb8b587f65611b6d40e88b61b9e11a51aad9dcb5240270774b45921cc79a47de17bffbf122f9231b3aa2703ba6bf12bc8a7fe776e6cf1409caff836f0b9e9e910f55e9c8bae5f59d7189986709c04824aefec01e279e43d7e7d7c0b0eec18716cd738a14e36d9cf943d44b8eb65b7c8888ca0e0faf3acdaa928d946a0185f6588a56db2976eb1251e7733ce4b006210e143ed29b60732491fc885fd7b1bd665996ffa0149d60802b18bacdea74cbfbc86ac374bd6a302f36ab9e5ebd26f1bf2435441a13bd748a7bba491d1987985255a33a7af81262b8d3061b30c83473362d4e2f27d1f8f5c57b4c84727024bcab1b6e0a0fa632f8b1a2725d24f0075518f150953907ede58f99bf9493753884e5d177529b088838a8cc8993cdb2ce584c674d6faa795ad76e401c9f43fd68d3630edfab14d93793af5764d724a34710848d1ff56d0d247ca8b6bb391a16f71a1db987a56852672cf8a77fbc67eac1b5f2e8fec9c03cf8b360930f44bad695a681516cd0cb288161191f0720fb40d3661ebfad81326d98ca6a360a3e5eb66fcc2aa1eaa64dd7c7ae49cbe98d1432d24c542ff26867961184aca03950136ca505a63192a90670a11f24e9ab72ea9f51e969b3c575d7373beff07ae330a56705463cde7fddb842b5741496d59178aa056b3313e6bbbec0489cda70765b42502ed52edd1247494a9761fbc743d0e4e70cccee0ac9152d6dead42c36a90e2cf5b64a6ec7c4796e5583fe04289cf0a3ae029a375268c884e23aef80ace2b14fd80c58688b84df89f2982c728bfcf2646d38866e674f93c8401719a9320271835aaf8331831634def09767ce574e12c8603074f70845e024ceb4839938900a1e21cbdb069cc1da7fe43e692bacd8a2618171dc85991167c2ed22a47d53c1775ba100e623a93f94f8183dadd335358eae6a540e5d3af7d36e08bcbd4bbb5482f51ef31a70032db3878f35545c9377fa00022e2c1c74a41cbdeade3d1867bef700a1fbcd72f17dd4858672089a8308789ba7edfc9ec7355b072e2ec7c6fc0a127629b027794852b8571e346d2ed7f8d632f40d942ec5dcb35be6ab178d138111ba59b3089559ce3ed2989d1a0bd8d407cc52e6756ea40cde8d2bc90e7abe71ba0a2b4655f0db8de2c19645f2c387c7127a834b4385b6baacb082e85ea8bf106f628929e3a1dc725f39fa39c8bc1b9026628bb0c87582194f3ccbd627018eece28701e515456e5be0e8ad075c4f22cb5dbded791743530c6c54d9bbaca9484b1c9fca55d5eb64452641f980d2fbe22be61ba3b18474429eaca21c95e6638f6e50a4a68472c7e5df6026d634b464cb78bc6cb6d3e5026fcdedef804296e86bd731d196a9b07e88446f453e4cf85d2087b937d407198d1f73af421e51dc3ea4c1662e0a73179d896d8332cfdc7893b08a1f45487505566cb1ba4f69a3e00d67270c42d8fab4c5c06ee324fd06cf0138856cb00c431cbb5acfa6750d888e95ee087a6fd1992354ee82c42142a0dea54f50ea6410967a68d6964ca309331f6239e20a63a8587a2198fe04f748e3e325ec8ff5576f5618ee6bf29fcc24cf65fe652abd1c18d61e9039fc87a4bfcadb4f9e7f8f908a9b1d68ae37e0c3239d870931d41b36c945e2a3c732965eec052e38a63aaf8ad750c33c3af80d6658132a05fe53ae41cb26e3078a777d9d3a84643db2a137b1d41a7b7b0dc5042edb59cdedf5d596de3892da82c3494cd22ee96e42c00d39b342732e4990f0065d68e2c94c1e98e35b37ba2ac2ccb46bc87fcb2511743270d08219d051955cdc8bee8c2833e8327f3e3963e6088320384984be00738462270e7104162869dd2cce033b1e37c02f860dacd9b50e382f552ce81622119d66a4215ccd37ea894989f24f0a66daaf62c713153710c3ba8fee6bd77761f65b0f15ff703c8740fd4c5aeba25f70f6a7fd4a4e0a78eb72bda9c4386a3fda3ed36cf610028e44c39c1889b36dce4499c15889bad7df8bf8f690f8770915600fd1444e9e820dcb985e74e318474baeed49159d38b3bbf1a0ae9a3208a021cf459524b63af1939b6620dab349746185f22994283996ea60ead6edaeb13638a9f0b95293835750d52d8f2f9d258edb93b78dddad0308175e928eb631ffde3adeac7705b3860cbb2f6d617956885d652fb480c5d61655f4e0b631f583b3bfa3f1f3aba49f36121f6555d6710fb98c1aa66c4bb634beb721839f6dd9226a1afb983fbe7a675b15c567d481e871737ec455c6d20395af94746bc1580c7b58cfc89d1765cfa80f891a8e7d7474de570eb784c91e6852edf9250247aee17057f17261a97c13ae569127334641631fd2c0f8d4c9474edbc8a925e233456039cc534b7394eaacbd9a515247628f423302ab28789af1dca7f7f7fc2e6497626c2cfc2a709a7d3e6c0d8fccaa5d924e6756d7052034705340ce101023d562a87f73134fb12472b925b2d4b3530e21b7b1d14fbd41dbc4d4895cc939f39d60258e8a2bbc1339f13d678553cb53998b9b1d8913083fdd0026467eadf0c3b9e4df17900dc2a3e156b876ab31d070ed7b35245e0d8c90e6c94283d7c8eca1299e22443ea3fa5d6679846a7631e66b138f73368b4de347b7d7a2d59e1540883388edb1f03fa3d6caf943d418c865c6011d35976ae5f8fb8549e50de1737023129dadbe63150e2a092c4576c4f2104e6b24daaf739310a921d903215a3047356c75969007e8e2097130eb6f3896e1106c7ccf5388d7ba2623f7b1bfd2d2621502f17dad0b790c1fd4aa06db18337f3d2cb1f14e0e8c6d211797c78c76857a3e68075786d195b144f4a16763435d55d3bfedec5bec4158e9737cfb74fc9160ac499f1a2ebae7afcd121f13730b6995d25212443ed5d5d9aa5d4e8f761b41456c0233bda3bdabe34dd501b66037114956e4"}, @nested={0x1014, 0x85, [@generic="0d9692ba46db29e75a96b67c49395cc6db289e1a31593c47d21936b2ea432787728e8f79f9cac07314c62c90bebc8a29e25a45adeaacdf760f566f58578fd0592a0ca91bf7f7a1e9570dd7eca72ae81b1f00d8c5f984ad664a7ebc7a76c060042ee575afbc454745c96f2b4f689b405e3620971bb755e60a0ecc3ea9dc75c59a03ad02a26978f828235174d18cf29fc149ec60df8977d0d5bcc2fed63d3cfcf4d53d36c6eb0d21493f81ed169e2b461e1e9eb9c180cb262946c9697a8b427d300c693f88192027b8af38b4edd41f3995c64fd9c23b8bd31cd9e2604abeefc60a6b0898fa6ab47e703a004573279bba9c05e7eca2fe509b137bc3cb18be2842847047351fb98c130a3cdba4b727879b31c6c1e9a0dcfe8dfb3618d891411dc2b990151b3b7a57e7c6738f2d70a328abacdb3ee2290495e74a871c060990e40308d6d21dff91c9c46f83d1fa51ae10057c8bfa7d96962c1bfff6e39ebeb6eaadc0e40ba202641bc8eb0945db22f4fa2ad7351451893e2f7bd293adb6e3260b71df7476a9cba4a506d749b2a308a31f4add63687303c09e10620d1b4cfa1b71ff8134b90f737c373533ebcbed070383b3c1e6e58ca2ebc6bd95dc502b0ff0a14ca14e65d42537165b2e1229d2daaa76b1b6c6ed7aac05e874b08f6a5fd8e485df0c672864dcb3b939de96e60234f4c5cadf3eea45c4ab5b028dfda7225d0bef283122802654aa56d66ca92c07c0b9258b86e1c61bf50ca5e8004b94c4173322fb98c3266d3240f62c47e2e6e5ebb15491cd2325e86d4ebf95bd9b4c3a8abe339fc6ee21aae45cc139a4f56a6adb0b46453a1a2029019328f14f621686c8c72c0113121db5c372c0147696ac60e7f713b089e88225d45ba1639b0540f7c6661c829c65c58d4b53ffa38f99c03d759fb1345339b9249378841b152eb90afb97737974ea0c836bfa61876770e508f425038d1e810d7f09f7299d7fb2a74663c86387e1a75c9448e7330c8605089f93aa310082c2e6818b7b1d206afb50d2ae507011b463c990e324fd109701043cebca844728f8c807ee54848ff5a194bd3f71f1b99f1d74b131d1cda5420eeabec088520d46cfdb41a61fd07f1d3513a79202375698ef214e3416335d9739008298366db8c1e79ce8a8be1413062a4230a4da775efcd6bb205222cc30cfbee1c0612679d0a4aedac4a934f7d5b468c18228044ecbb5824f3fe28da6332e2b06cdad4f635ec7d4fbbe92c2ffbb4a8f6e3ea105bacd419e04bea02b4367d62b33b09bef12c95edb48ee91e03b492aab9fc9ce59a2ba0b2657b8b55d3cf39ee7290ab80b9def046e67a31a9716617e4b0ea3beded3c4712a240fe424bf15a7c58dca3b5ef23bbdf6f8e6d37862069f34bbebc69e1b1074f96bb2263082f56a1c9e5876ce9a4d741dd6cd508235601eb24dff575dca057ce2083b84258ab87ac18f9cc0c324b2a085a9169df78e6381923af9ae62d4f35caca30178bd7bff914607ee5208b3ed1d8669cd531d8ae4ed0298d8671e167920ea4c799c62f8f3a9ed2c772469a4579ce61b7fcbad25592d77e03ecc514eabf225d52e6eff0b647ee16f813b4e90d4ad7b9e454c8776a77ec2f01d01d04bfb21ee412dff88ef479e307459eff69787f06786720c60c000032365bd6fce8ed8b77f852d4b531ae03f94157bd5149eddd42b4f594cde4f8c56b56df1d2e50cb00122242b15dbac8cf82bacf69ad18f5cacf450f86b85875b1ae7bc543157e18fa182844339d21cf19f6072308b77d36f4a2e1dff2aaa4c982423269aefe9480e3780a141c7b20a9dd103bb42245beae98789611133aec30a6a2207f264244a0559fc19f2fed00415688a32cda4df6257b6432e2f7c96dde5fae119b63ec21a6851e6164df2502d21e5f23e84a3eb663e72e9f13acd21f1ed953eaa6ce81523447411984c51985268681835a1c71e5e947acd667c4e3f7f29999188028473a429c4cecad25b80e50ee07f4588546f880de3bed6eaec139cf571e06119336754935eac87d895d89090bee5e3c7e4e89e328691432f624328cf4801173e7f23df5460246b32e6f2117db75c831a403543d485fde0b6ed1596f61c66694dfc559fd0fab1b2f123aeec5e864d98574343203f6ae9701624751b469d3e29408a2d32de95a1e7d35c679eeb7f4d2edfa58dd94d7d9e23bcd9de1388e8e0a67921f71f5c13ac994536f2c36acff7ed4251575f07fc51e2ec6a60d6a4492375f96cc0f0d75121f55460ff8c4801993a9085d80f8e8628b367cf28b14bd433f196e26df1e2217b24756057d96caf24db6b2f0cc8c3ca1d273544e0fbd4fba211e4039c12bb401ecfdf39c93e1170a17fdb0b3761c1af2e9c1defe564d3107957aca76ae9a9f72f37734de40646e39e588582d8bef17a792c5286ba32be079f23af18329491585cc0b22f6da7a6b1b882538d10f88cd0fe69b7b95d998f40a77a85eb8c3164c2c72bdf3fdc5c352790c0594493dc8f388123bf51e4aef081ec0b0726d11cd7bef016bc693f555bdbb3b9ff55290b0609e4fa33b1acf3f4a0ec3e01c4b23edb6fa1ca3997866b0cb394d6414bb154cc5164a404cabe4ede528b4b1e9932e7018980951cbf86527604bc5400713f2f3a066e2020ffac97b06c28332a79cde6470e286a7b19d9c5824e8f7516f2cd56786b828d57242361438eb617408f791221c0e310250548f5635e2e70b6c466f3c8fe6e4e4c7617af39f38a58bd9d25a0b2a8c67b8f6e1d0749c54ffdfa980da95b92e86a05943ed29b848d0a409ba51d320212c67debd9239bd63d40ebce77c60f5fbfd80ef1ae9740383aba06c63139bd5b9bd1c4379f6b7a0f8530cef47399152299b217f3dbd2ce1588a9f4c098273a3cbf5ab998e2746dd565b3eff0c404a269022078ff920e9d5cf3f23923347e6b2b7417e126c229aa5124077f360887c3d85058b74f2e7c87721de2d396ea824f7e0455c8b2b71cd42beae28e62ba7151eafa96b991dacdefb52efcde2ea31dc5dced417d879d9716fe9b07d9b7531a64e632e4445a2d61ad62f509970e122a6a2404c8c34ae78d303b7bf96898ef810e73a2d07b86dcec3f87d427dd76b43e45e9f4c3ae4b035fb0d22d1add96acb327da5c2e4bb82068db7cb7e6e06889f0cad6b65eca5c6dab81c060f9394c6368e8502a470b5ee7ae1e3ee8224487e032072d2e9e11d82fbf07e2b815c63e27f3e9ebf8b9c1aa9c727cf36631d839dd1c90445a0dfffcfa21b56c6d0e2ccd7f8aa1b46812e073cba07c0cf915cb2184565cff29b44fe6a639bf56df467f491cc14f69952cd03fc0526a52cba9f20b686c498a042f9894ab63a41833762667737abad0a1c3a6ad60a89ec037f108607e92304201b600f8e636a9a36f2d510839aa27aad720f32a7a9238033d9ccc8bf52e8905b06b7ccac53915423937544862de7bcec909938199c5e0bc869a939a7ff00b8f08bf8f02d853f0fbdbd4981ca6ef44b30a14c25ae2b4ccd9065794aa7cf4c24f44d747247da2b76bf2cdd8adbe015b4d630e82eebeb13938d7a189b35f8528cb60504d53534b0c4caf9ee6ab7ba831767b7a15288768b2913a76b2ebdfda9baf678827deb1e538cbf161c9e6e239af79af5fa23ece96a64376aeaad1ebb18cb47ae6fdba976776ba4de4e342e893b51bd737a6fe7de771fa10e50cb183d91dea3a5a6470aa3a61ef82999e66a57d8fe33c1b23736679792cc12837bf8eaeb6792a5a5c8921ce7d037427e2cd6421fb33627ab6920784929c95a8508686a5d59cc1b946b55325e35d0abdd3d412b907d95e68baaa474cac32240dcd3fcab15c7f2392bb4b9d6df1ca9e15fc4d0bd0db0526c2516ad0c8081ef8ba033b3a6ccc31f5889b60f2f9b267e0df0fe7c4e0daf533893175862b05ac7489dbead72826601627596a7cefecb5313f3979356ef8cb9cdcd62a4093d3e1748c159be9c092253a2ac51888373be0ab170c5f9f06b5f7ddb24148478d62efb1d1ca53d6ad1066d879bc10e95056073cb0fb0d3ad302b7fb8544e568b5a55edc916cc375f0c1e3bae80fd5bd85ca290fd72434a46cc516a3fc0400e3262dc8215bd37c8335c2e9f13b181d951ce5e73beef5b64930621f8c0bce27299ddb76183f496623c02024e8b1605dcbc7da71e214f26d48d50e6ac992f80707be77ae07fdc93b405c430b09f7fc660eeb64dfa84b7441ba8482fe43ca3f1cf33c2e29bca7767adf3c13dcbc26bb38a1796c774c4ac23de56216a452e8b216f22bfcf003ac6b05164de68a61b053f7ae9b6e3ee3c9d23dc953f6ef69aaa8f22f5cab734fc4dab86940fd018b2cdeaf7d318eafb60ca9bc8a2e749d3afc85a8cc541141373fc188536255facf25d6beeafef855bc8a7f885432fb74745b677bc123882da8c5645a93639f630849d99831750254fdc23ce86ca6663c5ecf11973e7016049fc2c2030f401b2c9fcbdab6e61cf21e2aeb41b5b532af71499379e6b33c5f5c95e5c0e168d6e4dd058ac5658ea057285bfb8232fad9dcf75c8eafde443dc1eb57efc5754666bf49c52d02a34169adfa48a6646eb9d0407f272c6b63e087182608e00b03ef70fead599f5361ea703fa3519e75da9bda6f755773b8c2bd331601209dd149e2bbffd75d999e063bd68807add6807dbe1d2745f31c5a9a435bcd934bb1099cef26d21a8225f5466021264a894c12e689454623c3dd97ae7885508769b948e42856606a25d65c77a17fbcf121472786692d578983019a5ceaf0ab6dde987457b17b92119bcec5e46aadd8ba6de13e99c88b2f3c3fde741a2b045676e1125d26a9fecba06724e79acf7950c21cac216209c438f9dee0132143490ba4f0f43e1763c69887eb05a3633609439c0c90f3fbb46a8ee0634a6f2e1b33ff34bac7bff722bbbd96e06c646d630e66d1c27b246ae10b7d6345c92de6c96f31cf551b22e7a47bba31bb3f4a0080c66e5315fd96543352908ab828c67dfec6e758e29a04999bbbff5827b8d0848a97a5f916120a1a1ef126c86956a0a5c4b38490047612c1da0129303cef826886a83b76dec0f2c321722515e4c141e9828f4ae2f2ffc6f2229c22034a7e153828e4fd9cd22cf62e463efbb352d8ec4fa39d6fc09e8c4c3dd350b8b839d6f849f8582e8e36b0d53eaaa76bfcbb43c0f5401621287e4799a8dac58cbb681d8ef14bbab30c838acfe8551e9b069decccb4efe0bb8802dd3475c45ebe071fb59ffe203b9ec82e6f7c93495e3a0de253806486bf37eb6271eb865e53cd962a3de2a0a31e88fcf6f6b02b9d89f81b65f103a2de7a130693857f33aafd371c2e207f1402bc8d5bba96d1d81a53ed03c43526fd3ddf230438d5defe2b183095147e8e541d56ee425465ccff7277b25ce6d69615c14b83fce9db885080de3aebf56cfae20f72aecd3668e4cb921a81515da75363f09ecf4356e9c3e234201f7eb438222c59c2329b8168da62cc921179760341d26b3ee51d3aa375d9ea4616584cf0df28252ca41c971f0a0a5bfb96abd494713ca4c5eb7a40404dc5657cc2ed22b18a21166661aa74912d22ee20e95098ffcc07779c411cc6cc6ff73fb588c1dcfa636d33abd1ddcf2a649ea31ce74109b91289eecba97d60a3c62d0edc70d5dca837eb125e79a4cda10ab3118e900c759e570da4fa956a0f541d592a692a5f3f4d8bd21c2f3d2fb2b4e788f7e2f716fd4142c35d0e607d4ff9ae349eb3dad90868985d07807c2f952bd09368baf893e084acaa881d8aa80a135cefba300e93", @typed={0x8, 0x1, @fd}, @typed={0x8, 0x48, @uid=r19}]}]}, 0x31ec}, {&(0x7f0000005980)={0x754, 0x18, 0x1309, 0x70bd2c, 0x25dfdbfd, "", [@generic="036f378a92a6af639a0cb0614953a93a8350bf102433cead38f4eb75381349bcfbb6363a68da99c94a070ba26b70691b6737", @generic="211801030ae21d59e02d36e170d579d92c199d9d77013386f8ec664ae5799e49f82a048fa3c7580719f5de3c7277c56fc84b0b027bb3d8b7400de72aace7b5ea16cc9c4062fffcd68eedcc8cf893d8c0bd2c89cc1e1c3e6cdfa180b22fe7365022d1c22550c8111a819fba3ffa79b34b7484cced2275372fafccf741f067941b70a035385480df9cfc9aba316adc35501172b7a5e5b34d632bb91feb6a0f645ac05735cfd378e1836e7a038574edd029d00fc85b4816ee0e21d8b8953e7205fc04eca9cfa5168a77f212777573008dd5897aeebb", @typed={0x4, 0x11}, @typed={0x4, 0x7e}, @nested={0x238, 0xb, [@typed={0xc, 0x45, @str='net\b\x00co\x00'}, @typed={0x94, 0x7b, @binary="7426c2328507a9b5893da8d0ce9899207bfb46ed9867fbdda3beb4de62ddfb8a1a89380563eee1f8f60b073f0975cde564d67c2800874cc2af79352685b5876a7186cdc8cff7f3d0de252e2da8793731b3fa9bd404ae9d656474df7d96e33980ac34c3bd7743c5c028cfc94a5d7b29d6bd146963a3128ac1109f0951b266e264b48038d35eaa18b1e3f89563e05ceb"}, @typed={0x14, 0x64, @ipv6=@loopback}, @generic="f8578ab3532408f83a4404df58f103898d82d6f23fa4fb63f21b54c27f713335862e1e21f13cb385b1273f6d21e6578d604b6300bdbf4cca663123c2e54c8898647ff2f649fc3a2fb0c295f48234e9f83350bdf9ba1dcd09bce1bedaeab56acdc2b7745260f60acc42a2611cce19ef5952ac705932475f58a301b28122", @generic="d3cc24ea32d1803f165f77b06f1628b687360d6a48492996bd8f30eaf67c781dbe8ae01a0cb690da20150cb684d892f51fa3d1a975299df00ff5d3e9084c8788a76d1324d015ae30c73a03dc7612048fd0a0cb91ad62076f6dc950cc972251777008132f8c2ed36b5e96c48b52e209f273c98e6167eebe7477b4f245f791396e49b8824082a8de733ae2462931ebd20e1e7909b99a8a742b", @generic="54a8690b842948c1d16bf3f070e8bf087737b6a0e3017e700e8986572326e65f94ed008254281a7ccddcf20f5d3d1dd6087532afb352836a5d06ae56fa86e692686c63b8577236d532e78b469d19843d07f1d8c38ba57a4cb3c465f20fb9ec7207335891e26cc922e3"]}, @generic="e8d292bc9f17d6aba04cd2e15b7989dac71ee9ef6b7e5313f2720bd2", @nested={0x168, 0x19, [@typed={0x8, 0xb, @ipv4=@empty}, @generic="7cea3597968494", @typed={0x8, 0x13, @fd=r20}, @typed={0x8, 0x8a, @u32=0x9}, @generic="ff492356fcbca853cfbe4e386b93530f708ba6a39ef8b97e9496d10fb34b19a7783cba8683a8e8775304e35d9c2674fdded583e6cd1c151554fbcde530ea47dc90a2db4d3b2b93448bef0b901369cf55488ccf3c61498cca1f60ba80c5eba2c0a8281a413486b99b7ffd75d993440a1873abf5b7a382d39a3ea6efb4fbb22f661a215ae3eb4ece362dbc1e4c42389e33b4b175c8d7df343d3ffa46bf8e2160faef926d83c111a23445e7fb2620be0993b16d631503108a4939eb84045036a8fc7003a3b2bde6f87b357006219217d5933ab0ce9a425f359b1c879458443722fca231e26444742dd2519035e406bd71bed5fcc255174258bca4be2139e9cc", @generic="ccf92d49aaef9fbc886813559b7a5969a77d7c0ea75ec92a40f9d485932196016378dec9c069ac90a53a6479da1c0618", @typed={0x14, 0x61, @ipv6=@loopback}]}, @nested={0x268, 0x3, [@typed={0x8, 0x5e, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}, @typed={0x8, 0x2d, @pid=r22}, @generic="6dc54593fbbae21d6b", @generic="c6b61e2c773021a3f10bd5cb2e76440cf0bdccc39edd7a995aceffcfe5c0bd4afbfbdbe3791b887b2c73a0a6b0898503a759b41a9130e474384b1955f5eb47fa7b5f6dba7c8b5c16e30991a64ad8f49e1fe234a3c6312d9d8f0d9760f8a66e4f6ba502d96832f169d9eebb0234b889dc586308deadf3b0cc8bc039fdc65230bc9f53a72da2616cb55c2e0e9772aaee6f78c543cd73a0cb4b896a79e51b95b4bb9d675a300bdd5e2de808be0b52e2c6701e27ac94b780bad44bd726d2a829", @generic="5c1430c8e03e3a752cbd2676848b9ed24fe246ec7878238bec6f2710199f178b5b7a7ecd2a13eefdf48847e534e66615e562edb2827847a55b25f450f948748dc678fc316b8ba6285f93e50c33706e2183836304d29074cfa7cfec7d1b092df2902b227f292bf7249f5b0caf1c06756b4b0599b227a49fabbab2fe061991235eaa19ce0db50bd90587ebddc2980f053601761187a01004175fef5814f84ea5201ae7dd337228028e311b8569faea174a5f065fc61ffae9789e07e6bac9", @typed={0x4, 0x8}, @typed={0x8, 0x29, @fd=r23}, @generic="e4fe2aa42dd474e8cc3c7dec4f59ea0d159c70606cd41254d216ac4849e2a8816dd4e93ae16ba06eeff1e5e5510630481995707ab4632f24d6baad6a966391cbff4ef118909cc74db144ab68093c4ff0bcaf3e944323154a18adc175b4414f5fe61a6bb0cba7dcccdabad7466516aedad27fb8fafac36966424c4178a94dc411bd1408b189daac870a9d90733a910c63684d653f9b7098a22c1e5ab70372fd67b99eb4879453490694e8a457820a57d6bb542eee41a943010fec2b1dce58053e63ecde86"]}, @typed={0x8, 0x72, @uid=r24}, @typed={0x8, 0x5a, @ipv4=@empty}]}, 0x754}, {&(0x7f0000006100)={0x4d4, 0x2f, 0x400, 0x70bd25, 0x25dfdbfc, "", [@typed={0xc, 0x50, @u64=0x2}, @generic="92d61e3e4ed6883fb2a4d93643701e7b1d531ca19e140c13729a799f48d414028c9c4e21fd9dfd89578f3f75a90d5d62e41b7fafb98e509fc8004a1f2f32597efcf5efc9b056704ffe4acfac6d186943f515fdf760213e7f699eb5700cbbfb4b349109e151f898e14dcaf1b4802ab5c6a47273e6f453b27352914865506d3793d6dc9cc9a97b93e576a720f72249ca3b18c214b73dfd5213aab14be68b2d329be5f31ffa726628ceb18af279795a3fb832c1d21d12a8ded9a838d886f8cf8e0f5eafe6a530222d9ab01d4c9bb03117bff5a71fee46e10f", @typed={0xc, 0x28, @str='user)\x00'}, @nested={0xcc, 0x29, [@typed={0x14, 0x15, @ipv6=@mcast1}, @generic="56c524d3f0c578535ca4c201445570469eb1d007b7ecde6ffa7ba2b7e0", @typed={0x8, 0x63, @u32=0x1f}, @typed={0x14, 0x7b, @ipv6=@loopback}, @typed={0x2c, 0x5d, @binary="06a91fd0e54c40811c738a0f042d5cfdacd16ad796ecd45d9f5734ddc20a89cab0ca2852ca77cd"}, @generic="4736dde1a4352da03177d142de7d3253fb39ce169b2f7b08a297bdae001d09b52314649e5f502472a4ea7bed27fbefb2f611b4d2875f7e3bd75ecfeabec8c8ec01abcda699e3668ccfebd52d"]}, @nested={0x238, 0x31, [@generic="f52a38605eea5782f5fde9440dd84099385c6eafceb3a1d5422aaf03fe97575b653fc21b653bc71bbecf691dca03d8c28ea977be79f5bcf91d1eac16e92346abb2b41612406c7aa3eeacf331788fb3d803d1a7a57ec7799882e8a8146a97efc1ed4cf765d03195e03b4747ee408234b738bfadc3bbe87bad763507dde493fa92a2ee7b1e885ab0f0e68e9be8c24bec23d70bb32db33fea59066d8079eb05efd3ca0fb8ae1e2c8602788e784ee085a71dcc6b", @typed={0xc, 0xb, @u64=0x4}, @typed={0xd0, 0x81, @binary="a4462b787f4bfbb85b260d4ec91d54d55246bd1c5c45143c5441ec3d2545bf5f642a1e167c757c33387f0e6a28677d5c0e66c8f1cd756f6e21e46e0e8b39257cb9f701bfb7ab25dc1f8c12d13ce8cb5b4d577ca1ae1d360205ea42b32948f63a4cf9ce39af196f1d7dbf6d78e57867a45a975065e8cbe1881bdde647a747ec96970655a156077ed0c7bef11915b37b75a4c3c087ed63bea802cad3187796e41d99d92c298c97e1db93d974e87c67e29f72963e6ebc94286250fe2733fb4183d1cafd364f9c6ca6a542"}, @generic="f057a4b51a4c16dfa1b248aafb79a6069b8f1b08b1d5ea31a3a0a4d2c6a58c8d2601a42f6ecdd8336ddb01178c60b4beac16343e77a1358088e36c2dce071759895913144bcde0527f286bcb9da7678e6b3da864d97fa3bbc92dafebd2", @generic="dc7d7a9c216eb3e9c6479ecefeaf4d953275aeb43af00bfe1f6ea7e73f64c2ec41df355e4acf93313abf4dbd9acd8c2fdbf20bdfbfebb6ccc520c1207ef3113da2db3f08ef1e812eb8"]}, @generic="ed687e3540d1791272013034cb759bcd5e491b557b6f80bae290198f544c32b63025a9489c0ab065b9b29b012025bf2c58d07d74edb9c1942197708385f2d6a4f7f8143b033b364cbd3c9a17304a3e9f21c9f4e42c185f2fe8b4207cfb4f20bcb88228f501df0497e692dbc9b7a584ef507940209f1d78c31d1b6ddaf391ed9c3796d6226d6148eb1daf4f0deaa59aafda48492f6c234b3b1b5c342f122bd1e84b5662c74a70e8affd0d19cd7656331ff951e752e771aa28dec484938e933d689af06c9b4b540bf2eb02f45a0693"]}, 0x4d4}, {&(0x7f0000006600)={0xc4, 0x40, 0x100, 0x70bd29, 0x25dfdbfe, "", [@generic="e4a71c564d2fc75e267d081311d95c15626a303782623ba4320d34fea3341e2a4efbd2a69dbe2e87793af2feaa3be3bcb1cc57a78fa1eb3ab2e34fd03a7a28514343f7e6316766fdbd3653491e5728c4169a84a6bde4f30d8ef0d1209df40f53636471f9b46bdf91e30ea282e211d35a7c08119c2b19aef6363d5677847920e77ba99c3da87c54a95aa71ac82d764e86ba2392b8b7833b119d4945fa71d56d8075ac7f53895001bb82", @typed={0x8, 0x7d, @pid=r26}]}, 0xc4}], 0xa, &(0x7f0000006900)=[@cred={{0x1c, 0x1, 0x2, {r27, r28, r30}}}, @cred={{0x1c, 0x1, 0x2, {r31, r34, r35}}}, @rights={{0x14, 0x1, 0x1, [r36]}}], 0x58, 0x8000}, 0x8014) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000600)) ioctl$SNDRV_TIMER_IOCTL_INFO(r4, 0x80e85411, &(0x7f0000000200)=""/173) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r37, 0x0, 0x0) getsockopt$sock_cred(r37, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$sock_inet_SIOCGIFNETMASK(r37, 0x891b, &(0x7f00000000c0)={'sit0\x00', {0x2, 0x4e21, @broadcast}}) 22:58:26 executing program 2: openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/icmp\x00') readv(r0, &(0x7f0000002340)=[{&(0x7f00000001c0)=""/4096, 0x141b}], 0x1) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000001600)={0x5, 0x8000, 0x5, 0x101, 0x9, 0x31aa}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'hsr0\x00', 0xd432}) pipe(0x0) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000001640)) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e3e3) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$loop(0x0, 0x4, 0x51d00) write(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f00000001c0)) sendmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000640)="24000000210007021dfdfd946f61", 0xe}], 0x1}, 0x0) ftruncate(0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0x81ff) io_submit(0x0, 0x7, &(0x7f00000019c0)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0xc, 0xb54d, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x683cb2b4bc11b951, r1}, 0x0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x3, 0x2000000000, r1, &(0x7f0000000580), 0x0, 0x2, 0x0, 0x0, r3}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x6, 0xffffffffffffffff, &(0x7f0000000440)="1955ed44daafdf2c1fbe2cdc9333032967022b00ff78a38cff9a746bbe6ae7648045c4d2f1a5fc0ce912a57ef32bd8031b7032c5c302c6e7d505a6d16367d5ad00840299fd09727dca0500a6a9003225e8723cdb1bbbfd0df24bad23559aa10269dd7aae7c5b203a52daeb73c7e9798620d75dc658d8ecd56afdf0106c6ed6236e39eaed6bb147f4a46e1d038949ba031437d1dcaf0ab213da7ef3d0f9d501da95116a80c1fb77828bafb415501abf87de4e1d1c00ce31a26ccdeb20709abe0d0ee9130e7de81f63e242792ecf814ab09934ce7ffc2eb298142b1af4b11b5913c4797d29ed839a224744723522e7f8ff9bcfaa87e0d86a177559582a21442b53205fb181943ecfcf7416ad285ae585f82a19276f627e4f04f4030324db1c37eb", 0x120, 0xdf9b, 0x0, 0x3, r3}, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x2, 0x63, r4, &(0x7f00000007c0)="f63c68e1ace4a26b9fc422d7760b0513b5ef2fadcb32680a8576f85ecc338a556ca53d197a56e2964ce760a5e11b83f3f5ef70cda6e4c72249b1c4ab96b7c0915ffef71c595bf581026268161e7ea2ad26656f34e62fee4e40ed5b9c243d68a4029ea4f79a0e02d0b4dbd124609242264bff33e9f7956c5fba6e4b6538dc3e653772cc87051503968f708ce445f696dbe416f122d3dd36bfaa2231cabe00b513a78fa33a402280518e6a552c82b9182007f3dba06758577e835c68af39851751ddf0eb891698833583efaf421b3355b93629ef2e33d712f77a9ca226479f8e933950a1743dfea019b3a5bac29e917ccebec14a68fd79365cbe0269c27d10c0514ecec1370e8337caa84253fc59942abc42b33c521ee3d5ecf54be132594806f5f6fef16371bbcf821accf35f5868b8c91b3e8dccbab5032060794ed5b7fa852c3c176843ec6aab78d6693c8c45a591f1806e68727d0c74b9a49f12cceea792e15c3ec1587245ca9a6b4a88bb2b28e7e008bea9149344ce168800ccd4509c41d16041bdd06cb0a20624738c82d0c2754aaa4133d5eaaef6af3b3f5d9e0961147e10278237bbc4cb4922b32c79b1aed69b6f328bf5f1a653101dfdfa75eead7ee98e55ef9ae97b8b415bc00f7381a6af34201dd546518b7d2e735bb354ef50b7a2fb802d4cca013cb863b714b85601cac24dba63530ea3d8824bc8a379c6f10ee785c4c400b1e25c6e472f89b8629a93647db3ac0fd861cda9806476ff39ccee49065c7815494a30a358a7217ac263f1f714fe530469e8001a8bba848c647f8d8f1afb7d66302600448807c68321e4bcef1e36532a9314c86508673f89da7c6a882de94f14571f77137ec77688d8f3ba47d08beb8c8bdb50501163a855efb57e548545d8246a76db1afee8a5aef0d38f36c1d10f63b434d3ebb8e91f233a9154d449a25e8d30e030f911a4557b1cac0e3ae3805c6867aa130b367d4f51b71a53d83a13292603f47707ebef215a0830d4c9e8c13fe62f55da46afa7254850c00be6a6eda5da5c54210c9fff40f94a852b9cb8eca3002901c0e6da9481d2b90c157151f0f5a3768ef466eca1f42633de1216db61652c590960e0cbafdec33e79ec7055683dc2a75b97509830a691338e852472f68aabec5c42aa40fbce681a50f62a48b57291020a02b4bf467d231de14e4c5164637be06683bf46f2c94393e2350abddf6d62aecade70a75b63991d0438ad3b693c6ef72d0c6d5f5ff9d0d1dfe9b046c2ef5c485a5e6a1c05c301bda77e9992121192da6d963b944cbe5ca97600cc4e2915fcce5faca955f47565c8cb82d542b114db9aa599d59824714423af8e6a78a5d9cead32457e55be397b7a9ffa5b97e428bd6ad20bff08b8c471f74a01350ba691ab97d15cffb93c29f50bc50bb628d9c2908952045d4cfc9d4a5a5e043cc43a245fc5f44be39a060e32818fa784a3dce6e74ac99e1263e617e2d3b1c8a06bcafb4ea7e54abca0db23606aedad0d8e2aae8e4d258a0aac4b8496e2eb3081a5a04255ad2914a56154b42569e41243e5ab098034da8c4e7c63c044142cc9d4101565155d3dd5caeed0ab2cde2746b2be69ee46c47c745fd51e5b9c650b4d3f09b37e85b828d1641480dabc33c2d6feaf9ac659454975e925a19127814b3799940f7941b9dab21f425ad0e04065661e02a254a81097c5b410957e50e13354b0bf92c66cfb12b8179c0ead4938ddf65ef6643264aafd8256e1fe132830f8f380a17008923345ec09e8ad67b5458680c2071a0945e06abd15e8d95f64875f9a54588667f371b94b1501a278baf66899e7bd20a38b09d8008160e957c64cd468e198cd03eadcc2d18a0185411f12a87bb061aab02ba4822bfa63c524732076d453fa33050ae36f32290aec44cf1c0e87e96d48a06c576e0fee3ae2276d317e556434da4f7f0f294179ef7189f3232742a4367542be1ebe1da17acd94e9a6ca979c1bfb2c96a15bcc0c907cb08f2bea30c036945f6be1fad21160e2e8f40d2aed1eb3212bc86348fd3530a3c5af09d09888fdf88b59a83c9af8120c9d63c2766f23fe6f040273ee086c10742e9c5419e08f1afb00be99077f187796df7e28228e3c21e5c17abe08689f5ba5ffd1d0af918693b302e200c9808155a60a102b4553ceeb1c16d8a58c13130a5d3e282f0a35dd056d6101980a8ee33a72e69b6a84d3128d96ef51be4e5756409a64d165462fffc6c08a6dbce7c1d942c6f6386a13dd8656f35547fd0181e5378dbb2f392b2cfc2dbdc38e5de7cd7e26a8369e2e204a4c2492a76560a251aaf54815a8fcd803f9411bc29a48ad3ba56006535da5ebc7ad6e31c4eaa4687bbd7d9d2dfed754d725c7ca8a7abc2c6679571512927b5b6bd56079ea0c94f6a03465140852d81f6ed2cabca260a3f0967a98f0e7dadbd2a4a89e620de8977d0789c9bd397b8a08282d8dedb6c87ee84edd8a6c1193a8a259ea439981b8e66a6c949851521341ff203dd6e73e06c434f28e40edcd811d084826950cf5bbbdb2e8c3db25864b75916455703fc5276f6a4124a888ad1f5c84baf46fcbd95c1351222bf2e7bc1e7960e3c976bffa994f40a5395554c395c958c7d16fce53bdb3a9f0aa86aa7b3cbfead6e5a1603935b1ba1769be97f1428fd37f858395b03448a8fdce209e622d07c708076cc71eb13e6123b2934c0e617d64ba9cc644069e5c19373d2ba2266606209c29581e5d696dcf63de83a1104e74aca7d258ccd56eeaee5570659ce42fa00345d91e01e5427aa4e4da168d8239d12e84a2ad1a3cb289e56985eb22e40a011e77db1ee0212ba6b41e81565da7df4622a54429ba8458244bf4de593afc3c7ed8638f7fa20462b3b97bcd7781455f3d2e1ed35f02afa24ec1692231059dd651b591461f21669df858abfacf798949c1e5b562c57542391577d75298d62502393c13d5f06f89726493699ac2d166e540089d05af373ab9a2b7df01de542594445bde5a8472b15386332b465191bba78112b9c101b839dfc2c5cd22c7fdbf214dc5b085f2e496493fd68c3741073accb2dad9959d5c19dcff95b7644cf71e74a8ac64805c50b2c3851ef37a0322da907ae4a6f31dae665a6beeb59a6c3fd14979a0a9d58f1c5b3256b76c7c189c3a124feb4f6a6bc66746e4cb4eda222c367e11d427c5be6fb5845fc48aca8c3e7f89f5c9cbe50ce3cbc59421729b1f845b7e331e486c0eb43440848ac44cf36bcd7797e9aec4086aaf985953ede0e17fd41e7fab01e99002635392e43b011218e078a9f65e2fa92c09fd1a00e174b808f41451ea1243507b3ec121635462bfa96acda59227576e71286fdcd02702eb14e5a8e4604574ecee3efeed944620eeabd6439c8d827466792e6e066ff6066bd8dc3038e5682a01c7dfa84a04e976ab751c1ba507ba2050cb41a99a62027e1ffd25b42d96a4505598f6681ca5ce0cb8108ce8cd6f7ed44eb00d656c76c97a247e5e9a7b50c9485456e41814825874325d82611df9252c6a4050a3db53868d1b7bc942da57f2bc328977a5a7087de126318db3e3cc71ee09c40e129e9602b56cb2a585a991f223046a4c3895f800f53d30d2d02adbf0a138e3221e2edafb2ae8d79a6d7addc3ccc5eeac2a3c3e2d046e63b8a54c044eae03ccb4ec38fc6a2723f722e19620d17c10ca58b0b2398237d25fe83b36f72e3cfdd4d4620c1542ad9cbbe5e8a50921a7fa72d4dc29579d9f83317422d70334a5769c908dc056b677268b8227f92ed3a295cd1627c6b16ac67ff5219e16ee482ea04300f5202156824cd0785658b9ddaa90da3da53c04fcc45086e366bcca9b54889051981ffca6ad61dea4d144acc902460003949898bc1a0be025dfad3512cb008d35a6dde2a42071f17fcf26cd7e18100189907a678bc79455487b1db3ed90184b65763b5f6ccad945a63560474cce3ebc879330911105d747431f6950840fd16bc4b8264a926c340e7a4b71d4b180bd931579d69b5613c622eaea58c9472e922c3491f68b185030a4e2ca7a73c90d1eb95113b1c3c6f666a38018aa6206de5fdb90ecd224d5a1bb2ede1b597f633cf0321458edd161351969327dd253cd2912a90b2d3016387f1e584ff4ced8ecc5a7d9ef2272fc58c99006042b1d575d7cce9fcb3127a82622cf74097388283298aade0522597484152cb69d1ee880104b1bb84a1a766406e8d9352fc8c7023f8742c68e3f2c661c94583821415ec720307b756e0a048f9e28f2e8105ec515601492df3580aac7584f968e0d24d7e0eecfe352aa24f27ce5abc5ba0a7511c10343290eb3821c096c25da662e73a5de1b9b7e4c21f40afa0b368435e1be703298d866b683d93a7fbec5cab66f974597001cc10e37f0cc5c28718f8f65c4424b8579b80ad2dc9a736c3e82be57c596eb61d3d12ccbf0aab37833a90b2829aa9d860b48ac1325e4d21912d18dfe09f64a209c1f13504332e8fb490db4d7ad5b95209218bfd4486b5e1aa6e3d7fd9bf81d87f0925bc6271fdc237bc0b3e89b4cefd36e47274f7d6baadff882b7b0406ab7652f6c7e4111389b2220d1129f422709280abef095737114038a1a4e5806cbfba7b623d2544f95e2dd4320da5f1a6f3269b6fd929c35bc6e561e1d1486274d0e43005893d555a20149a51f0ee466ddb48a7ea921f8e728ee413632a820c740ad158bd37aa6d37ec2b6ce037f37721f6ee0629b82e1ba8cc7141716aa158ef482fd98669c5c60bcdfa02fb649869665c3af111d4a9eb1575824bcc7d70b827830dc9ec41e810d3c063e468428f3b70de3b9a08f59c0fc82bcb9507aec2b927a2fac58760d643a6f773f4e214cd96fdda7cbde2f358d27de89fcc26cf79e3076a3c4b3bf4c50cad383ae4b4ac6a2770fc22aa5aae46f78eae5d38a1f40cc92fd52cd334ad71421a1404c9b2660d209bfcdf3566181d62ee39ad03b8a04907196f4333ab4c91ec589aa9422e2694327dfb8c14f9013f5c64beeab6e4925057d71cdaf3856c8c3c4dde291259327870e507fa6edde5db52eca2617765cbc2ccce7eeffa637f33b6e4b2fd71b6b6171e7", 0xe0c, 0x2, 0x0, 0x1}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x7, 0xffffffff, 0xffffffffffffffff, &(0x7f0000001800)="86b7e0ff9e6590e8da72fb6b63de2056a0bf4c7d57ac3b65ad10674df9a825fbdf71b923a1dbde9789946dd6be2b3c963133cd55", 0x34, 0x0, 0x0, 0x5}, &(0x7f0000001980)={0x0, 0x0, 0x0, 0xd57ea18703433360, 0x0, 0xffffffffffffffff, &(0x7f0000001880)="b6db78d7f4ba81314af85f29b659359d8d5f31366fda534a66bc58fd444ba1fabca895cb7b4662fb7e5d4700f34192ad02acd240b6ef501f4c32c1efd7bd861957332991cf8f15060f692ad534683c3ebb4f9b965e9c7e0b47a144dd300b8860cb21fa2cf15a1392fc28ef4febed55c8d6afb40926af543af19bbbf85907585679ffba52d65c0f80f7d4cdb98d93fef78c0765cdadcfd28f33580266b3da59bfb761cb476ecf", 0xa6, 0x9}]) setitimer(0x1, &(0x7f00000000c0)={{}, {0x0, 0x2710}}, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f00000001c0), 0xfffffef3) read(r5, &(0x7f0000000200)=""/250, 0x50c7e5e2) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r8 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/load\x00', 0x2, 0x0) dup2(r8, r2) sendfile(r6, r7, 0x0, 0x80000001) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000100)='net/icmp\x00') write$cgroup_int(r9, &(0x7f0000000300), 0x12) [ 812.214960] binder: 6376:6382 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 812.225847] binder: 6379:6384 got transaction with invalid offset (-7677002734444675072, min 0 max 120) or object. [ 812.238746] binder: 6376:6382 transaction failed 29201/-22, size 120-24 line 3199 [ 812.246729] binder: 6379:6384 transaction failed 29201/-22, size 120-24 line 3199 [ 812.258359] binder: undelivered TRANSACTION_ERROR: 29201 22:58:26 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r2) r3 = open(&(0x7f0000000540)='.\x00', 0x0, 0x0) sendmsg$nl_netfilter(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x41010000}, 0xc, &(0x7f0000000040)={&(0x7f0000000580)={0x1110, 0x11, 0x6, 0x200, 0x70bd25, 0x25dfdbff, {0x2, 0x0, 0xa}, [@nested={0x1078, 0x7f, [@generic="a483f805ae66f07252d4f92022df5591a1e8bd0edf872497aeea9007486127a3b974e00d77e8aac6868701253bb95d535f4fdb529972e942fb10e42ed5059f286d710cfca8575b9c0311dd8bb31642bc9b8b155e1a0d2ff3eeba629d6bed872e3d993a9df1b94b87faa347275e92627e24fa6a", @generic="4aa7ea5dba808428103f958913b0f01e2d51a10ccff3dfb97824916c1432b617941507f25a6808858a1c5bb06cf2aa7cbda3c705696f724e61d73ffc3db289738a88e6c22cf19dd2f4cd548740b82bcc669bc17594613290bc960e0252f1bcc3797e6e7f6de1414403f76788c0c25aa9a8de0ff0296352c1ba6a7d1f53b97bfe7dbe3d01b372472934b01de332584a1090e878185dcc40bb85fa2f7bd56133343059df839ae64778f6444235d595bdd3668c59e372cc47dc5187388f02f0684002208c4d1f03ec3c2550ab54d407094d487f5cc442d0d6311740b563b434a5bcde3f19e1b8a7e1c5fe0acf4a917ee8d8652246397d7c65b26ddb0fe1b2a1038e5b8cf493755dab0e0c62a742251535ec5a59b918149a38efdb13612999e57b0c0f2c096b105f47197ae35ef47ca0044ff733d78b64315dc159f3aa0b5b719842fcd5b405262323255fefc409fe971aa23a12acd7860e6f6310545f391cf22741ae71c70833bd21127720bca9df9184313bd1bf090cbdd73bc838c273ce5512ed6513db1e73768c0eed2e3a14e2cd7f98356f9268e094e35f3d99270ef80e8bdaf9d7a1f0f666a3a80ee95529520d58bdb66c9ed3e92d74c7c3998e388532b0bde17b844f59bc0511c56993ff92dfe362712416a5b01147431a3c3737aa30128a877aea990c29d959a4bcc3ad68629a962e31131201da8737579ff38c5871060d70140cd641c6de8c56274ff0ef2a89ae54e214f5b8b11709626bb28394be881e2f56699e46e9a0d81848846e26413dd6a9133de7f7c47689d5166f735397ad3443e6ed3a28d01ee5f0978de4a94d2be4caf778fb2d84b585a384e92fc16edc654a257066580a3780a3a6dd73ea0d105492507e96fc13779a36088dd0dc95a8184642c31a711443625723e82e6678d2d0912d19458de5c5ede52d2a77c76c4109211b32be597e67d82d912068c623dbf176ba4c355228f75f3e1ceba81a0ed0d23b24ec0cb42b7277be2b214ffadfdc589cf06badb3ab7ec07b4389e7b90dde6020ae25c917f73b7bf437206990f441a273ff9347654ce55f53d437990e9c96cbf00eb4aef949537d7b99d5c82216446c99c9f87ea389a22f148eb652e0586a8bcee03033f9a4ee3c590ec0868a9e0cd19e8b1aab6f1d1bb718cdac38a2ccfe1c16c2f4f58ed88a7594a56101f13c6f1356891f6bb68e828cc000794085acdb8671be8aed59d893c1e84bc60f45f75a37be033d840190fa129304d07658661920809cbb8ff6442cf27e94fd0971e1e5a04c1ece284bced69d56012f44a0febbcfa545324068b10b24ddaa36280ee20f7b1ccdf3b8cdc8e2782c8ccb3d5aed648a633dc380f3743b6e7ffac6ca399e400ba3fb2ef8c98c663aaf809fefa50dcd416c780fde233fba6beeb6586bb438a613cfb216055efb5778151b4518771bcf3a7a14f089ae09f5f348a9fd8aa667594d378ee19edb6d1016160ad25afbd2d425e71d19513ba99a6898a88e4932c3badcafe485e04440e8087990456ab79c29944b882527d44876c073db7b149b3d622d4d29d5f6d0150fe2148732ba72f849df2862606031941bd9b40ff0696a0f5a2f6885b4439f70e1f52d9ace5bcecd15898d28a1846ea168135b1872f6b8963cc233be83b2536cce0209ee0851a01e1528873958f6f86ab3c734e3e6d891cbe285c61d405fc51e37afa8c7d9f896eb4759a18c334bc30449851e0affb54a6b42f7dae1d3bf936a0f71770dcba260e2b7874d67159f0d0ceebe5d98af056877dd5e6e85be9dc4e82da098192e1fd8f541c82f02716f83c6d4840a36830c3c530c45f5c64a43b2a56834103351189976399572239a96c94ee5cf413859cc3ad72b701553cbccfdb96a16ac218f47571024da8bd5ae9dd880bcdc3f99f9d55ef93f9c94ded08b73baa7c994ab758ab03208523c01d7ce3f23938a7cea4f54d0b664e2a920e103e9d4c42f676b62d0c1d59b290f99b9ade88dac3b04ed2159f9da9eb315a8d311a2895880e1075115c2b6b2538527b3128adde162a86aeffa8d10326cb2a6a50e857bf773c7ae246c856c525444500b9a3858e01ffa6ed61feff122065ddf1034dcbd16dd8aee81571b648bc3939670c903c05c8d0675163c83468303a51c8f616ee4aa44c08ddd4f03244683a4a1c6274ecf0d0a4acf423d01e7715e9522bb3f38653e0110d674def9a1dd6f82b8463db8ed14e82fd6fe8bb7d981dd91a01c642230889550e028fed9071997e92532ef0cb72459cc048d447ffd24f48da1da0c992ff8d2f885b171f02e34b9b185687e9469adef7392351bf10a7f3fe01ea0b33c503aa9944e444a27a5db4c00c2721cad843d5dd8f6b494947bb14b0e9579feeed09526cc4957d9f5226fea3b3acfa859184acc5c5c1bec5225e4ff7c5a1d83289abff6eadb2462f2d6ef5acf1207d6a3a054ab83b8188e7be09cbbd9f893aa0a1a4e0dbac9caa4ec047bb02fff637ed644d072f5fde539ee5826be811749c336d2c2657b0ec6b75b986f0a3dfd1288cb21abdf28a7656e1be6a90ca1e5018b45867eb5d224c7d928494012eac96e7e4382eb5d0b0f8bbe493c98b8515678daa7c75f8cf5fa785f6d6e61cf45a640297110eee62d00e69076b766881da7c2f6d73958bc72fa246539c1c653f6fe115ed26db303087b92eec5fd732980fbc81a24fc9dbd23c4aace922ba0f2627bb46a0121207ce2ed1a7e225215f19fcb8e6fd5179ae97e673d0ba4b9563c20bc33517eabadd5bfc61eb6d235bf03c90cc6436201e2df77d2e6cc1e5a77200154285da7bb243be03930f51956b9987bb016f1ab67cfbc16e589d9641609ab5493a67c38b75552fbdc22c37f8bb89058021005082ec5b1794712a8f0a0ababe63429d4a117346bcf6b0953c78d0521b0e20c9803c295738d4c13ebdb6d3aee5dac7f39e326a67924a943b7ca4b509ef1fbfe4a3b5a5f754c8c67a722d5ff2c4ec1207c9b045565020c37fba5f07207ebd507ae0d1b55af730a50e9b4bd3a0a2ae3ce11c5e544a28bb537264dab1f5c76b13d4ac4116ec3d97c598b8fa26df6e2c739800839e5cd93225062a8130931937edfd79a8ab6705d0aecf4853ceaff17d1bb9b27fa7067ee0cacbd09c9ade3defac8cc81777ea55b71380fe406ef7088318b5aac10f15571adedd8d79e9a583ea20864ade165b98a2484579af5a3ba5bedcdc375e8c4a8b2ca791e5516611741cd91954dcedd229b52b518e5ee75f4cb27ab6a1e52fb220e953465cdd4a0280604b8516e610e1e46f4cefb2ab7e8d434b8b9b038586e182ba6db8fcb772814e7f1578a5332336142ee4d30bc46fb7f9d557ad48e0ccc557231c65500499480439884564e5e69d074c9c4939414fbb005fe5dd3cfb8fa7d56d9796bd05ecadbf02b6f1497449a17c7538e606f8dbd0925e43081ccaf6e7ad3653ba3c8285bbe4c5ba2e14867c5dbc80c81bed109e34ed8d3a850e88970e471439a63acecc507a6d9c893d47fb7e3621272e57ecf1ca4e2f0589b3a347b8621ed5ffd0c5830706c514caf574ace151a1c7c7f047890fdd3f30c0986cd5d47a6a4a3a7a9b0e74386e95da3da10d1430ff0d61ed7ac5382d3741f0f40faa39de8ba09874da5f23f00926a0e6b003172f4f56253c045f5a27d2e615f0c929dee5876eae852e35063844aa96417081484feb4803fa6d4237ca78d6d8f41a9852e3d64b2cdbc74d75382ae5b820354be469c85dab7f6abf57ab56c6c266e83c9393c7d1d8c219a35ab9311966196642b88ca6ac554d90b4c27886f64523a3ebdbfc00b0a59abc02caf05242e6cdc2b24ba073a0d5e78c754aa7f6cd83de59dccc8e8ff0827af4311cf23e081b56b3d38e4eec12c4f20e6f6efeb74eb8e78192242989938bf919e2b9256203b1caca9f854037b79efa07a4e1237a5d254e83d1761376a7e24930daa247cb3caa7943c3eba51939929e393affe144185849d4b77c04fbbaedfe78490327c9c41a186bfa0ff0e20c9ee8e3c157a708bec171e5d56a320e2cd3af15a9d344485930f41714c2713ddcd84ddf59dab51520d1f4ddcb0c74f78d2d55608ec644a3822ba5d1fcb2181f27c98bc3268a37b2d1879d5fe76ccdbd0eaa88c96d4fb7e6dbeda887ca20f2e0b784743096e69644cc1cfb9047d572ea5f990cb01203319dff9b8856d9fffae0e3bc79fa63fc9057ff9bd78a98197eccd900da80c47974204c3269b4f6e4191ac929d3baaf416cd81b3516e66bb8fbe682cfdaeebc2e61a5a8883d21330e99627faa84d4fa8517786a207cc1a24cbba3f1f4117fb389b6eda861abbae18df6eb9284f2e775b82f72403b2300420affdecf74515a99b55d8ddd45904542fd9d2c1a12dae04297322d5387bd50145c2ed6e1dd646beac81ccbd3b4361ec7271bf9c62d1b282577127518f1add9fb9f3ccb6847735c4382395aef5e8301f20c0b82596a982a98ac0d96a4863b501bcb4db8a7ac93dae716835e63c837a07716bc13e23aaed8139512ae0cdca6d256bfa8618f3cb2a936df3b40eb1d9d7ce897b0baee5a065ee7ec7c1876f3b620a9cdc6460dbf83b76fac1776002fc1236ef1d1dc68486b99d87fd04ae2b31aa6589aabeae39b3377156872764e24ab69aee85f983bc0508fb134b567fadc3c190d2f0f5a180a56879fead75a5f27e33f0d52b06c79e97086ba5b80846176cb7887701df76e1d7933f467f6279da6ff069e90f702a3b172c0c9887cac36b4c732797c7730b8133cbda967f935ef2e525ce56493d665dbd5095d0e4279e112381784eaadb3ec1f5df5ca6d324f2f823561c590a8665e0680be4c34d641a339234a7df6f7c66057e2e12dc075d1a0bcf225600cbd5a57808065229e2f421fd5be1d1ab914d8f7815058bb67ed6bef00f3cb94c7ed7549dd0c0c83ebe45c22effb68896d9f4de843ca95153c900e442cc5b2e2b1dcfe0f8982aa41976ef8fd9d7fb8803cbee076e111d8d99066bc289b3ae4c74b7b637f57cbda5dbbad3e9349b4f34f11c2bf3138807282f2c2a50383330619080fe31681f4ca842032c6e636a27b488c1f996d446a45003e7bdcb6cb3bb26c908ad72131d818756140016ca49d5acf9a7779d27ea03eef3b3e153473e5fa4112eee6eb4ce82732b0d053665be00499a11895ca774b989303ebeaeb9ccd29958bd64048eef6c3bdf9ef828a5292877cc57f77daaf511a73a9b2a397437e76381b2311e93b4825785fedc9596e1d16818ed39f27cbfc6b3d4f69f2f655e4753426a2eaf612a985cfddecf66d8ceaef5ac19355cccd395f9ecd36c3aaa5e1ed6484eff8b8806e533112c344948f7ce17e207a849aa35469c0d4e5c2c1354df6cf3c50912b25c9256dec4e7398df7d81946fbd0a90220102a9890c985c30b6ad8b0fdca1193797786f0f0b39a8b9a3dcd3df4e1da29a396476aba632f6b75a117d2a5877e1d8de42c4d0796e8fd161845d187b7e6264b8ed80e7e79e26081e3c431f22b34a330e5163949328f1609ce329406cf6f131d478121a1b3f8b499afd574a0d828f4b0e05e413984d61a7154499a373345dc212fb3ba4217d298969311873c823395d601aa2e055f9585e75e7f2af5bdb2515f8e19d7195ccf7abcaf28b2565496b0cc559797fb94b153e6d796fe1ea9efa540873f3021d0c7892fea0800337e15c5d7b8594651ed9fcdde05fd46c4b40409b718c23b6e463f186b4ecee2b7ad2152b087707e01705a87f5258afe41548128b7e848d4b583d748c9b125981e506e7ac3e94fe9de"]}, @generic="799300b2a4dc4f4d3dcaca4ff1d5f666e6c869eb0cd5d9725448afbe594a3d0666fea4e2c0adf68f3b1b7e32b9ca209bac628dfd87bfac63e3f06a92e267ad7eb0b5d5e05de63fbdaa581443649a6ac2476a5fb39337378e60c58a854e101763dc4e38966e37ad6e9901e346fe05f189d6971e5248aa47625ea985c7ba59e21b6e428cb9"]}, 0x1110}, 0x1, 0x0, 0x0, 0x10}, 0x4000090) renameat2(r3, &(0x7f00000000c0)='./bus\x00', r3, &(0x7f0000000280)='./file0\x00', 0x2) [ 812.273859] binder: undelivered TRANSACTION_ERROR: 29201 [ 812.286658] binder: BINDER_SET_CONTEXT_MGR already set [ 812.312302] binder: 6379:6393 ioctl 40046207 0 returned -16 22:58:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r1, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000240)) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) r5 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r5, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000000)={0x2}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 812.313125] binder_alloc: 6377: binder_alloc_buf size 4840 failed, no address space [ 812.313132] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 812.313170] binder: 6377:6386 transaction failed 29201/-28, size 4096-739 line 3137 [ 812.344127] binder: undelivered TRANSACTION_ERROR: 29201 [ 812.354954] binder: 6379:6401 transaction failed 29189/-22, size 120-24 line 3014 22:58:26 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r2) r3 = open(&(0x7f0000000540)='.\x00', 0x0, 0x0) sendmsg$nl_netfilter(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x41010000}, 0xc, &(0x7f0000000040)={&(0x7f0000000580)={0x1110, 0x11, 0x6, 0x200, 0x70bd25, 0x25dfdbff, {0x2, 0x0, 0xa}, [@nested={0x1078, 0x7f, [@generic="a483f805ae66f07252d4f92022df5591a1e8bd0edf872497aeea9007486127a3b974e00d77e8aac6868701253bb95d535f4fdb529972e942fb10e42ed5059f286d710cfca8575b9c0311dd8bb31642bc9b8b155e1a0d2ff3eeba629d6bed872e3d993a9df1b94b87faa347275e92627e24fa6a", @generic="4aa7ea5dba808428103f958913b0f01e2d51a10ccff3dfb97824916c1432b617941507f25a6808858a1c5bb06cf2aa7cbda3c705696f724e61d73ffc3db289738a88e6c22cf19dd2f4cd548740b82bcc669bc17594613290bc960e0252f1bcc3797e6e7f6de1414403f76788c0c25aa9a8de0ff0296352c1ba6a7d1f53b97bfe7dbe3d01b372472934b01de332584a1090e878185dcc40bb85fa2f7bd56133343059df839ae64778f6444235d595bdd3668c59e372cc47dc5187388f02f0684002208c4d1f03ec3c2550ab54d407094d487f5cc442d0d6311740b563b434a5bcde3f19e1b8a7e1c5fe0acf4a917ee8d8652246397d7c65b26ddb0fe1b2a1038e5b8cf493755dab0e0c62a742251535ec5a59b918149a38efdb13612999e57b0c0f2c096b105f47197ae35ef47ca0044ff733d78b64315dc159f3aa0b5b719842fcd5b405262323255fefc409fe971aa23a12acd7860e6f6310545f391cf22741ae71c70833bd21127720bca9df9184313bd1bf090cbdd73bc838c273ce5512ed6513db1e73768c0eed2e3a14e2cd7f98356f9268e094e35f3d99270ef80e8bdaf9d7a1f0f666a3a80ee95529520d58bdb66c9ed3e92d74c7c3998e388532b0bde17b844f59bc0511c56993ff92dfe362712416a5b01147431a3c3737aa30128a877aea990c29d959a4bcc3ad68629a962e31131201da8737579ff38c5871060d70140cd641c6de8c56274ff0ef2a89ae54e214f5b8b11709626bb28394be881e2f56699e46e9a0d81848846e26413dd6a9133de7f7c47689d5166f735397ad3443e6ed3a28d01ee5f0978de4a94d2be4caf778fb2d84b585a384e92fc16edc654a257066580a3780a3a6dd73ea0d105492507e96fc13779a36088dd0dc95a8184642c31a711443625723e82e6678d2d0912d19458de5c5ede52d2a77c76c4109211b32be597e67d82d912068c623dbf176ba4c355228f75f3e1ceba81a0ed0d23b24ec0cb42b7277be2b214ffadfdc589cf06badb3ab7ec07b4389e7b90dde6020ae25c917f73b7bf437206990f441a273ff9347654ce55f53d437990e9c96cbf00eb4aef949537d7b99d5c82216446c99c9f87ea389a22f148eb652e0586a8bcee03033f9a4ee3c590ec0868a9e0cd19e8b1aab6f1d1bb718cdac38a2ccfe1c16c2f4f58ed88a7594a56101f13c6f1356891f6bb68e828cc000794085acdb8671be8aed59d893c1e84bc60f45f75a37be033d840190fa129304d07658661920809cbb8ff6442cf27e94fd0971e1e5a04c1ece284bced69d56012f44a0febbcfa545324068b10b24ddaa36280ee20f7b1ccdf3b8cdc8e2782c8ccb3d5aed648a633dc380f3743b6e7ffac6ca399e400ba3fb2ef8c98c663aaf809fefa50dcd416c780fde233fba6beeb6586bb438a613cfb216055efb5778151b4518771bcf3a7a14f089ae09f5f348a9fd8aa667594d378ee19edb6d1016160ad25afbd2d425e71d19513ba99a6898a88e4932c3badcafe485e04440e8087990456ab79c29944b882527d44876c073db7b149b3d622d4d29d5f6d0150fe2148732ba72f849df2862606031941bd9b40ff0696a0f5a2f6885b4439f70e1f52d9ace5bcecd15898d28a1846ea168135b1872f6b8963cc233be83b2536cce0209ee0851a01e1528873958f6f86ab3c734e3e6d891cbe285c61d405fc51e37afa8c7d9f896eb4759a18c334bc30449851e0affb54a6b42f7dae1d3bf936a0f71770dcba260e2b7874d67159f0d0ceebe5d98af056877dd5e6e85be9dc4e82da098192e1fd8f541c82f02716f83c6d4840a36830c3c530c45f5c64a43b2a56834103351189976399572239a96c94ee5cf413859cc3ad72b701553cbccfdb96a16ac218f47571024da8bd5ae9dd880bcdc3f99f9d55ef93f9c94ded08b73baa7c994ab758ab03208523c01d7ce3f23938a7cea4f54d0b664e2a920e103e9d4c42f676b62d0c1d59b290f99b9ade88dac3b04ed2159f9da9eb315a8d311a2895880e1075115c2b6b2538527b3128adde162a86aeffa8d10326cb2a6a50e857bf773c7ae246c856c525444500b9a3858e01ffa6ed61feff122065ddf1034dcbd16dd8aee81571b648bc3939670c903c05c8d0675163c83468303a51c8f616ee4aa44c08ddd4f03244683a4a1c6274ecf0d0a4acf423d01e7715e9522bb3f38653e0110d674def9a1dd6f82b8463db8ed14e82fd6fe8bb7d981dd91a01c642230889550e028fed9071997e92532ef0cb72459cc048d447ffd24f48da1da0c992ff8d2f885b171f02e34b9b185687e9469adef7392351bf10a7f3fe01ea0b33c503aa9944e444a27a5db4c00c2721cad843d5dd8f6b494947bb14b0e9579feeed09526cc4957d9f5226fea3b3acfa859184acc5c5c1bec5225e4ff7c5a1d83289abff6eadb2462f2d6ef5acf1207d6a3a054ab83b8188e7be09cbbd9f893aa0a1a4e0dbac9caa4ec047bb02fff637ed644d072f5fde539ee5826be811749c336d2c2657b0ec6b75b986f0a3dfd1288cb21abdf28a7656e1be6a90ca1e5018b45867eb5d224c7d928494012eac96e7e4382eb5d0b0f8bbe493c98b8515678daa7c75f8cf5fa785f6d6e61cf45a640297110eee62d00e69076b766881da7c2f6d73958bc72fa246539c1c653f6fe115ed26db303087b92eec5fd732980fbc81a24fc9dbd23c4aace922ba0f2627bb46a0121207ce2ed1a7e225215f19fcb8e6fd5179ae97e673d0ba4b9563c20bc33517eabadd5bfc61eb6d235bf03c90cc6436201e2df77d2e6cc1e5a77200154285da7bb243be03930f51956b9987bb016f1ab67cfbc16e589d9641609ab5493a67c38b75552fbdc22c37f8bb89058021005082ec5b1794712a8f0a0ababe63429d4a117346bcf6b0953c78d0521b0e20c9803c295738d4c13ebdb6d3aee5dac7f39e326a67924a943b7ca4b509ef1fbfe4a3b5a5f754c8c67a722d5ff2c4ec1207c9b045565020c37fba5f07207ebd507ae0d1b55af730a50e9b4bd3a0a2ae3ce11c5e544a28bb537264dab1f5c76b13d4ac4116ec3d97c598b8fa26df6e2c739800839e5cd93225062a8130931937edfd79a8ab6705d0aecf4853ceaff17d1bb9b27fa7067ee0cacbd09c9ade3defac8cc81777ea55b71380fe406ef7088318b5aac10f15571adedd8d79e9a583ea20864ade165b98a2484579af5a3ba5bedcdc375e8c4a8b2ca791e5516611741cd91954dcedd229b52b518e5ee75f4cb27ab6a1e52fb220e953465cdd4a0280604b8516e610e1e46f4cefb2ab7e8d434b8b9b038586e182ba6db8fcb772814e7f1578a5332336142ee4d30bc46fb7f9d557ad48e0ccc557231c65500499480439884564e5e69d074c9c4939414fbb005fe5dd3cfb8fa7d56d9796bd05ecadbf02b6f1497449a17c7538e606f8dbd0925e43081ccaf6e7ad3653ba3c8285bbe4c5ba2e14867c5dbc80c81bed109e34ed8d3a850e88970e471439a63acecc507a6d9c893d47fb7e3621272e57ecf1ca4e2f0589b3a347b8621ed5ffd0c5830706c514caf574ace151a1c7c7f047890fdd3f30c0986cd5d47a6a4a3a7a9b0e74386e95da3da10d1430ff0d61ed7ac5382d3741f0f40faa39de8ba09874da5f23f00926a0e6b003172f4f56253c045f5a27d2e615f0c929dee5876eae852e35063844aa96417081484feb4803fa6d4237ca78d6d8f41a9852e3d64b2cdbc74d75382ae5b820354be469c85dab7f6abf57ab56c6c266e83c9393c7d1d8c219a35ab9311966196642b88ca6ac554d90b4c27886f64523a3ebdbfc00b0a59abc02caf05242e6cdc2b24ba073a0d5e78c754aa7f6cd83de59dccc8e8ff0827af4311cf23e081b56b3d38e4eec12c4f20e6f6efeb74eb8e78192242989938bf919e2b9256203b1caca9f854037b79efa07a4e1237a5d254e83d1761376a7e24930daa247cb3caa7943c3eba51939929e393affe144185849d4b77c04fbbaedfe78490327c9c41a186bfa0ff0e20c9ee8e3c157a708bec171e5d56a320e2cd3af15a9d344485930f41714c2713ddcd84ddf59dab51520d1f4ddcb0c74f78d2d55608ec644a3822ba5d1fcb2181f27c98bc3268a37b2d1879d5fe76ccdbd0eaa88c96d4fb7e6dbeda887ca20f2e0b784743096e69644cc1cfb9047d572ea5f990cb01203319dff9b8856d9fffae0e3bc79fa63fc9057ff9bd78a98197eccd900da80c47974204c3269b4f6e4191ac929d3baaf416cd81b3516e66bb8fbe682cfdaeebc2e61a5a8883d21330e99627faa84d4fa8517786a207cc1a24cbba3f1f4117fb389b6eda861abbae18df6eb9284f2e775b82f72403b2300420affdecf74515a99b55d8ddd45904542fd9d2c1a12dae04297322d5387bd50145c2ed6e1dd646beac81ccbd3b4361ec7271bf9c62d1b282577127518f1add9fb9f3ccb6847735c4382395aef5e8301f20c0b82596a982a98ac0d96a4863b501bcb4db8a7ac93dae716835e63c837a07716bc13e23aaed8139512ae0cdca6d256bfa8618f3cb2a936df3b40eb1d9d7ce897b0baee5a065ee7ec7c1876f3b620a9cdc6460dbf83b76fac1776002fc1236ef1d1dc68486b99d87fd04ae2b31aa6589aabeae39b3377156872764e24ab69aee85f983bc0508fb134b567fadc3c190d2f0f5a180a56879fead75a5f27e33f0d52b06c79e97086ba5b80846176cb7887701df76e1d7933f467f6279da6ff069e90f702a3b172c0c9887cac36b4c732797c7730b8133cbda967f935ef2e525ce56493d665dbd5095d0e4279e112381784eaadb3ec1f5df5ca6d324f2f823561c590a8665e0680be4c34d641a339234a7df6f7c66057e2e12dc075d1a0bcf225600cbd5a57808065229e2f421fd5be1d1ab914d8f7815058bb67ed6bef00f3cb94c7ed7549dd0c0c83ebe45c22effb68896d9f4de843ca95153c900e442cc5b2e2b1dcfe0f8982aa41976ef8fd9d7fb8803cbee076e111d8d99066bc289b3ae4c74b7b637f57cbda5dbbad3e9349b4f34f11c2bf3138807282f2c2a50383330619080fe31681f4ca842032c6e636a27b488c1f996d446a45003e7bdcb6cb3bb26c908ad72131d818756140016ca49d5acf9a7779d27ea03eef3b3e153473e5fa4112eee6eb4ce82732b0d053665be00499a11895ca774b989303ebeaeb9ccd29958bd64048eef6c3bdf9ef828a5292877cc57f77daaf511a73a9b2a397437e76381b2311e93b4825785fedc9596e1d16818ed39f27cbfc6b3d4f69f2f655e4753426a2eaf612a985cfddecf66d8ceaef5ac19355cccd395f9ecd36c3aaa5e1ed6484eff8b8806e533112c344948f7ce17e207a849aa35469c0d4e5c2c1354df6cf3c50912b25c9256dec4e7398df7d81946fbd0a90220102a9890c985c30b6ad8b0fdca1193797786f0f0b39a8b9a3dcd3df4e1da29a396476aba632f6b75a117d2a5877e1d8de42c4d0796e8fd161845d187b7e6264b8ed80e7e79e26081e3c431f22b34a330e5163949328f1609ce329406cf6f131d478121a1b3f8b499afd574a0d828f4b0e05e413984d61a7154499a373345dc212fb3ba4217d298969311873c823395d601aa2e055f9585e75e7f2af5bdb2515f8e19d7195ccf7abcaf28b2565496b0cc559797fb94b153e6d796fe1ea9efa540873f3021d0c7892fea0800337e15c5d7b8594651ed9fcdde05fd46c4b40409b718c23b6e463f186b4ecee2b7ad2152b087707e01705a87f5258afe41548128b7e848d4b583d748c9b125981e506e7ac3e94fe9de"]}, @generic="799300b2a4dc4f4d3dcaca4ff1d5f666e6c869eb0cd5d9725448afbe594a3d0666fea4e2c0adf68f3b1b7e32b9ca209bac628dfd87bfac63e3f06a92e267ad7eb0b5d5e05de63fbdaa581443649a6ac2476a5fb39337378e60c58a854e101763dc4e38966e37ad6e9901e346fe05f189d6971e5248aa47625ea985c7ba59e21b6e428cb9"]}, 0x1110}, 0x1, 0x0, 0x0, 0x10}, 0x4000090) renameat2(r3, &(0x7f00000000c0)='./bus\x00', r3, &(0x7f0000000280)='./file0\x00', 0x2) 22:58:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x2000) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$LOOP_CLR_FD(r1, 0x4c01) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) r6 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100), 0x0, 0xfffffffffffffff9) keyctl$revoke(0x3, r6) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 812.374195] binder: undelivered TRANSACTION_ERROR: 29189 22:58:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000000000008000000000000000000400"], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) ioctl$KDADDIO(r4, 0x4b34, 0x5) [ 812.454189] binder: 6415:6417 transaction failed 29189/-22, size 4096-739 line 3014 [ 812.471150] binder: undelivered TRANSACTION_ERROR: 29189 [ 812.522904] binder: 6420:6422 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 812.555789] binder: 6420:6422 transaction failed 29201/-22, size 120-24 line 3199 [ 812.560449] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=28265 sclass=netlink_route_socket [ 812.587980] binder: undelivered TRANSACTION_ERROR: 29201 [ 812.593847] binder: BINDER_SET_CONTEXT_MGR already set [ 812.599362] binder: 6420:6423 ioctl 40046207 0 returned -16 22:58:27 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0, 0x0}) tkill(r1, 0x3c) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:27 executing program 1: sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00008feff0)={0x0, 0x1af}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000700000002000000e0000001000000f5000000000800120002000200000000000000000030006c0002010000ff3f567b000000200200000000152c0000000000000000010a0014bb0000000000000000000000000300050000000000020000000400"/128], 0x80}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) ioctl$LOOP_CLR_FD(r1, 0x4c01) socket$inet6(0xa, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = fcntl$dupfd(r4, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendmmsg(r0, &(0x7f0000000180), 0x400024c, 0x0) 22:58:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) timer_create(0x5, &(0x7f0000000100)={0x0, 0x29, 0x1, @thr={&(0x7f0000000000)="abb3f71bbb5b763f10da014a64bbff3ee76fe2011a1b3c3a67734bb684c982f1ea5158e99e4635c7b2f49310f13a5c1f2da1cae4646f49d382025956e75707f9be7f2b89cc525ab24413da8f2ce57e7bb5b7c54a32df4b0a96cc803c5732a621871d8569f8901bd669af278c15e34f5dfdb940bdcf8e1402fa1156c6325d50efbaed3a8c7081da31457f7c", &(0x7f0000000400)="1cdb1b5918284c24964fec1cb208550b7a57399b6b2b62259484010fc4d16498a528fe8901b166369f735e8ac79fd831c9e0d3aa9d1bb355aacd69eb5bdfa5b6d3e8e6ac5868ff2762648667071bb2b3b701dacbb8d79470ade088192ceffcce91ab9674f3674f25869ccb9cf6b17018fcb190c0b3e49af97d1d95210514f2d3247c2d07ba8b41ee9c39efd85b1d544aa0480d8af7a837403478d8e5a0f561062ab20a39985cfac94ba4e8d52b7e2d9a3af7344c742ab3fde5ba986726b27ea79c4e494dccbfdf03b7b825d6d761297e29f0e9b090e1c9af88f19d1ba35960e3e5817f1b56073a90c7a2191de1aa2c5d89b4a17fe8aa49bfe406b58305"}}, &(0x7f00000001c0)=0x0) timer_delete(r1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x20cd03) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r5 = fcntl$dupfd(r4, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/pid_for_children\x00') ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r3, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce", [0x400000]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x22, 0x0, &(0x7f0000000400)=ANY=[@ANYRESHEX=r3, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[]], 0x0, 0x0, 0x0}) 22:58:27 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000580)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, {0x306}, 0x10, {0x2, 0x0, @broadcast}, 'veth1_to_bridge\x00'}) r3 = socket(0x18, 0x0, 0x3) connect(r3, &(0x7f0000000000)=@nfc_llcp={0x27, 0x1, 0x2, 0x4, 0x31, 0x80, "15d0f8f238b5c51bbef4ca856c7afc4d0e0c940e5c816a36d1ca9a9028ee9f5f437d803c8623c65c3cb58ff542be1975c07b0c0a481fc5c440b52091f575d0", 0x2c}, 0x80) setsockopt$sock_int(r1, 0x1, 0x1e, &(0x7f0000000040)=0xfffffffffffffffc, 0x4) clone(0x20003ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = socket(0x0, 0x80, 0x5) r5 = open(&(0x7f0000000500)='./bus\x00', 0x8141042, 0x80) close(r5) r6 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x6, 0x105082) r7 = memfd_create(&(0x7f0000000000)='}#*nodev\xee\xb8em2N,\x00', 0x0) pwritev(r7, &(0x7f00000000c0)=[{&(0x7f0000000480)="a8", 0x1}], 0x1, 0x80ffe) ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r5, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffed6) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendmmsg(r8, &(0x7f00000002c0)=[{{&(0x7f0000000080)=@nfc={0x27, 0x2}, 0x80, 0x0}}, {{&(0x7f0000000100)=@x25={0x9, @null=' \x00'}, 0x80, 0x0}}], 0x2e1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r10, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r9, 0x0, r10, 0x0, 0x1003, 0x0) fcntl$setstatus(r4, 0x4, 0x2400) pipe(&(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r12, &(0x7f00000001c0), 0x526987c9) getsockopt$ARPT_SO_GET_ENTRIES(r5, 0x0, 0x61, &(0x7f0000000740)=ANY=[], 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000680)='lp\xff\xbf\xfco\xd5\xaa\xfe\x1d\x15\xe2\x95Q\x87\xa4\'\xd0\xd8\xe3\xa1\x83\xf2A/\x80x\xe9\x11\x05\x8dOS\xdb\xc7`J\x94X\xbd\x9eXg\x7f\xfdQu\xcd<\xbfi1\xd4\xbbb\xe2\xf3,^\xbc\xbb\b\x8d#%\";+\xb8\xc3\x9ea\xde\xd2,S\xa1\x14\xbd\xe9\n3-\x88B\x1f\xa5\xba\xfc\x9fTZW\vG\xe4\x1a6\xdf\x14o.mU\x94t\x90P\x84\x7f\x16\x89\xf7S\x8e\x12U}[\xa6\xe7\"`\x14\xdf\x04z:', 0x80) read(r11, &(0x7f0000000200)=""/250, 0x50c7e3e3) sendfile(r6, r5, 0x0, 0x80005) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000003c0)={0x0}, &(0x7f0000000340)=0xb84699fd) syz_open_procfs(r13, &(0x7f0000000180)='ne\x8f/p\x00\xc9\xfc\"\'_\x8f\x93\f\xb9\x00\x00') r14 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r14, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r15 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fcntl$dupfd(r11, 0x0, r15) 22:58:27 executing program 2: openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/icmp\x00') readv(r0, &(0x7f0000002340)=[{&(0x7f00000001c0)=""/4096, 0x141b}], 0x1) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000001600)={0x5, 0x8000, 0x5, 0x101, 0x9, 0x31aa}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'hsr0\x00', 0xd432}) pipe(0x0) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000001640)) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e3e3) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$loop(0x0, 0x4, 0x51d00) write(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f00000001c0)) sendmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000640)="24000000210007021dfdfd946f61", 0xe}], 0x1}, 0x0) ftruncate(0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0x81ff) io_submit(0x0, 0x7, &(0x7f00000019c0)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0xc, 0xb54d, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x683cb2b4bc11b951, r1}, 0x0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x3, 0x2000000000, r1, &(0x7f0000000580), 0x0, 0x2, 0x0, 0x0, r3}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x6, 0xffffffffffffffff, &(0x7f0000000440)="1955ed44daafdf2c1fbe2cdc9333032967022b00ff78a38cff9a746bbe6ae7648045c4d2f1a5fc0ce912a57ef32bd8031b7032c5c302c6e7d505a6d16367d5ad00840299fd09727dca0500a6a9003225e8723cdb1bbbfd0df24bad23559aa10269dd7aae7c5b203a52daeb73c7e9798620d75dc658d8ecd56afdf0106c6ed6236e39eaed6bb147f4a46e1d038949ba031437d1dcaf0ab213da7ef3d0f9d501da95116a80c1fb77828bafb415501abf87de4e1d1c00ce31a26ccdeb20709abe0d0ee9130e7de81f63e242792ecf814ab09934ce7ffc2eb298142b1af4b11b5913c4797d29ed839a224744723522e7f8ff9bcfaa87e0d86a177559582a21442b53205fb181943ecfcf7416ad285ae585f82a19276f627e4f04f4030324db1c37eb", 0x120, 0xdf9b, 0x0, 0x3, r3}, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x2, 0x63, r4, &(0x7f00000007c0)="f63c68e1ace4a26b9fc422d7760b0513b5ef2fadcb32680a8576f85ecc338a556ca53d197a56e2964ce760a5e11b83f3f5ef70cda6e4c72249b1c4ab96b7c0915ffef71c595bf581026268161e7ea2ad26656f34e62fee4e40ed5b9c243d68a4029ea4f79a0e02d0b4dbd124609242264bff33e9f7956c5fba6e4b6538dc3e653772cc87051503968f708ce445f696dbe416f122d3dd36bfaa2231cabe00b513a78fa33a402280518e6a552c82b9182007f3dba06758577e835c68af39851751ddf0eb891698833583efaf421b3355b93629ef2e33d712f77a9ca226479f8e933950a1743dfea019b3a5bac29e917ccebec14a68fd79365cbe0269c27d10c0514ecec1370e8337caa84253fc59942abc42b33c521ee3d5ecf54be132594806f5f6fef16371bbcf821accf35f5868b8c91b3e8dccbab5032060794ed5b7fa852c3c176843ec6aab78d6693c8c45a591f1806e68727d0c74b9a49f12cceea792e15c3ec1587245ca9a6b4a88bb2b28e7e008bea9149344ce168800ccd4509c41d16041bdd06cb0a20624738c82d0c2754aaa4133d5eaaef6af3b3f5d9e0961147e10278237bbc4cb4922b32c79b1aed69b6f328bf5f1a653101dfdfa75eead7ee98e55ef9ae97b8b415bc00f7381a6af34201dd546518b7d2e735bb354ef50b7a2fb802d4cca013cb863b714b85601cac24dba63530ea3d8824bc8a379c6f10ee785c4c400b1e25c6e472f89b8629a93647db3ac0fd861cda9806476ff39ccee49065c7815494a30a358a7217ac263f1f714fe530469e8001a8bba848c647f8d8f1afb7d66302600448807c68321e4bcef1e36532a9314c86508673f89da7c6a882de94f14571f77137ec77688d8f3ba47d08beb8c8bdb50501163a855efb57e548545d8246a76db1afee8a5aef0d38f36c1d10f63b434d3ebb8e91f233a9154d449a25e8d30e030f911a4557b1cac0e3ae3805c6867aa130b367d4f51b71a53d83a13292603f47707ebef215a0830d4c9e8c13fe62f55da46afa7254850c00be6a6eda5da5c54210c9fff40f94a852b9cb8eca3002901c0e6da9481d2b90c157151f0f5a3768ef466eca1f42633de1216db61652c590960e0cbafdec33e79ec7055683dc2a75b97509830a691338e852472f68aabec5c42aa40fbce681a50f62a48b57291020a02b4bf467d231de14e4c5164637be06683bf46f2c94393e2350abddf6d62aecade70a75b63991d0438ad3b693c6ef72d0c6d5f5ff9d0d1dfe9b046c2ef5c485a5e6a1c05c301bda77e9992121192da6d963b944cbe5ca97600cc4e2915fcce5faca955f47565c8cb82d542b114db9aa599d59824714423af8e6a78a5d9cead32457e55be397b7a9ffa5b97e428bd6ad20bff08b8c471f74a01350ba691ab97d15cffb93c29f50bc50bb628d9c2908952045d4cfc9d4a5a5e043cc43a245fc5f44be39a060e32818fa784a3dce6e74ac99e1263e617e2d3b1c8a06bcafb4ea7e54abca0db23606aedad0d8e2aae8e4d258a0aac4b8496e2eb3081a5a04255ad2914a56154b42569e41243e5ab098034da8c4e7c63c044142cc9d4101565155d3dd5caeed0ab2cde2746b2be69ee46c47c745fd51e5b9c650b4d3f09b37e85b828d1641480dabc33c2d6feaf9ac659454975e925a19127814b3799940f7941b9dab21f425ad0e04065661e02a254a81097c5b410957e50e13354b0bf92c66cfb12b8179c0ead4938ddf65ef6643264aafd8256e1fe132830f8f380a17008923345ec09e8ad67b5458680c2071a0945e06abd15e8d95f64875f9a54588667f371b94b1501a278baf66899e7bd20a38b09d8008160e957c64cd468e198cd03eadcc2d18a0185411f12a87bb061aab02ba4822bfa63c524732076d453fa33050ae36f32290aec44cf1c0e87e96d48a06c576e0fee3ae2276d317e556434da4f7f0f294179ef7189f3232742a4367542be1ebe1da17acd94e9a6ca979c1bfb2c96a15bcc0c907cb08f2bea30c036945f6be1fad21160e2e8f40d2aed1eb3212bc86348fd3530a3c5af09d09888fdf88b59a83c9af8120c9d63c2766f23fe6f040273ee086c10742e9c5419e08f1afb00be99077f187796df7e28228e3c21e5c17abe08689f5ba5ffd1d0af918693b302e200c9808155a60a102b4553ceeb1c16d8a58c13130a5d3e282f0a35dd056d6101980a8ee33a72e69b6a84d3128d96ef51be4e5756409a64d165462fffc6c08a6dbce7c1d942c6f6386a13dd8656f35547fd0181e5378dbb2f392b2cfc2dbdc38e5de7cd7e26a8369e2e204a4c2492a76560a251aaf54815a8fcd803f9411bc29a48ad3ba56006535da5ebc7ad6e31c4eaa4687bbd7d9d2dfed754d725c7ca8a7abc2c6679571512927b5b6bd56079ea0c94f6a03465140852d81f6ed2cabca260a3f0967a98f0e7dadbd2a4a89e620de8977d0789c9bd397b8a08282d8dedb6c87ee84edd8a6c1193a8a259ea439981b8e66a6c949851521341ff203dd6e73e06c434f28e40edcd811d084826950cf5bbbdb2e8c3db25864b75916455703fc5276f6a4124a888ad1f5c84baf46fcbd95c1351222bf2e7bc1e7960e3c976bffa994f40a5395554c395c958c7d16fce53bdb3a9f0aa86aa7b3cbfead6e5a1603935b1ba1769be97f1428fd37f858395b03448a8fdce209e622d07c708076cc71eb13e6123b2934c0e617d64ba9cc644069e5c19373d2ba2266606209c29581e5d696dcf63de83a1104e74aca7d258ccd56eeaee5570659ce42fa00345d91e01e5427aa4e4da168d8239d12e84a2ad1a3cb289e56985eb22e40a011e77db1ee0212ba6b41e81565da7df4622a54429ba8458244bf4de593afc3c7ed8638f7fa20462b3b97bcd7781455f3d2e1ed35f02afa24ec1692231059dd651b591461f21669df858abfacf798949c1e5b562c57542391577d75298d62502393c13d5f06f89726493699ac2d166e540089d05af373ab9a2b7df01de542594445bde5a8472b15386332b465191bba78112b9c101b839dfc2c5cd22c7fdbf214dc5b085f2e496493fd68c3741073accb2dad9959d5c19dcff95b7644cf71e74a8ac64805c50b2c3851ef37a0322da907ae4a6f31dae665a6beeb59a6c3fd14979a0a9d58f1c5b3256b76c7c189c3a124feb4f6a6bc66746e4cb4eda222c367e11d427c5be6fb5845fc48aca8c3e7f89f5c9cbe50ce3cbc59421729b1f845b7e331e486c0eb43440848ac44cf36bcd7797e9aec4086aaf985953ede0e17fd41e7fab01e99002635392e43b011218e078a9f65e2fa92c09fd1a00e174b808f41451ea1243507b3ec121635462bfa96acda59227576e71286fdcd02702eb14e5a8e4604574ecee3efeed944620eeabd6439c8d827466792e6e066ff6066bd8dc3038e5682a01c7dfa84a04e976ab751c1ba507ba2050cb41a99a62027e1ffd25b42d96a4505598f6681ca5ce0cb8108ce8cd6f7ed44eb00d656c76c97a247e5e9a7b50c9485456e41814825874325d82611df9252c6a4050a3db53868d1b7bc942da57f2bc328977a5a7087de126318db3e3cc71ee09c40e129e9602b56cb2a585a991f223046a4c3895f800f53d30d2d02adbf0a138e3221e2edafb2ae8d79a6d7addc3ccc5eeac2a3c3e2d046e63b8a54c044eae03ccb4ec38fc6a2723f722e19620d17c10ca58b0b2398237d25fe83b36f72e3cfdd4d4620c1542ad9cbbe5e8a50921a7fa72d4dc29579d9f83317422d70334a5769c908dc056b677268b8227f92ed3a295cd1627c6b16ac67ff5219e16ee482ea04300f5202156824cd0785658b9ddaa90da3da53c04fcc45086e366bcca9b54889051981ffca6ad61dea4d144acc902460003949898bc1a0be025dfad3512cb008d35a6dde2a42071f17fcf26cd7e18100189907a678bc79455487b1db3ed90184b65763b5f6ccad945a63560474cce3ebc879330911105d747431f6950840fd16bc4b8264a926c340e7a4b71d4b180bd931579d69b5613c622eaea58c9472e922c3491f68b185030a4e2ca7a73c90d1eb95113b1c3c6f666a38018aa6206de5fdb90ecd224d5a1bb2ede1b597f633cf0321458edd161351969327dd253cd2912a90b2d3016387f1e584ff4ced8ecc5a7d9ef2272fc58c99006042b1d575d7cce9fcb3127a82622cf74097388283298aade0522597484152cb69d1ee880104b1bb84a1a766406e8d9352fc8c7023f8742c68e3f2c661c94583821415ec720307b756e0a048f9e28f2e8105ec515601492df3580aac7584f968e0d24d7e0eecfe352aa24f27ce5abc5ba0a7511c10343290eb3821c096c25da662e73a5de1b9b7e4c21f40afa0b368435e1be703298d866b683d93a7fbec5cab66f974597001cc10e37f0cc5c28718f8f65c4424b8579b80ad2dc9a736c3e82be57c596eb61d3d12ccbf0aab37833a90b2829aa9d860b48ac1325e4d21912d18dfe09f64a209c1f13504332e8fb490db4d7ad5b95209218bfd4486b5e1aa6e3d7fd9bf81d87f0925bc6271fdc237bc0b3e89b4cefd36e47274f7d6baadff882b7b0406ab7652f6c7e4111389b2220d1129f422709280abef095737114038a1a4e5806cbfba7b623d2544f95e2dd4320da5f1a6f3269b6fd929c35bc6e561e1d1486274d0e43005893d555a20149a51f0ee466ddb48a7ea921f8e728ee413632a820c740ad158bd37aa6d37ec2b6ce037f37721f6ee0629b82e1ba8cc7141716aa158ef482fd98669c5c60bcdfa02fb649869665c3af111d4a9eb1575824bcc7d70b827830dc9ec41e810d3c063e468428f3b70de3b9a08f59c0fc82bcb9507aec2b927a2fac58760d643a6f773f4e214cd96fdda7cbde2f358d27de89fcc26cf79e3076a3c4b3bf4c50cad383ae4b4ac6a2770fc22aa5aae46f78eae5d38a1f40cc92fd52cd334ad71421a1404c9b2660d209bfcdf3566181d62ee39ad03b8a04907196f4333ab4c91ec589aa9422e2694327dfb8c14f9013f5c64beeab6e4925057d71cdaf3856c8c3c4dde291259327870e507fa6edde5db52eca2617765cbc2ccce7eeffa637f33b6e4b2fd71b6b6171e7", 0xe0c, 0x2, 0x0, 0x1}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x7, 0xffffffff, 0xffffffffffffffff, &(0x7f0000001800)="86b7e0ff9e6590e8da72fb6b63de2056a0bf4c7d57ac3b65ad10674df9a825fbdf71b923a1dbde9789946dd6be2b3c963133cd55", 0x34, 0x0, 0x0, 0x5}, &(0x7f0000001980)={0x0, 0x0, 0x0, 0xd57ea18703433360, 0x0, 0xffffffffffffffff, &(0x7f0000001880)="b6db78d7f4ba81314af85f29b659359d8d5f31366fda534a66bc58fd444ba1fabca895cb7b4662fb7e5d4700f34192ad02acd240b6ef501f4c32c1efd7bd861957332991cf8f15060f692ad534683c3ebb4f9b965e9c7e0b47a144dd300b8860cb21fa2cf15a1392fc28ef4febed55c8d6afb40926af543af19bbbf85907585679ffba52d65c0f80f7d4cdb98d93fef78c0765cdadcfd28f33580266b3da59bfb761cb476ecf", 0xa6, 0x9}]) setitimer(0x1, &(0x7f00000000c0)={{}, {0x0, 0x2710}}, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f00000001c0), 0xfffffef3) read(r5, &(0x7f0000000200)=""/250, 0x50c7e5e2) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r8 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/load\x00', 0x2, 0x0) dup2(r8, r2) sendfile(r6, r7, 0x0, 0x80000001) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000100)='net/icmp\x00') write$cgroup_int(r9, &(0x7f0000000300), 0x12) [ 813.487870] binder: 6438:6440 unknown command 808482864 [ 813.493838] binder_alloc: 6437: binder_alloc_buf size 4840 failed, no address space [ 813.504624] binder: 6438:6440 ioctl c0306201 20000080 returned -22 [ 813.511460] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 813.523119] binder: 6438:6448 unknown command 808482864 [ 813.529702] binder: 6437:6441 transaction failed 29201/-28, size 4096-739 line 3137 22:58:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r1) add_key$keyring(0x0, 0x0, 0x0, 0x0, r1) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r1) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) keyctl$revoke(0x3, r1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="160000000000000000000000000000000000000000000000f5295c5bb97b61ca6e2bfc93cbf4dabc7c60fef9353a40bdf7141c8b6d4ebb132f42b20f4bdf6ad5b0cf2774b26c16932b8419a180cde7bc156fc563b63271f4374e2c198ad1de7824f159c213974fa1835aec3a3694f08c482bdbe724d98344dfa1bf5a370289c41808c2758ad00ac85b2ea9c4fdd29fea10d908b489a0f0b0f7a1e13c4057103d4fcb99fee438df9aa78ea3feabea256075009fe8464fe79a6793fc031bb3fbdc5b61377829c873fed55ecd1645173888dc95c24ce23b2fad"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) 22:58:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x44000, 0x0) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000000040)=0x7fff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x6f, 0x0, &(0x7f0000000140)=[@acquire_done={0x40106309, 0x1}], 0x1e3, 0x0, 0x0}) [ 813.547779] binder: 6438:6448 ioctl c0306201 20000080 returned -22 [ 813.567155] binder: undelivered TRANSACTION_ERROR: 29201 22:58:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xe4, 0x18, 0x200, 0x70bd25, 0x25dfdbfd, {0x6}, [@generic="7438f4dd7cf8b9e3bc0a7c5489b817cee50a0a1c85033364a4b2e1ded17a372d99cf3512cc0788401662cfa5dc600e6e8861ec9820a16d5b95dc0d11109e97709636900e05deccb0d930f8a457d5d2aebd365989fb6265de52591badb2c509d1c71a14e3920bf81725637f6014b903d92d6a48cf73a5903c1bbe8f6648b92f9ffe4ee4bff871d0bd4ce9b301ae56f3e12ede7d09085c0351aae4ae42f063ae49050d7c1fc94717e16962a4942c45b2a7871569a609b32d8c65fedd1343248baee0ebbdb21d3785", @typed={0x8, 0x48, @str='\x00'}]}, 0xe4}, 0x1, 0x0, 0x0, 0x800}, 0x8000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00000000f8ffffff0000040000000000203100000000"], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) 22:58:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket(0x1, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x26c) sendmmsg(r3, &(0x7f0000005040)=[{{&(0x7f0000000180)=@xdp={0x2c, 0xffffa888, r5}, 0x80, 0x0}}], 0x300, 0x0) r6 = getuid() setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, @in=@empty, 0x4e22, 0x0, 0x4e21, 0x9, 0x2, 0x40, 0x20, 0x2f, r5, r6}, {0x6, 0x5, 0x10000, 0x100, 0x3, 0x1, 0xfffffffffffffff7, 0x3f}, {0xffff, 0x5, 0xc67, 0x9}, 0xfa, 0x6e6bb7, 0x0, 0x0, 0x0, 0x9b67fc728b380be4}, {{@in6=@rand_addr="e61c7241818a99e6f2636f4022fd1ed2", 0x4d3, 0x3c}, 0x0, @in6=@ipv4={[], [], @multicast1}, 0x3502, 0x0, 0x3, 0x0, 0x5, 0x7fffffff, 0x100}}, 0xe8) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$EVIOCGPHYS(r2, 0x80404507, &(0x7f0000000000)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = fcntl$dupfd(r8, 0x0, r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="516348400010000000000000000000000000001a000000000000000000000000000000000010000000000000e3020000000000000000000000000000000000000000000000000000000000008962f63ab13738566d2128bfa273a1860e80a24f3c754022687e34a9e4deaa75d44e835500d6aa9c"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x9d) 22:58:27 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0, 0x0}) tkill(r1, 0x3c) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:27 executing program 1: syz_open_dev$loop(&(0x7f0000000340)='/de\r\xcd\x1a@\xb1\x02\x91\x11', 0x6e04, 0x182) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000480)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0xfffffffffffffffe) fcntl$getownex(r1, 0x10, 0x0) inotify_init() fcntl$setstatus(r1, 0x4, 0x6100) openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x2a0241, 0x0) fcntl$getflags(0xffffffffffffffff, 0xe) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa) truncate(&(0x7f00000000c0)='./bus\x00', 0x800) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x2) sendfile(r1, r2, &(0x7f0000000040), 0x8000fffffffe) writev(r1, 0x0, 0x0) r3 = open(&(0x7f00000004c0)='./file1\x00', 0x101000, 0xf0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) r4 = socket$inet6(0xa, 0x480040004000, 0x2) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) connect$unix(r6, 0x0, 0x0) epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x40, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000b82000)) sendfile(r8, 0xffffffffffffffff, 0x0, 0x800) write(r5, &(0x7f00000001c0), 0xfffffef3) fcntl$lock(r5, 0x7, &(0x7f0000000100)={0x0, 0x1, 0xd95}) openat$full(0xffffffffffffff9c, 0x0, 0x80, 0x0) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x600000, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = dup(r9) ioctl$PERF_EVENT_IOC_ENABLE(r10, 0x8912, 0x400200) getsockopt$inet6_IPV6_IPSEC_POLICY(r10, 0x29, 0x22, &(0x7f0000000600)={{{@in=@multicast2, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@initdev}}, &(0x7f0000000240)=0xfffffffffffffe07) setsockopt$inet6_IPV6_PKTINFO(r4, 0x29, 0x32, &(0x7f00000028c0)={@dev, r11}, 0x14) setsockopt$packet_drop_memb(r3, 0x107, 0x2, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000080)="0a5cc80700315f85") write$selinux_load(0xffffffffffffffff, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0xa5cc554) [ 813.696032] binder: 6469:6471 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 813.723190] binder: 6472:6475 unknown command 1078485841 [ 813.744845] binder: 6472:6475 ioctl c0306201 20000200 returned -22 [ 813.752861] binder: 6469:6471 transaction failed 29201/-22, size 120-24 line 3199 22:58:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x1802) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:27 executing program 2: openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/icmp\x00') readv(r0, &(0x7f0000002340)=[{&(0x7f00000001c0)=""/4096, 0x141b}], 0x1) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000001600)={0x5, 0x8000, 0x5, 0x101, 0x9, 0x31aa}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'hsr0\x00', 0xd432}) pipe(0x0) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000001640)) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e3e3) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$loop(0x0, 0x4, 0x51d00) write(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f00000001c0)) sendmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000640)="24000000210007021dfdfd946f61", 0xe}], 0x1}, 0x0) ftruncate(0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0x81ff) io_submit(0x0, 0x7, &(0x7f00000019c0)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0xc, 0xb54d, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x683cb2b4bc11b951, r1}, 0x0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x3, 0x2000000000, r1, &(0x7f0000000580), 0x0, 0x2, 0x0, 0x0, r3}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x6, 0xffffffffffffffff, &(0x7f0000000440)="1955ed44daafdf2c1fbe2cdc9333032967022b00ff78a38cff9a746bbe6ae7648045c4d2f1a5fc0ce912a57ef32bd8031b7032c5c302c6e7d505a6d16367d5ad00840299fd09727dca0500a6a9003225e8723cdb1bbbfd0df24bad23559aa10269dd7aae7c5b203a52daeb73c7e9798620d75dc658d8ecd56afdf0106c6ed6236e39eaed6bb147f4a46e1d038949ba031437d1dcaf0ab213da7ef3d0f9d501da95116a80c1fb77828bafb415501abf87de4e1d1c00ce31a26ccdeb20709abe0d0ee9130e7de81f63e242792ecf814ab09934ce7ffc2eb298142b1af4b11b5913c4797d29ed839a224744723522e7f8ff9bcfaa87e0d86a177559582a21442b53205fb181943ecfcf7416ad285ae585f82a19276f627e4f04f4030324db1c37eb", 0x120, 0xdf9b, 0x0, 0x3, r3}, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x2, 0x63, r4, &(0x7f00000007c0)="f63c68e1ace4a26b9fc422d7760b0513b5ef2fadcb32680a8576f85ecc338a556ca53d197a56e2964ce760a5e11b83f3f5ef70cda6e4c72249b1c4ab96b7c0915ffef71c595bf581026268161e7ea2ad26656f34e62fee4e40ed5b9c243d68a4029ea4f79a0e02d0b4dbd124609242264bff33e9f7956c5fba6e4b6538dc3e653772cc87051503968f708ce445f696dbe416f122d3dd36bfaa2231cabe00b513a78fa33a402280518e6a552c82b9182007f3dba06758577e835c68af39851751ddf0eb891698833583efaf421b3355b93629ef2e33d712f77a9ca226479f8e933950a1743dfea019b3a5bac29e917ccebec14a68fd79365cbe0269c27d10c0514ecec1370e8337caa84253fc59942abc42b33c521ee3d5ecf54be132594806f5f6fef16371bbcf821accf35f5868b8c91b3e8dccbab5032060794ed5b7fa852c3c176843ec6aab78d6693c8c45a591f1806e68727d0c74b9a49f12cceea792e15c3ec1587245ca9a6b4a88bb2b28e7e008bea9149344ce168800ccd4509c41d16041bdd06cb0a20624738c82d0c2754aaa4133d5eaaef6af3b3f5d9e0961147e10278237bbc4cb4922b32c79b1aed69b6f328bf5f1a653101dfdfa75eead7ee98e55ef9ae97b8b415bc00f7381a6af34201dd546518b7d2e735bb354ef50b7a2fb802d4cca013cb863b714b85601cac24dba63530ea3d8824bc8a379c6f10ee785c4c400b1e25c6e472f89b8629a93647db3ac0fd861cda9806476ff39ccee49065c7815494a30a358a7217ac263f1f714fe530469e8001a8bba848c647f8d8f1afb7d66302600448807c68321e4bcef1e36532a9314c86508673f89da7c6a882de94f14571f77137ec77688d8f3ba47d08beb8c8bdb50501163a855efb57e548545d8246a76db1afee8a5aef0d38f36c1d10f63b434d3ebb8e91f233a9154d449a25e8d30e030f911a4557b1cac0e3ae3805c6867aa130b367d4f51b71a53d83a13292603f47707ebef215a0830d4c9e8c13fe62f55da46afa7254850c00be6a6eda5da5c54210c9fff40f94a852b9cb8eca3002901c0e6da9481d2b90c157151f0f5a3768ef466eca1f42633de1216db61652c590960e0cbafdec33e79ec7055683dc2a75b97509830a691338e852472f68aabec5c42aa40fbce681a50f62a48b57291020a02b4bf467d231de14e4c5164637be06683bf46f2c94393e2350abddf6d62aecade70a75b63991d0438ad3b693c6ef72d0c6d5f5ff9d0d1dfe9b046c2ef5c485a5e6a1c05c301bda77e9992121192da6d963b944cbe5ca97600cc4e2915fcce5faca955f47565c8cb82d542b114db9aa599d59824714423af8e6a78a5d9cead32457e55be397b7a9ffa5b97e428bd6ad20bff08b8c471f74a01350ba691ab97d15cffb93c29f50bc50bb628d9c2908952045d4cfc9d4a5a5e043cc43a245fc5f44be39a060e32818fa784a3dce6e74ac99e1263e617e2d3b1c8a06bcafb4ea7e54abca0db23606aedad0d8e2aae8e4d258a0aac4b8496e2eb3081a5a04255ad2914a56154b42569e41243e5ab098034da8c4e7c63c044142cc9d4101565155d3dd5caeed0ab2cde2746b2be69ee46c47c745fd51e5b9c650b4d3f09b37e85b828d1641480dabc33c2d6feaf9ac659454975e925a19127814b3799940f7941b9dab21f425ad0e04065661e02a254a81097c5b410957e50e13354b0bf92c66cfb12b8179c0ead4938ddf65ef6643264aafd8256e1fe132830f8f380a17008923345ec09e8ad67b5458680c2071a0945e06abd15e8d95f64875f9a54588667f371b94b1501a278baf66899e7bd20a38b09d8008160e957c64cd468e198cd03eadcc2d18a0185411f12a87bb061aab02ba4822bfa63c524732076d453fa33050ae36f32290aec44cf1c0e87e96d48a06c576e0fee3ae2276d317e556434da4f7f0f294179ef7189f3232742a4367542be1ebe1da17acd94e9a6ca979c1bfb2c96a15bcc0c907cb08f2bea30c036945f6be1fad21160e2e8f40d2aed1eb3212bc86348fd3530a3c5af09d09888fdf88b59a83c9af8120c9d63c2766f23fe6f040273ee086c10742e9c5419e08f1afb00be99077f187796df7e28228e3c21e5c17abe08689f5ba5ffd1d0af918693b302e200c9808155a60a102b4553ceeb1c16d8a58c13130a5d3e282f0a35dd056d6101980a8ee33a72e69b6a84d3128d96ef51be4e5756409a64d165462fffc6c08a6dbce7c1d942c6f6386a13dd8656f35547fd0181e5378dbb2f392b2cfc2dbdc38e5de7cd7e26a8369e2e204a4c2492a76560a251aaf54815a8fcd803f9411bc29a48ad3ba56006535da5ebc7ad6e31c4eaa4687bbd7d9d2dfed754d725c7ca8a7abc2c6679571512927b5b6bd56079ea0c94f6a03465140852d81f6ed2cabca260a3f0967a98f0e7dadbd2a4a89e620de8977d0789c9bd397b8a08282d8dedb6c87ee84edd8a6c1193a8a259ea439981b8e66a6c949851521341ff203dd6e73e06c434f28e40edcd811d084826950cf5bbbdb2e8c3db25864b75916455703fc5276f6a4124a888ad1f5c84baf46fcbd95c1351222bf2e7bc1e7960e3c976bffa994f40a5395554c395c958c7d16fce53bdb3a9f0aa86aa7b3cbfead6e5a1603935b1ba1769be97f1428fd37f858395b03448a8fdce209e622d07c708076cc71eb13e6123b2934c0e617d64ba9cc644069e5c19373d2ba2266606209c29581e5d696dcf63de83a1104e74aca7d258ccd56eeaee5570659ce42fa00345d91e01e5427aa4e4da168d8239d12e84a2ad1a3cb289e56985eb22e40a011e77db1ee0212ba6b41e81565da7df4622a54429ba8458244bf4de593afc3c7ed8638f7fa20462b3b97bcd7781455f3d2e1ed35f02afa24ec1692231059dd651b591461f21669df858abfacf798949c1e5b562c57542391577d75298d62502393c13d5f06f89726493699ac2d166e540089d05af373ab9a2b7df01de542594445bde5a8472b15386332b465191bba78112b9c101b839dfc2c5cd22c7fdbf214dc5b085f2e496493fd68c3741073accb2dad9959d5c19dcff95b7644cf71e74a8ac64805c50b2c3851ef37a0322da907ae4a6f31dae665a6beeb59a6c3fd14979a0a9d58f1c5b3256b76c7c189c3a124feb4f6a6bc66746e4cb4eda222c367e11d427c5be6fb5845fc48aca8c3e7f89f5c9cbe50ce3cbc59421729b1f845b7e331e486c0eb43440848ac44cf36bcd7797e9aec4086aaf985953ede0e17fd41e7fab01e99002635392e43b011218e078a9f65e2fa92c09fd1a00e174b808f41451ea1243507b3ec121635462bfa96acda59227576e71286fdcd02702eb14e5a8e4604574ecee3efeed944620eeabd6439c8d827466792e6e066ff6066bd8dc3038e5682a01c7dfa84a04e976ab751c1ba507ba2050cb41a99a62027e1ffd25b42d96a4505598f6681ca5ce0cb8108ce8cd6f7ed44eb00d656c76c97a247e5e9a7b50c9485456e41814825874325d82611df9252c6a4050a3db53868d1b7bc942da57f2bc328977a5a7087de126318db3e3cc71ee09c40e129e9602b56cb2a585a991f223046a4c3895f800f53d30d2d02adbf0a138e3221e2edafb2ae8d79a6d7addc3ccc5eeac2a3c3e2d046e63b8a54c044eae03ccb4ec38fc6a2723f722e19620d17c10ca58b0b2398237d25fe83b36f72e3cfdd4d4620c1542ad9cbbe5e8a50921a7fa72d4dc29579d9f83317422d70334a5769c908dc056b677268b8227f92ed3a295cd1627c6b16ac67ff5219e16ee482ea04300f5202156824cd0785658b9ddaa90da3da53c04fcc45086e366bcca9b54889051981ffca6ad61dea4d144acc902460003949898bc1a0be025dfad3512cb008d35a6dde2a42071f17fcf26cd7e18100189907a678bc79455487b1db3ed90184b65763b5f6ccad945a63560474cce3ebc879330911105d747431f6950840fd16bc4b8264a926c340e7a4b71d4b180bd931579d69b5613c622eaea58c9472e922c3491f68b185030a4e2ca7a73c90d1eb95113b1c3c6f666a38018aa6206de5fdb90ecd224d5a1bb2ede1b597f633cf0321458edd161351969327dd253cd2912a90b2d3016387f1e584ff4ced8ecc5a7d9ef2272fc58c99006042b1d575d7cce9fcb3127a82622cf74097388283298aade0522597484152cb69d1ee880104b1bb84a1a766406e8d9352fc8c7023f8742c68e3f2c661c94583821415ec720307b756e0a048f9e28f2e8105ec515601492df3580aac7584f968e0d24d7e0eecfe352aa24f27ce5abc5ba0a7511c10343290eb3821c096c25da662e73a5de1b9b7e4c21f40afa0b368435e1be703298d866b683d93a7fbec5cab66f974597001cc10e37f0cc5c28718f8f65c4424b8579b80ad2dc9a736c3e82be57c596eb61d3d12ccbf0aab37833a90b2829aa9d860b48ac1325e4d21912d18dfe09f64a209c1f13504332e8fb490db4d7ad5b95209218bfd4486b5e1aa6e3d7fd9bf81d87f0925bc6271fdc237bc0b3e89b4cefd36e47274f7d6baadff882b7b0406ab7652f6c7e4111389b2220d1129f422709280abef095737114038a1a4e5806cbfba7b623d2544f95e2dd4320da5f1a6f3269b6fd929c35bc6e561e1d1486274d0e43005893d555a20149a51f0ee466ddb48a7ea921f8e728ee413632a820c740ad158bd37aa6d37ec2b6ce037f37721f6ee0629b82e1ba8cc7141716aa158ef482fd98669c5c60bcdfa02fb649869665c3af111d4a9eb1575824bcc7d70b827830dc9ec41e810d3c063e468428f3b70de3b9a08f59c0fc82bcb9507aec2b927a2fac58760d643a6f773f4e214cd96fdda7cbde2f358d27de89fcc26cf79e3076a3c4b3bf4c50cad383ae4b4ac6a2770fc22aa5aae46f78eae5d38a1f40cc92fd52cd334ad71421a1404c9b2660d209bfcdf3566181d62ee39ad03b8a04907196f4333ab4c91ec589aa9422e2694327dfb8c14f9013f5c64beeab6e4925057d71cdaf3856c8c3c4dde291259327870e507fa6edde5db52eca2617765cbc2ccce7eeffa637f33b6e4b2fd71b6b6171e7", 0xe0c, 0x2, 0x0, 0x1}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x7, 0xffffffff, 0xffffffffffffffff, &(0x7f0000001800)="86b7e0ff9e6590e8da72fb6b63de2056a0bf4c7d57ac3b65ad10674df9a825fbdf71b923a1dbde9789946dd6be2b3c963133cd55", 0x34, 0x0, 0x0, 0x5}, &(0x7f0000001980)={0x0, 0x0, 0x0, 0xd57ea18703433360, 0x0, 0xffffffffffffffff, &(0x7f0000001880)="b6db78d7f4ba81314af85f29b659359d8d5f31366fda534a66bc58fd444ba1fabca895cb7b4662fb7e5d4700f34192ad02acd240b6ef501f4c32c1efd7bd861957332991cf8f15060f692ad534683c3ebb4f9b965e9c7e0b47a144dd300b8860cb21fa2cf15a1392fc28ef4febed55c8d6afb40926af543af19bbbf85907585679ffba52d65c0f80f7d4cdb98d93fef78c0765cdadcfd28f33580266b3da59bfb761cb476ecf", 0xa6, 0x9}]) setitimer(0x1, &(0x7f00000000c0)={{}, {0x0, 0x2710}}, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f00000001c0), 0xfffffef3) read(r5, &(0x7f0000000200)=""/250, 0x50c7e5e2) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r8 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/load\x00', 0x2, 0x0) dup2(r8, r2) sendfile(r6, r7, 0x0, 0x80000001) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000100)='net/icmp\x00') write$cgroup_int(r9, &(0x7f0000000300), 0x12) [ 813.786360] binder: undelivered TRANSACTION_ERROR: 29201 [ 813.796809] binder: 6469:6485 got transaction with invalid offset (4294966837, min 80 max 120) or object. 22:58:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x7d, 0x2) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r4 = dup2(r2, r3) ioctl$PPPIOCSDEBUG(r4, 0x40047440, &(0x7f0000000000)=0xfff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="006340fa22410440ee00000000000000000000000000000000000000000000000000000000000000780000000000000018000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) r6 = creat(&(0x7f0000000180)='./file0\x00', 0x382) ioctl$FS_IOC_FIEMAP(r6, 0xc020660b, &(0x7f0000000040)=ANY=[@ANYBLOB="000000000000000051ffffffffffffffb68ffcfffffffd0b00"/34]) dup(0xffffffffffffffff) ioctl$sock_SIOCBRADDBR(r6, 0x89a0, &(0x7f0000000140)='lapb0\x00') 22:58:27 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0, 0x0}) tkill(r1, 0x3c) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 813.873213] binder: 6469:6485 transaction failed 29201/-22, size 120-24 line 3199 [ 813.882647] binder_alloc: 6488: binder_alloc_buf size 4840 failed, no address space [ 813.896665] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 813.905765] binder: undelivered TRANSACTION_ERROR: 29201 [ 813.913977] binder: 6488:6491 transaction failed 29201/-28, size 4096-739 line 3137 22:58:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) write$P9_RFLUSH(r2, &(0x7f00000001c0)={0x7, 0x6d, 0x2}, 0x7) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x54, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000240)={@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/73, 0x49, 0x1, 0xd}, @flat=@handle={0x73682a85, 0x1}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}, 0x1400}], 0xae, 0x0, &(0x7f0000000340)="e99151eb64b19c05c689f115ad71c51513a392fca565d8c2b4afb0678e626fd4738ffd92e00e9bd534fc21192bc88ffd177d75bc2c0b2f9d5cc7d8233836901b19abd28d53760fdd47dbb0c4bcfad9633c47c141ba4ebff799932cfb5e9d591b036c0f2b379581cfafab651f1b2f8f16f39862e5daff462be6a8d220d4766869899f164897a606fd24d47d6ce2fa8c0ec041ecd927fc2dfbcfb595c984fa63e0b69f37b54e55e206023423cd0a07"}) r3 = syz_open_dev$binderN(0x0, 0x0, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:27 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000580)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, {0x306}, 0x10, {0x2, 0x0, @broadcast}, 'veth1_to_bridge\x00'}) r3 = socket(0x18, 0x0, 0x3) connect(r3, &(0x7f0000000000)=@nfc_llcp={0x27, 0x1, 0x2, 0x4, 0x31, 0x80, "15d0f8f238b5c51bbef4ca856c7afc4d0e0c940e5c816a36d1ca9a9028ee9f5f437d803c8623c65c3cb58ff542be1975c07b0c0a481fc5c440b52091f575d0", 0x2c}, 0x80) setsockopt$sock_int(r1, 0x1, 0x1e, &(0x7f0000000040)=0xfffffffffffffffc, 0x4) clone(0x20003ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = socket(0x0, 0x80, 0x5) r5 = open(&(0x7f0000000500)='./bus\x00', 0x8141042, 0x80) close(r5) r6 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x6, 0x105082) r7 = memfd_create(&(0x7f0000000000)='}#*nodev\xee\xb8em2N,\x00', 0x0) pwritev(r7, &(0x7f00000000c0)=[{&(0x7f0000000480)="a8", 0x1}], 0x1, 0x80ffe) ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r5, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffed6) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendmmsg(r8, &(0x7f00000002c0)=[{{&(0x7f0000000080)=@nfc={0x27, 0x2}, 0x80, 0x0}}, {{&(0x7f0000000100)=@x25={0x9, @null=' \x00'}, 0x80, 0x0}}], 0x2e1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r10, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r9, 0x0, r10, 0x0, 0x1003, 0x0) fcntl$setstatus(r4, 0x4, 0x2400) pipe(&(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r12, &(0x7f00000001c0), 0x526987c9) getsockopt$ARPT_SO_GET_ENTRIES(r5, 0x0, 0x61, &(0x7f0000000740)=ANY=[], 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000680)='lp\xff\xbf\xfco\xd5\xaa\xfe\x1d\x15\xe2\x95Q\x87\xa4\'\xd0\xd8\xe3\xa1\x83\xf2A/\x80x\xe9\x11\x05\x8dOS\xdb\xc7`J\x94X\xbd\x9eXg\x7f\xfdQu\xcd<\xbfi1\xd4\xbbb\xe2\xf3,^\xbc\xbb\b\x8d#%\";+\xb8\xc3\x9ea\xde\xd2,S\xa1\x14\xbd\xe9\n3-\x88B\x1f\xa5\xba\xfc\x9fTZW\vG\xe4\x1a6\xdf\x14o.mU\x94t\x90P\x84\x7f\x16\x89\xf7S\x8e\x12U}[\xa6\xe7\"`\x14\xdf\x04z:', 0x80) read(r11, &(0x7f0000000200)=""/250, 0x50c7e3e3) sendfile(r6, r5, 0x0, 0x80005) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000003c0)={0x0}, &(0x7f0000000340)=0xb84699fd) syz_open_procfs(r13, &(0x7f0000000180)='ne\x8f/p\x00\xc9\xfc\"\'_\x8f\x93\f\xb9\x00\x00') r14 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r14, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r15 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fcntl$dupfd(r11, 0x0, r15) [ 813.955198] binder: 6494:6495 unknown command -96443648 [ 813.961158] binder: 6494:6495 ioctl c0306201 20000080 returned -22 [ 813.972158] binder: undelivered TRANSACTION_ERROR: 29201 22:58:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000200)={{{@in=@multicast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@remote}}, &(0x7f0000000000)=0xe8) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000300)={0xa0, 0x0, 0x4, {{0x2, 0x0, 0x1, 0xdf, 0x3, 0x4, {0x1, 0x9, 0x1, 0x100000000, 0xba0, 0x1, 0xbc4, 0x551, 0xa9f, 0x0, 0x3, r4, 0xee00, 0x6, 0x79}}, {0x0, 0x16}}}, 0xa0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0063402d000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) 22:58:28 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0, 0x0}) tkill(r1, 0x3c) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) r3 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r3, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) sendmsg$unix(r4, &(0x7f0000002640)={&(0x7f0000000280)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000600)="21cb1893811869a522c100d0fac7c94152a4860762fc7bdae5353404e3b865e74eac1b3074f949b0c83a12a5e0e07b0cb427a7b2d74084ebb0cea30b64d8bd3a97f5bd51fa5588d7aac7afe502483d0a5c89500dc339e81672e30b96d3422d8b3a1642b07bba824eac6feac92d1892ecf1eed5b6465e83d384e2ebccd80ab3c52e2000347560d38f6d14c9f4401a7540f54e5d0ce324aabb8eecf67ad4041d3ee18ae90e7e5a364ab5bf218ddbaee1414ef4b49a26b346bb46103f39615923a337c9db38fb1a53e3c32721768a23f7b48aed68d2edfe6da586975b48c5e0571464efa585c0f38b0221a22cd8ec5b2e1a76e1fa4319fb808f59e6219bfcd374185066c551b1789ef94aedd9d7e01e617e91c65f28558b47d42cbb8a6edc723f2532ebb845a5f7392d18344f255675f22feef8b24a2fad08e43b646dfa4d55893cf3631e3499d3abc405bf192c5a99b592711885c765184bdd0b66432cbbc2c4a4d00abae7151acb8bc5caaf0b7015e72e0291f62b58516f143d60e9c50c500a90ab6b583dd1d2d64c033fc8f5b2c5ab480875360c2b5cdf8f9d6d0c2239abb121aebad0b21600478221f6100fb511f2a17146a77e1aa4c82276d97b6c56b6dfd5107261133c9308155b45f56ff9a9c8f6ad3b35572e307f06ada0efaac70adacfe025f95749e89ba290497e907c9cc0e028d108cf5894303795c2a29be5952b44375985b71c1d2a243a0de92e40f65eff991f5ab8fb2af8680eef5ea0ffce53d1ea2f2200ca3f6ca46136d60b2157dfedd55d1ee86c329637a7ea6b5f1f46e7c3ab9b81bfe793e0b8248e804fe5e87ee2c40c59fc07584c5485cb2d4b450fc7d65d8aab06dfcfbd6e9e0c363ef38504174956121ce390f4b1c0f9cf93c3d5fd36db1dc26a25a102384e4f05caa6885dbeb8531d307e56bd871ba64a2cce70ff423ec5c73161b3338a564c520f6b76b50dabffc894ebfe16ba662c8ce452e39d2cb8b3f623399cf3749261a3a984e8a2d1c4e628a871c0678cf84712ce79ac6ef716ae70abb802bfec1a77952fc43c4acf1d3d32dd7cf3a32a8f86c352949adba26b12e086298edee5f7b7507d49c6d77a38ebf4ac6a62d8713479464a88639996c8755856d24e0dbc903065e8c3f682debe520210fe37e4f23cbc7e9bec796c44dd7be2dfdcf734b7d9d4c257ba4d605ea5a6de9abb67233a9e46297c225a00ce49895d0a75a65296415fa30d69a68d589dbdb3019227a3e92a297b12b033aa3703029cb8141cbd0de5101f2608b605eb2e8d68f1182d863e9dbb49531f2fc55122d687b604291ac24634d3a5c68402715bc38c2d49ad913ff09a790ed2301b851866e6ddaeb78adb851538fcf93a119fbdaedf4e75a9b130d57c26affa8f784e3c1c23f97a480c6accc03dc59324f4766d4dbb9b0798915c59279aceda755df989edef48ddc375c520a0967864873b4ce91390fa2bf2b155be7323a633299ce7ec9afe313f737833b72ae83ff3505a47d2fdcc86865255bb5d7fda2cf29ec66204b7aa4bf89ada743bba4dfb38ac599515e54b3b740c2fca797b70a8ede69298b72a5dfbb8e58b5d4787756a7380599aeea44259356e0f61859f00a2dbbd777788bfbd7d40fecb051f00349c6a8f21809422ea08ebaa5365f7506f3e6cf07ab187af4d4f85f9e5abcc1d0b2f3b9e118a5d7bd28f0f507da08e747f18b48d5b60fc06ca6cfc061b2f4c27d86d93d64765dc2a83ca6da3684ad554a9fcd2f770edbd801904f077e10080db46cc38574d31a15a4da14f38cf281116ed0c359367323c347f1c4f3b22e8a9ac360545908209f85182db47f47edcf2ac84e95b01b3f300df36ca961e6744b6611ca88ed6fa60cd154270f1a7ff707bc9f862ec614771f642a88489463e7032f3af9f693d6de39f3695263f9bc46afbff0ce295134fc4a7f56c75c952f12681caf9ba6fc461ca84acd7c85d9057c0d68ed1fdce0d17220f47fb15a8432a9f91eb88c3995e9b35ca8ad0bbb525f107c19e9c2015d6d3fefb7701c7001f612d3abaa82a8ccd4e1f57664a08b7a83384f1f69a2d893c6d5b13bb86483661e7beff3181e8be42e5f81daf085c93a0ef4558c83989a03d0d4a6778e397e62bb04e5af47ab1b2d7e39f7b2571313177b67fbbca2e66fcfea87007291052ca6afb165ce4bcb3903805c2f6c961c8cae07b128222ba083561159a6fdf2e3092d2cf03f12aa97e236da071a2df2eac73474f3cc0dd1116370724367df00ebdb9fe11cc31b88f8c86e1d8b4beb1deb01d1aa39897ccc28914c737f7d18f7f73eab461e50a92777169d06038d838ef97677ba7b099a5702de30cac4e6583dd163bd6c40feabfcec54e2955e920dcce8267fdfe881e6c187b625fc09fed75d6c8558f9a2cc10e99d4cd6f6be9e347b275d330eadba9aa6296111e66064ab56102ee43057b0c67610daee3d65cff5514bcb645c26d5effd35da536ba6db8db2d485b5fa50f468d64a418c1bea26c5281ce413a91a79eca33e7a22d886a4fc875f62a1722839cc6f96a040e8806ecdab820a3470b898adbfd7041eb9801c9c1365ecfe510c7395a904ddf7dc6f1c5f2a99cd3fb1ca5589b277c75935b5df1bbe41f245547cf1707aa496e8538c590cb925ef5882623e21ec4c51fed1415e93dce2eec3f034c44ced2081997d03049536ac667689053928f7bd3721dc460180f0286b6cebf5e11b64dff03dd6d7a63a8f3cfbe3b463fd9e321ba27959a4c2cc96157c8a56e317bcd0b81b8cf4260d6839c15641afa962bcef02ee81d3413df50bc7cc8c5566ba5a364d25b73e9eab2217dbf934604dc09de642f1bc506e6a3fb6bbdffe0e45458e6c36cbb416c84f88896e26e4c6666ade3ae7a7becc0b91a6e1982eea268cb6147f5bfb5f04ce0d099d02c9e5e9c147a36f483a671699bc17322ef818a060bbb0cc4bcb226e3b6b1d11dcafebe2b688f73e3318bedc82e6aa98990c88349779ad24cda545833d68363ed1596dad4039a466da64817f540efa11e5cc9f19e83089ed255fd25b00adf4b06980e6752856ffed708692f313f0f7883fd98376c827e3b0d9f40138f664047bb76ce060b803c23cd85072714eb6b7265adced00777f8686fa89bff4a59fd0a7a7e726b3e06fe3d572049f0c713ef55f686c9c5ff0528a33f59ff49550c4bcfe723f77075f01015d047de08c14e6d9038b9955755ee9cd8a3b25870af26c2717dd2bafe6802c0706126cb7ce15aface50ec720879287547b87ce9e7d6a300cce4edb2d87d1175c4de07dd1bf69795319cbe70a4d9a97bdb44a2677dcd69f1d62fd83444f7640b8e6969f26c949b91de197929a3ce72f6f418fcf3498f3580eb77cbcb592be842cdbaef07ddc2829ef85a182db95e71ca93b071b4d01de21ba8c1c1a3d57a295e050f1340962779cb15a9d57e1f2e8be0ff4bb6853020f732b91457f8b5ddc41ea5b883329b7180222466dfcc16d62287e66d3b0b3feda5b7fdd15b35f5f3ea96bd2d8e96b0153496cc3866bd75b882d4d04571b7192010675a1c5eef5a189194a476b277c3aa6d1b4d559ef2b6cf87a75e15d3254c8225f76160f6f5dc972ed2bd92ca48f3bcdbf024c94678292fe4d0ccf21af50edcb7dd96e3b5076d9fa5f66575a0991efab5f3bd49acb2094423b4da96397bc705a9b913f12f047480e387df0b5f686d6471645c932fb91899504bcffb25ab5ff18c2328c188c58f0a7c55a46e93e9b303aaa3996e666d33258c2f388d6fdf54bd931c6f25f876cacdd8a8bf1757e31e6bde553d97434caae0363522c1c239244cd84ae9dfa894aa88beffc430d7a34e5e8aa0bc49dddb412d77976a800cdc6672f4e40f3afdbaa11a7069f48db5520180dc47d55a9b4cd478fc8968122bb446baf47f9d6447cd0ffb2880abd8afa0e8592f88ea58b5955bdd96cda243b7c5062aeab4d7c424a5fd360bab74e41cfb3937ed975c0e2ec6fd54909741662eca934cbae66aa23bb2b62f2e2228ec3b0abc22cc0dd31dad7a0672c84936bf75eaef2a4584dbe0401d28f95438842175413c16733af2cc86875a631cbb2b9264d0189426e2e12f4e2e221b59c1adf5c7a28cb9ec5b741434913fb880c30d21587abf5604778887203feb449a510d406b8bd6ec53c4b82e959d507348b4ec627ed5b1875db58416cb88430eecc49e8cb42fcebfddb76463084c621c7eb317c124203383de7618871436062a7044515a87ea9fe810ec3e2867b61812e5031966428570e39b840897fe70c7fdd601987c52c1dbbf860a2972e366fc9bdc28cc625ee0c1e08be89d42506b7220fb3c8625765336874c0e1bb6903a7b20bef118b0f05be9dfeeeb69b84423bae7ea4dc5d0fcdedfc8e3861fd060b16a3804fe6899a3552acd89272a320c089398076cc0e83739945d4693da7ad2f7ecb0a1b34d5847c1c4620dd49ae9c2621e8935da4ef5db578cf4844bab27a7775d06ec26b3c7ebd57e4496823e291ca130e4afe639aeba7774754ac1c0353a29830ef975e747bb329180a566b5e8320a1d34fa28bf4bcaec3922ecba48b4d0e321945abbc0c43713205ae30579ec289857df712322aaaad724de2778e47ef5475b9359a9d1c139dca832047f11379f3284f1baa41a714a60f14e38d91b4ce3a851fd32f9c35ab5760db40970e9d2078deebb9ba059a306ac3e4c8047327a1d9299e9b766bc9302dcc52a6b5c4819713154eb89b27ece03f1dcc526c4450405189bb671535ff0844299d44780eb669e70ac93b9b0d7173a8caf5a55747fe0c768e62a65a9af77ad3d637e121d57fe1fd02ef75c1597695480f9b1fa6ae3c8afbfb6ae2077407dc06ea346daefede7d95da78b291413efd2a8f74b516a9feba42213f82de5a5ae98aaa1b9fa26a201526323d8477e965d89f84804bb98333c6f8d6e3af025bb241ce2806005cee997e2f2ff7b5507b08766c3cd0cb5581aad7d6750d7a27e447a256a2d2855b0ff05bde08cf6e467e93c4c10c8fbf6bdada7d4efa5cca5a6069946fbe84f04bdefe7d527b73dc2d185788a8436eb6b6dd3f21e6aa96d6eb3617dc43a301dc398cf47b024bc092e08c0447da1c5d616a984b0cf8a4439efa319c15473d5774a2f5b4374cc1672b809cfb2b15f0120de71f3cecd9a0c88bb851235f7fb6c3b43f2b6cf4b3a88e267eccf26cbe4c4b08d2dd4e8399af0ece974c688c53d60e89d632227ec6aa7a1fce5473c5ca03686cdf9bf4e984496ac8a91adb745fd7580727c9cacf438bb1a64edcedde72c07e84cd4a074f83f13c48b95d7de1f4d5a56d95581f59f8d16a3143f1b967ba8d705abb0f5900f40f9eba108cf9c5de507648ff482364eae4c00bddc2cfff299e078ea15e5392e41ef856bccaea46fdd916e62aca5e0b1f2249ff565f2d1857f1dd4094d71c0caf6bb11f88395bc8cabdf1af1e45afc8b75491b90905e0c54e9185895a717c48e0cb716b300c9fa2125d3c95628e123e2547bfede0a14632145c20d50667b3eebc5ca486b7c648529bf130b91c843fa5cbc55a729142919e23647ed83766cd462e5243f48247fd102910e300dd647451a8d867a9e6843ca79a10386ace2672740882118f45cd6cc7ff5757e07b8605dbe45d74f5c61a8e743f458caf4f15c6415da6321c414657b1a4bab1905a4d3bf4526376fda23ff2b5f18ff54c0bd1e31b5563c371a55bcdc051fefb1f49998cfedb6cc23ffb5f8a144543059cf2fe0265962a67ae5638ac4a99453da9e8c16389c511937040229379db8e24c06", 0x1000}, {&(0x7f0000000000)="6e1f2c15c5b0890eb306df23a3f2e454b3ca7110", 0x14}, {&(0x7f0000000500)="fc8059b795720c91d864", 0xa}, {&(0x7f0000001600)="99d40b837782116d0895add5a51b039b7d9c3d160be920ca8704cfb513882121a5e4a45a5e0a94c7cb404d5065a3028d1af0f4ee0960ab7f7965bb62640529c35a8b91ed5313530b8552bd1df81fef53480968fc73c76725da928717cf5ec7761db829973e4e194db50726dcf456fad922c30e882b801653f0fa862ef8cace93d46f97a0e3b02f9bbdabc1a79f9ebcca0d943a3160dffc3947d98d0c5a361220e4a0abc569bf009cb7e2e50a9b5cf7381d6292187c3ca6bdabb4e73114836356b4ad6c3d9fb9d5a3d56bdcd45f157d0b67b34072f1b07ca0af3e010f78b015a4cddbe14985f70ebca1878b88a285c34154e14705b78a0b8ad49882f394adb51319e84567e187be4789f443e086b1dc0ac8c6d3fd1c57fafb83eecfdb1694a16f672c41acf49c5883762ce581a73828168698b529d97cdf9d143d00184720b4fb10b0ad8199e87a9c64d36146d7ae20b954b897e6d76b6be9b29c164c2aaf35a253120489214691be4ebbb66a6b4b5da681311b4bdd015c69b4304512a2bf9f6556874938483f8ca71c34f5e2ea4d72f7a7fd887ad72b9db2122a7f238dc3dd05ee8c653dc26f0f0a0f8e1fa79ae1b0b188286b25676c45ad7f1f0a2593bc75ec94f32e110ef1bbad750c12a576ecd2c0b85d94b031f784ca9431d0f1afc336411fcd2f5bbe9dca824483fe4635af20f0c8cc064061844bce79c0b840dedfbcde9610bd4d24a73c00246c6870aa61d0b5c8118a89bc12e18d766a1b9c422c2bc26d538b7d916f31988899276c2d2fcca5729164de64d7e95f185f4153a1d44deec710a7692fb99f8290f891b4e2b931cda51bac2dda517deca9f6abc622249aba8e5f3c0e68e8d9747f6072bb672e4ab33e90291073421018c21e71caf28c6c038a258b7a5572c827aa0181abb5a54cb9564b765298f3bf050dd7965ae81311cd8239ebdc8d2a362304cf4877427c16260f5789d9052a94ea9c96a5ee066258cd6ab2bfa97380bafab4a5fcff7c8d9698b0a37b5a922545aca8fc3a0b70447fa72f50fd78606093427556d96f8f6b8e44d55afe8f3abbd6115cd18f597c48cf059074926fff622003b15ecb549dd617d94029293a89ca64e8b50b9d7cf40eb88462354e294391b5b6f9523e7bb2bf379275adc57c2e0d0fe0d789a89f1d43d4998053dae9d572938be7a3e7e3d86415a1cf0f155ff43b44731b12ec266198cc4ab6ea828eb5999907e1ecd63277ff2f6280625c586662e45c624e3b8850089eb2df803d1dadcbc58645a79f18021aa3f39c404e65f73410dc64ab19c9cc6aa05d6903cc0f3b129023d96e1e6e0809cc65861a1fc247f914e9c01b1b7326781e6a3814e1aa1f97e8e3a55301113a6408d9fe85fd9cabd0ea6e2bfab79ebf1bf3ec1ff9dbc39a1ecd61e09ddf2459e33b27a5b8cad5a3fe13a56cf57a66336d717dd03b98c1fe4ac5e6a07b792a3b2cfa582dfc99f9dc450f9f23bb845e1112c2accd6f3a382b4578d9f5c8b11468c7ce70e1f7e58020c75c4ae8c944ee3ee8015760a509841af88f5464d6cfde4e3d339d6687933c6e21410d4ba0e4c6c29543acb28d5c3a06313c68e083839787314d955b40743fa196261071fd89195ea2c19cb50bdfedc897fb6cf589bb69b81dad1044445ea2f5962bdee687fa40ed4f086a0343a97e1e97b7a0d5f65ffb82fd3745781631a761b8ff391985354093a3c45ac5c22988ab206d934932d683a1712b5cfb612454ed2fb0ab01161df39da66793ff8a00520e73f7946fada56d430cd54937954b73b75924da3977f8c8376ab0be60919457ffd9211874b56cbde24a9380d459149eeb9334617d466a7f8d93f9650aeda60d79963fc4451fbb01eca7aa725049c9cc5e70f120d62fd32158e86efdc0df6f45e0b309d1a0c139d359cc2cd7b25e35433ff00aec26f3304c271e43c411f8f6939f8e25f26c17f4819cda6e84d5dcc7e6056a19f1737d0077a53fb6b0caa969b7d1564d1f63b0783bd99635374a7b880dfbd878d3f59e28d8ac8cb62e641f2e341589221282ce6ad3a503f1d87a19a29eb9620bd2b3c21cc0944f47ee30fba5e740fbc0e025f0b7ac40c20644bc211b8feb907dd0e285bb278c3f240bdc387fd120b3b6f552a02f1f0e409a04d34eeff8871e505c3f897671d7e3693f4d04a58786477dfd4957e600d104d037d88053dc5114c3e2339028933501b4cc95b5043335d476dab57e57a4e3956df8ea088a51dd64046bbefcbe7a1ddf94ca6c2c0d64eb2bd2d2beb5542c04940f14b68bb41244f45876c71a286d40cb49fd124b1f348e04d7ab679f1e6b78227671c0aaf2d2d8af2e49aef17505935f873cf31014f22b7d440eba2492693f73b098a7af29897f2da135e9a79eb724daee95dc5300a2058b2ddcaac57d7716e0291db5f85b9c5656966db267942d68e8afa365d653a9cff5cbeb563659a4f2e2e4a22ea43a467e660b31deae09164f015fbc509c0fe426e7fc735a9eee73443a5069503bda74684b929c7d4de11d6f17ab9d487dcc0e8f3ebf26529f85f86e0e29e1567fab0740858097837e987aa4965f95f90109fffdbea80c140a14c905605eaf2eb90af263e57f78f1d272f54b4b286c83eb5a99c5d5f8741864690186f229cc5fb8a0c4bd0f050c49b67d8b97b5526fa54ae3b4ec660ccd2b33d80bb7d44c1e5627e90bc7c36654f1d21fabff7287815e67b76c69187373686af262ad3ed1d885bddc72631c9e1a3e8d46ea51ae71717816f50a3d89fe41f7237af88450b1a0f412973f93107753d0da11a4955aa43b16ac8bfb2b7b480385a7e83108d76c857f2cbc5914e9e73f6957aefee4a992af4c975b0b9ccb866ee256e9e3ac8538aa38d9a90bbd9fbaf21183779b00fb68b4887e6feffd8a5e156be820862060ef25b7eb1b86719b1172e86f5f1947b5fd59dcfb66ec020066a5873b2bd83daadb1bb71590f48f7a8f8b91d031a0092a6c3be8ae8b2aa519dbd21921f28035e54ffcba72e3e2b8153138fd8ed541e5f03277d0043f260c3b0d4f6430b74f9068ec2bf0f92634c9af483f5e53c70d0c6ca0e1d45b5b1fdf3e9d1cd3497603416c6b7289e8b895d06d83327027e40f4141083e049321c79e36ee5ccf92ba4b7f60c227fc2d293aff96ffc65c1f90bbc3cd4ec4ec134625446abbdff3ef468ac70ccb65e5087e64aa59c5f7f4fbad7c9090136095941fe8d658f7a264fbc0ed729541395f7621db383d017015800e0dbd9a1a14fd387baf97ea7b65b88ffa8d7c2a181dade41bc54594f8117c0015896fcf0455fc0b94eb7c3c8767a8411352fb2c582bfe1741e4520d32445491517ada9c672bb8c7f9b7db8cede929804375da5993bc76c222f47638b6581ffa3e6197e183987987817321773c83d7828744500ed188f67c0b7fab8cd291cefdaa5be5effde62df9f923f371bb5d49731dcc6e6a1ccf9ade4dbe055eb78fee453ec24e6ad9ee5de4827e6ac8e29b96da286b026b0e68f6a458dfd7a44238124d1e5101d1d06872dfe115a00b632bf9342a48900feca5ebd51e0ee8abbfadb1129a45fc4e8e2acd9d75e77c1dcd2e61e75d5bbb6268991d720683057473352faae6129ce306b95054815e64377ff8949078925e6f3b0e2694780fbf0e3d4c40c93390e821652ec938df46418e977db964311e60db558382b964a8d4647bf1be5740f7fc8ddba4c35a22deafd97b149b3d74fdff12469f0461d2b656967fff6ca01c4370430e1b3ae6b2207fd54d214040815ec187063a83950df20e32e924f3379ccffa4d68ae845c680e7f123259ccf9d6e706c00bb5fbbeee889d82fd4d2d7b1326f6dba5047d2609f3d8e131d0b0e0c574a79e66936041c73a949b00df2a6c1b0d5b35e2de6d35cb641ae4f3a668c99caeb9edfdc1619914abc5e94bc27fc14236b431f0c00047f5fe4d86c792f62815dcb267c0181385324555ff4f3d5545f69f9cc3a06d2c3f3aa4b9f3d143c8eaf665735e0b03e7798f80f463fddc18244c3c60ac3427226dbabd797bee313b8653fa9db3864a37489d89a007858c7966e0c1ae733ceb17a1a13b01cb06dfec7f45b28d3dc73a1ae4355b1cb14a9195a94b32981a2744d7801169a1d2fb378e672e986d8861bbff56acf8b577e6c92156c9f02ec5dd02461780892f959a9266068997fb527866c5c641bb1bb25686eb1d74b0836decc37cf575c9158b6c26ce71f0ee8089971bc7a01a7f2b8f3a50caef415d552b36e01ae2b5e8b1d01fd862b2b06b1c2dbdd85a79b576f0ec75c1a41225819db7d42abb5abc071d814794359c8eb1a1d1008b9e4d05fa5d0415b6d735ea64468b551efd95039d0e379be5187db1f90aab2b9612841e1149fc2ce390e63bf73743c67de3c88f308b588ff711426ddc4b4c511ffd417ba2683928a043d6cb50492bde53e8ac3019a76d35e673d6c19c24170d595d1e24a6af7401358ad391e19693f7178f9b4399929ca9de220d3ca9a2d3294dd84f90d078df1f3b01c2f717b9d3b72bf4df9cee874df59f2d53752acc84495fbbaac054edab8659e9a6fe8525d7f73bc0e8a5f19497c6f1c3601b74c2ca0cf1254faccc60958ad8c7ebb461328ea5d2017ac0995578b17a914b4e03e55c66b97527d4c41b9af4120ffe81abb885db4235c3873488224642bb7afa2b42a86ccfe8a9e35a8a1ace751049c3848c46d57db1a741dedb8ed4c6969da99203ad1eb660c4cf98380f17c651338b0d2eec8998ccdde839f63ca294ad2c94f5e534052816f7745519d61b0eb85479220e3c0c5266f23fc82830cb1ec859b27eb80944f1d91af28619f6ab8a2c6a755e5fc4853a9997c3de9a81b7c91f81380440a197de911f1c38fd9078c1036e4a9c56d6fb4cbb930c094b67105bc255bd94cb401eef7391683df50dd96e060e15239e086f61015de5c120f48b73d82f598bc3ec111220f643c1a2df295b9b0f92b48fe90ee47136b94d9f5ccc1840f68322ea934aa528ae7276113b41d3d15a3c7cc9c25facd1f6b1035ab52d5a1998957cfe31eca108767ea2e7dfa9325f2f2a7d992e6ce9c55e73f8e5f6419de60038430e24619c1dcc276c6d15de9fb5d8fbffbd3a8d399815ad806858e77978029fa83becc5e4128154d9256bfe47a7d3ae31acb95fc082d3ff91d6616b51aa46051bf30ec7ab9f6ced9ccd3ee6a354b3bdf9090e284186ddb701beb5dcc308de637f098b5b97beb7a80cdac66548af5b787048071e7ba7214fa7908c878904704b95e8a7f6f88d36357543740753318ea606c0a994069ca4ab0faa2af34d45c8aa393bab62cc8026039536212a15476a10ef1fbb04a1ae638fd55d4bbd4b69d7b93588b837e7340207312dbe98ceda370e3df6a1be3e84c59cfac307db6f264684080113211b56914a9fafe00e1601181ebb53f56cac89ae68133aaed16d927ba4ec48a51f9138712bd38d70cf08889b616ad2b4f66316de667ce41e906feb03dce15c24f403616dd9c81b5d6bf678faad572d162efba799b6ddfc6caeb9c1a1fef0da1989476a662e89aba5d67b9a6dcb9261c88c7952e14ac82aa2047d40fe45c0a628c488065675f010d57c2ef793eb916c93242874a7f09e497d5b127444515ea44e2f35731c76697eac9a40dd7e9359d2f5fa5debcdff5ea60e93cface40c5e10049a6e218f2bc50656b420b7ba270afec0e5fb6343049e16edeb4a97806f5090b79a96c0ca9b8c65d60dc0bab3730f0b8305f27a410b53993d1a5a2498ccd97e149132d0ec0291079d76e27e3b6a2210707423", 0x1000}], 0x4, &(0x7f0000002600)=[@rights={{0x14, 0x1, 0x1, [r5]}}], 0x18, 0x8000}, 0x40000) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f0000000400)) ioctl$LOOP_SET_STATUS64(r2, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) dup3(r0, r2, 0x80000) getsockopt$IPT_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x0, 0x42, &(0x7f0000000040)={'TPROXY\x00'}, &(0x7f0000000140)=0x1e) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000026c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000002780)={&(0x7f0000002680)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002740)={&(0x7f0000002700)={0x30, r6, 0x400, 0x70bd27, 0x25dfdbfd, {{}, 0x0, 0x4108, 0x0, {0x14, 0x18, {0x3, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00634040000000000000000000000000000000002475760000000000000000000000000000008000000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470010000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="160000000000000000000000000000000400000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 814.128079] binder: 6511:6513 unknown command 759194368 [ 814.134205] binder: 6511:6513 ioctl c0306201 20000080 returned -22 22:58:28 executing program 2: openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/icmp\x00') readv(r0, &(0x7f0000002340)=[{&(0x7f00000001c0)=""/4096, 0x141b}], 0x1) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000001600)={0x5, 0x8000, 0x5, 0x101, 0x9, 0x31aa}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'hsr0\x00', 0xd432}) pipe(0x0) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000001640)) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e3e3) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$loop(0x0, 0x4, 0x51d00) write(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f00000001c0)) sendmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000640)="24000000210007021dfdfd946f61", 0xe}], 0x1}, 0x0) ftruncate(0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0x81ff) io_submit(0x0, 0x7, &(0x7f00000019c0)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0xc, 0xb54d, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x683cb2b4bc11b951, r1}, 0x0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x3, 0x2000000000, r1, &(0x7f0000000580), 0x0, 0x2, 0x0, 0x0, r3}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x6, 0xffffffffffffffff, &(0x7f0000000440)="1955ed44daafdf2c1fbe2cdc9333032967022b00ff78a38cff9a746bbe6ae7648045c4d2f1a5fc0ce912a57ef32bd8031b7032c5c302c6e7d505a6d16367d5ad00840299fd09727dca0500a6a9003225e8723cdb1bbbfd0df24bad23559aa10269dd7aae7c5b203a52daeb73c7e9798620d75dc658d8ecd56afdf0106c6ed6236e39eaed6bb147f4a46e1d038949ba031437d1dcaf0ab213da7ef3d0f9d501da95116a80c1fb77828bafb415501abf87de4e1d1c00ce31a26ccdeb20709abe0d0ee9130e7de81f63e242792ecf814ab09934ce7ffc2eb298142b1af4b11b5913c4797d29ed839a224744723522e7f8ff9bcfaa87e0d86a177559582a21442b53205fb181943ecfcf7416ad285ae585f82a19276f627e4f04f4030324db1c37eb", 0x120, 0xdf9b, 0x0, 0x3, r3}, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x2, 0x63, r4, &(0x7f00000007c0)="f63c68e1ace4a26b9fc422d7760b0513b5ef2fadcb32680a8576f85ecc338a556ca53d197a56e2964ce760a5e11b83f3f5ef70cda6e4c72249b1c4ab96b7c0915ffef71c595bf581026268161e7ea2ad26656f34e62fee4e40ed5b9c243d68a4029ea4f79a0e02d0b4dbd124609242264bff33e9f7956c5fba6e4b6538dc3e653772cc87051503968f708ce445f696dbe416f122d3dd36bfaa2231cabe00b513a78fa33a402280518e6a552c82b9182007f3dba06758577e835c68af39851751ddf0eb891698833583efaf421b3355b93629ef2e33d712f77a9ca226479f8e933950a1743dfea019b3a5bac29e917ccebec14a68fd79365cbe0269c27d10c0514ecec1370e8337caa84253fc59942abc42b33c521ee3d5ecf54be132594806f5f6fef16371bbcf821accf35f5868b8c91b3e8dccbab5032060794ed5b7fa852c3c176843ec6aab78d6693c8c45a591f1806e68727d0c74b9a49f12cceea792e15c3ec1587245ca9a6b4a88bb2b28e7e008bea9149344ce168800ccd4509c41d16041bdd06cb0a20624738c82d0c2754aaa4133d5eaaef6af3b3f5d9e0961147e10278237bbc4cb4922b32c79b1aed69b6f328bf5f1a653101dfdfa75eead7ee98e55ef9ae97b8b415bc00f7381a6af34201dd546518b7d2e735bb354ef50b7a2fb802d4cca013cb863b714b85601cac24dba63530ea3d8824bc8a379c6f10ee785c4c400b1e25c6e472f89b8629a93647db3ac0fd861cda9806476ff39ccee49065c7815494a30a358a7217ac263f1f714fe530469e8001a8bba848c647f8d8f1afb7d66302600448807c68321e4bcef1e36532a9314c86508673f89da7c6a882de94f14571f77137ec77688d8f3ba47d08beb8c8bdb50501163a855efb57e548545d8246a76db1afee8a5aef0d38f36c1d10f63b434d3ebb8e91f233a9154d449a25e8d30e030f911a4557b1cac0e3ae3805c6867aa130b367d4f51b71a53d83a13292603f47707ebef215a0830d4c9e8c13fe62f55da46afa7254850c00be6a6eda5da5c54210c9fff40f94a852b9cb8eca3002901c0e6da9481d2b90c157151f0f5a3768ef466eca1f42633de1216db61652c590960e0cbafdec33e79ec7055683dc2a75b97509830a691338e852472f68aabec5c42aa40fbce681a50f62a48b57291020a02b4bf467d231de14e4c5164637be06683bf46f2c94393e2350abddf6d62aecade70a75b63991d0438ad3b693c6ef72d0c6d5f5ff9d0d1dfe9b046c2ef5c485a5e6a1c05c301bda77e9992121192da6d963b944cbe5ca97600cc4e2915fcce5faca955f47565c8cb82d542b114db9aa599d59824714423af8e6a78a5d9cead32457e55be397b7a9ffa5b97e428bd6ad20bff08b8c471f74a01350ba691ab97d15cffb93c29f50bc50bb628d9c2908952045d4cfc9d4a5a5e043cc43a245fc5f44be39a060e32818fa784a3dce6e74ac99e1263e617e2d3b1c8a06bcafb4ea7e54abca0db23606aedad0d8e2aae8e4d258a0aac4b8496e2eb3081a5a04255ad2914a56154b42569e41243e5ab098034da8c4e7c63c044142cc9d4101565155d3dd5caeed0ab2cde2746b2be69ee46c47c745fd51e5b9c650b4d3f09b37e85b828d1641480dabc33c2d6feaf9ac659454975e925a19127814b3799940f7941b9dab21f425ad0e04065661e02a254a81097c5b410957e50e13354b0bf92c66cfb12b8179c0ead4938ddf65ef6643264aafd8256e1fe132830f8f380a17008923345ec09e8ad67b5458680c2071a0945e06abd15e8d95f64875f9a54588667f371b94b1501a278baf66899e7bd20a38b09d8008160e957c64cd468e198cd03eadcc2d18a0185411f12a87bb061aab02ba4822bfa63c524732076d453fa33050ae36f32290aec44cf1c0e87e96d48a06c576e0fee3ae2276d317e556434da4f7f0f294179ef7189f3232742a4367542be1ebe1da17acd94e9a6ca979c1bfb2c96a15bcc0c907cb08f2bea30c036945f6be1fad21160e2e8f40d2aed1eb3212bc86348fd3530a3c5af09d09888fdf88b59a83c9af8120c9d63c2766f23fe6f040273ee086c10742e9c5419e08f1afb00be99077f187796df7e28228e3c21e5c17abe08689f5ba5ffd1d0af918693b302e200c9808155a60a102b4553ceeb1c16d8a58c13130a5d3e282f0a35dd056d6101980a8ee33a72e69b6a84d3128d96ef51be4e5756409a64d165462fffc6c08a6dbce7c1d942c6f6386a13dd8656f35547fd0181e5378dbb2f392b2cfc2dbdc38e5de7cd7e26a8369e2e204a4c2492a76560a251aaf54815a8fcd803f9411bc29a48ad3ba56006535da5ebc7ad6e31c4eaa4687bbd7d9d2dfed754d725c7ca8a7abc2c6679571512927b5b6bd56079ea0c94f6a03465140852d81f6ed2cabca260a3f0967a98f0e7dadbd2a4a89e620de8977d0789c9bd397b8a08282d8dedb6c87ee84edd8a6c1193a8a259ea439981b8e66a6c949851521341ff203dd6e73e06c434f28e40edcd811d084826950cf5bbbdb2e8c3db25864b75916455703fc5276f6a4124a888ad1f5c84baf46fcbd95c1351222bf2e7bc1e7960e3c976bffa994f40a5395554c395c958c7d16fce53bdb3a9f0aa86aa7b3cbfead6e5a1603935b1ba1769be97f1428fd37f858395b03448a8fdce209e622d07c708076cc71eb13e6123b2934c0e617d64ba9cc644069e5c19373d2ba2266606209c29581e5d696dcf63de83a1104e74aca7d258ccd56eeaee5570659ce42fa00345d91e01e5427aa4e4da168d8239d12e84a2ad1a3cb289e56985eb22e40a011e77db1ee0212ba6b41e81565da7df4622a54429ba8458244bf4de593afc3c7ed8638f7fa20462b3b97bcd7781455f3d2e1ed35f02afa24ec1692231059dd651b591461f21669df858abfacf798949c1e5b562c57542391577d75298d62502393c13d5f06f89726493699ac2d166e540089d05af373ab9a2b7df01de542594445bde5a8472b15386332b465191bba78112b9c101b839dfc2c5cd22c7fdbf214dc5b085f2e496493fd68c3741073accb2dad9959d5c19dcff95b7644cf71e74a8ac64805c50b2c3851ef37a0322da907ae4a6f31dae665a6beeb59a6c3fd14979a0a9d58f1c5b3256b76c7c189c3a124feb4f6a6bc66746e4cb4eda222c367e11d427c5be6fb5845fc48aca8c3e7f89f5c9cbe50ce3cbc59421729b1f845b7e331e486c0eb43440848ac44cf36bcd7797e9aec4086aaf985953ede0e17fd41e7fab01e99002635392e43b011218e078a9f65e2fa92c09fd1a00e174b808f41451ea1243507b3ec121635462bfa96acda59227576e71286fdcd02702eb14e5a8e4604574ecee3efeed944620eeabd6439c8d827466792e6e066ff6066bd8dc3038e5682a01c7dfa84a04e976ab751c1ba507ba2050cb41a99a62027e1ffd25b42d96a4505598f6681ca5ce0cb8108ce8cd6f7ed44eb00d656c76c97a247e5e9a7b50c9485456e41814825874325d82611df9252c6a4050a3db53868d1b7bc942da57f2bc328977a5a7087de126318db3e3cc71ee09c40e129e9602b56cb2a585a991f223046a4c3895f800f53d30d2d02adbf0a138e3221e2edafb2ae8d79a6d7addc3ccc5eeac2a3c3e2d046e63b8a54c044eae03ccb4ec38fc6a2723f722e19620d17c10ca58b0b2398237d25fe83b36f72e3cfdd4d4620c1542ad9cbbe5e8a50921a7fa72d4dc29579d9f83317422d70334a5769c908dc056b677268b8227f92ed3a295cd1627c6b16ac67ff5219e16ee482ea04300f5202156824cd0785658b9ddaa90da3da53c04fcc45086e366bcca9b54889051981ffca6ad61dea4d144acc902460003949898bc1a0be025dfad3512cb008d35a6dde2a42071f17fcf26cd7e18100189907a678bc79455487b1db3ed90184b65763b5f6ccad945a63560474cce3ebc879330911105d747431f6950840fd16bc4b8264a926c340e7a4b71d4b180bd931579d69b5613c622eaea58c9472e922c3491f68b185030a4e2ca7a73c90d1eb95113b1c3c6f666a38018aa6206de5fdb90ecd224d5a1bb2ede1b597f633cf0321458edd161351969327dd253cd2912a90b2d3016387f1e584ff4ced8ecc5a7d9ef2272fc58c99006042b1d575d7cce9fcb3127a82622cf74097388283298aade0522597484152cb69d1ee880104b1bb84a1a766406e8d9352fc8c7023f8742c68e3f2c661c94583821415ec720307b756e0a048f9e28f2e8105ec515601492df3580aac7584f968e0d24d7e0eecfe352aa24f27ce5abc5ba0a7511c10343290eb3821c096c25da662e73a5de1b9b7e4c21f40afa0b368435e1be703298d866b683d93a7fbec5cab66f974597001cc10e37f0cc5c28718f8f65c4424b8579b80ad2dc9a736c3e82be57c596eb61d3d12ccbf0aab37833a90b2829aa9d860b48ac1325e4d21912d18dfe09f64a209c1f13504332e8fb490db4d7ad5b95209218bfd4486b5e1aa6e3d7fd9bf81d87f0925bc6271fdc237bc0b3e89b4cefd36e47274f7d6baadff882b7b0406ab7652f6c7e4111389b2220d1129f422709280abef095737114038a1a4e5806cbfba7b623d2544f95e2dd4320da5f1a6f3269b6fd929c35bc6e561e1d1486274d0e43005893d555a20149a51f0ee466ddb48a7ea921f8e728ee413632a820c740ad158bd37aa6d37ec2b6ce037f37721f6ee0629b82e1ba8cc7141716aa158ef482fd98669c5c60bcdfa02fb649869665c3af111d4a9eb1575824bcc7d70b827830dc9ec41e810d3c063e468428f3b70de3b9a08f59c0fc82bcb9507aec2b927a2fac58760d643a6f773f4e214cd96fdda7cbde2f358d27de89fcc26cf79e3076a3c4b3bf4c50cad383ae4b4ac6a2770fc22aa5aae46f78eae5d38a1f40cc92fd52cd334ad71421a1404c9b2660d209bfcdf3566181d62ee39ad03b8a04907196f4333ab4c91ec589aa9422e2694327dfb8c14f9013f5c64beeab6e4925057d71cdaf3856c8c3c4dde291259327870e507fa6edde5db52eca2617765cbc2ccce7eeffa637f33b6e4b2fd71b6b6171e7", 0xe0c, 0x2, 0x0, 0x1}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x7, 0xffffffff, 0xffffffffffffffff, &(0x7f0000001800)="86b7e0ff9e6590e8da72fb6b63de2056a0bf4c7d57ac3b65ad10674df9a825fbdf71b923a1dbde9789946dd6be2b3c963133cd55", 0x34, 0x0, 0x0, 0x5}, &(0x7f0000001980)={0x0, 0x0, 0x0, 0xd57ea18703433360, 0x0, 0xffffffffffffffff, &(0x7f0000001880)="b6db78d7f4ba81314af85f29b659359d8d5f31366fda534a66bc58fd444ba1fabca895cb7b4662fb7e5d4700f34192ad02acd240b6ef501f4c32c1efd7bd861957332991cf8f15060f692ad534683c3ebb4f9b965e9c7e0b47a144dd300b8860cb21fa2cf15a1392fc28ef4febed55c8d6afb40926af543af19bbbf85907585679ffba52d65c0f80f7d4cdb98d93fef78c0765cdadcfd28f33580266b3da59bfb761cb476ecf", 0xa6, 0x9}]) setitimer(0x1, &(0x7f00000000c0)={{}, {0x0, 0x2710}}, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f00000001c0), 0xfffffef3) read(r5, &(0x7f0000000200)=""/250, 0x50c7e5e2) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r8 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/load\x00', 0x2, 0x0) dup2(r8, r2) sendfile(r6, r7, 0x0, 0x80000001) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000100)='net/icmp\x00') write$cgroup_int(r9, &(0x7f0000000300), 0x12) [ 814.283716] binder_alloc: 6524: binder_alloc_buf size 411041792 failed, no address space [ 814.296744] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) [ 814.316534] binder: 6524:6530 transaction failed 29201/-28, size 8388608-402653184 line 3137 22:58:28 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:28 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:28 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xe4, 0x18, 0x200, 0x70bd25, 0x25dfdbfd, {0x6}, [@generic="7438f4dd7cf8b9e3bc0a7c5489b817cee50a0a1c85033364a4b2e1ded17a372d99cf3512cc0788401662cfa5dc600e6e8861ec9820a16d5b95dc0d11109e97709636900e05deccb0d930f8a457d5d2aebd365989fb6265de52591badb2c509d1c71a14e3920bf81725637f6014b903d92d6a48cf73a5903c1bbe8f6648b92f9ffe4ee4bff871d0bd4ce9b301ae56f3e12ede7d09085c0351aae4ae42f063ae49050d7c1fc94717e16962a4942c45b2a7871569a609b32d8c65fedd1343248baee0ebbdb21d3785", @typed={0x8, 0x48, @str='\x00'}]}, 0xe4}, 0x1, 0x0, 0x0, 0x800}, 0x8000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00000000f8ffffff0000040000000000203100000000"], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) 22:58:28 executing program 4: getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0)={@local}, 0x0) pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfb120eb7) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='\x00\x00t/netstap\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) setsockopt$inet6_udp_int(r3, 0x11, 0xab, &(0x7f00000003c0)=0x7fff, 0x4) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000400)=""/117) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000001c0)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00') dup(r5) sendmmsg(r2, &(0x7f00000092c0), 0x1d2, 0x0) ioctl$RTC_VL_READ(0xffffffffffffffff, 0x80047013, &(0x7f0000000600)) write$binfmt_misc(r1, &(0x7f0000000300)={'syz0', "244b3e3fe26ceed3271d64aa76f328295ac05779f79ccf173ba30b61260febd4f33b815293174c2e8168fad8df7140567c366b16f995950b8548d1dd52cb57b03c0b2cd5893244f8cb58bef11b957fc0950caacd9f3c18840014e3a7ff2f619fa6c2e3f5ff"}, 0x69) write$P9_RVERSION(r4, &(0x7f0000000380)=ANY=[@ANYBLOB="1380000065ffff0000000006003950323030303ff295e16d1b89f5112dd3ba66fa9e7c4855c47af8c2341ca08267050f7900"/63], 0x13) bind$inet(0xffffffffffffffff, 0x0, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x40800, 0x0) open(0x0, 0x0, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='\x00\x00t/netstap\x00') write$selinux_user(r6, &(0x7f0000000180)={'system_u:object_r:sulogin_exec_t:s0', 0x20, 'sysadm_u\x00'}, 0x2d) fdatasync(0xffffffffffffffff) 22:58:28 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac', 0x3) write$binfmt_misc(r3, &(0x7f0000000c40)=ANY=[@ANYRES32], 0xff67) sendfile(r2, r3, &(0x7f0000000000), 0xffff) fcntl$addseals(r3, 0x409, 0x8) fsetxattr$system_posix_acl(r3, &(0x7f0000000240)='system.posix_acl_access\x00\xee\xc8\x1a\xe1\x90\xc2\xd97\xcb^\xdb\xf2{\xd7#\xf30\xf6(\x19\xb5 \xf1p\x97\x05H{|\x11g\xfb\x1a\x1f.\x01\x96\xf4\x1e9\xc67\xeer\xaf\x86?MG\xddxL\xaa\xf1?-\x8a\xdb\x05\x06>\x04K?~\xc0\xe1\t\v\x82p~tdC\xa7\xf8\x9a\xf6\xce\x1f\xfd\xa7\xa2\x10\x0e6\x1fj\x9c+\xe8\xba\x9f\xb9IS\xe3[\xd5L5)1\xf8\xd6\xfdL\x83\x04\x00\x00\x00\x00\x00\x00\x00\x90oQw\xb7\xbc\xa7s\xab\xde5\xe6\x84\xf1\xc3d\xa0\xd8\xf3\x90\xe2H\xfa\xc4\xda_\x9c', &(0x7f00000000c0)=ANY=[@ANYBLOB="020000000100000000000000040000000000000008000000", @ANYRES32=0x0, @ANYBLOB="10000000000000000100000000000000"], 0x2c, 0x0) dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 22:58:28 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 814.634681] binder: 6547:6550 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 814.644641] binder: 6547:6550 transaction failed 29201/-22, size 120-24 line 3199 [ 814.666897] binder: undelivered TRANSACTION_ERROR: 29201 22:58:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$ION_IOC_HEAP_QUERY(r3, 0xc0184908, &(0x7f0000000080)={0x34, 0x0, &(0x7f0000000040)}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = dup(r3) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0xad734503, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r5, 0x0, r6, 0x0, 0x1003, 0x0) splice(r1, &(0x7f0000000100)=0xece, r6, &(0x7f0000000140)=0x800000, 0xd4ee, 0xa) 22:58:28 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:28 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 815.011240] binder: undelivered TRANSACTION_ERROR: 29201 [ 815.017127] binder: BINDER_SET_CONTEXT_MGR already set [ 815.024668] binder: 6524:6530 ioctl 40046207 0 returned -16 22:58:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xf4, r2, 0xc00, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x200}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x81}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}]}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x100}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8000000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x596}, @IPVS_CMD_ATTR_SERVICE={0x64, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3b}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x1}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9e5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7fffffff}]}, 0xf4}, 0x1, 0x0, 0x0, 0x48000}, 0x537414acc521ae56) 22:58:29 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:29 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r1, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x9, 0x1a, 0x8, "91d25b91def8ea50b71a1fc14509f32e827e66d9194d9b64d4d6c6538695c28d39b9703704f6c4ff73f4a6cfe666d5450c7b1790a48983dd20b29515c21bcaa7", "e9ed2f48fc69ccfb8e6beeef2e0804287715e765000f400001c5a9e5e688175e", [0x5dd, 0x88d]}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x200002, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:29 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="2400000024007fffffff9e0000007701001c00ff0100000000000000f1", 0x1d) splice(r0, 0x0, r2, 0x0, 0x422000a78, 0x0) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfffffd88) sendmsg$nl_netfilter(r1, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0xe0000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x11c, 0xa, 0xb, 0xf05d95c6a7cbdc1f, 0x70bd29, 0x25dfdbfc, {0xc, 0x0, 0x9}, [@nested={0xb0, 0x4, [@generic="83003bdf0bbce5a62487611ed77dcdc335d5c6510f8bd0b8bc6a2a77d08ba8c13c477cbbcbf395fd90fd0c02ceb79ca03cd867cf36f6afd8bd530da5d09ac4f2e88a5d18fc2af6543f62457a570ddf1b97ebe4fe8e20d0e85fc074024a8e023d9981d6abe4bd6b70cf7ba8f3a5c680c41b0e279e00d7c3f9449aefcb7dffb94727aeb06f4ab09ce6c66f5cc9059679f9723b4800fc0df587b456672b125e16a7831b5b9ecc8f1e0b45"]}, @generic="a6ec842ebd67203d71ac0309dff7c3feea3e9868176555459cbc92a22a29b1779329cf721a5e0710efab68140b3d3ea4c8fa46fd65c750a8c5d1f4870b8c13c8af80b71465ea408cdd3a3aac8d64a43c75228cd54ebae4"]}, 0x11c}, 0x1, 0x0, 0x0, 0x8000}, 0x1020) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, &(0x7f00000000c0)={'bond_slave_0\x00', {0x2, 0x4e20, @multicast2}}) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x11, r5, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r6, 0x0, r7, 0x0, 0x1003, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r7, 0x1, 0x1, &(0x7f0000000300)={0x4}, 0x4) 22:58:29 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000000)={0x5, 0x200, 0x7, 0x3c0, 0x6}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 815.153773] binder: 6584:6592 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 815.190119] binder: 6584:6592 transaction failed 29201/-22, size 120-24 line 3199 [ 815.204435] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.241730] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.260001] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.260456] binder: undelivered TRANSACTION_ERROR: 29201 [ 815.270134] binder: 6584:6592 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 815.270191] binder: 6584:6592 transaction failed 29201/-22, size 120-24 line 3199 [ 815.277375] binder: undelivered TRANSACTION_ERROR: 29201 [ 815.320165] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.329989] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.344165] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.355456] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.365543] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.375537] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.392853] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.402759] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.412917] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.422725] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.432779] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 815.442577] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket 22:58:29 executing program 4: getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0)={@local}, 0x0) pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfb120eb7) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='\x00\x00t/netstap\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) setsockopt$inet6_udp_int(r3, 0x11, 0xab, &(0x7f00000003c0)=0x7fff, 0x4) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000400)=""/117) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000001c0)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00') dup(r5) sendmmsg(r2, &(0x7f00000092c0), 0x1d2, 0x0) ioctl$RTC_VL_READ(0xffffffffffffffff, 0x80047013, &(0x7f0000000600)) write$binfmt_misc(r1, &(0x7f0000000300)={'syz0', "244b3e3fe26ceed3271d64aa76f328295ac05779f79ccf173ba30b61260febd4f33b815293174c2e8168fad8df7140567c366b16f995950b8548d1dd52cb57b03c0b2cd5893244f8cb58bef11b957fc0950caacd9f3c18840014e3a7ff2f619fa6c2e3f5ff"}, 0x69) write$P9_RVERSION(r4, &(0x7f0000000380)=ANY=[@ANYBLOB="1380000065ffff0000000006003950323030303ff295e16d1b89f5112dd3ba66fa9e7c4855c47af8c2341ca08267050f7900"/63], 0x13) bind$inet(0xffffffffffffffff, 0x0, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x40800, 0x0) open(0x0, 0x0, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='\x00\x00t/netstap\x00') write$selinux_user(r6, &(0x7f0000000180)={'system_u:object_r:sulogin_exec_t:s0', 0x20, 'sysadm_u\x00'}, 0x2d) fdatasync(0xffffffffffffffff) 22:58:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) r5 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000340)='ns/cgroup\x00') sendfile(r4, r5, &(0x7f0000000380)=0x5, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r6 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r6, 0xc020660b, &(0x7f0000000740)=ANY=[@ANYBLOB="0000000000000000000100000000000000000000000000000013000000000000"]) write$P9_RAUTH(r6, &(0x7f0000000300)={0x14, 0x67, 0x1, {0x50, 0x1, 0x7}}, 0x14) ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) clone(0x200, &(0x7f0000000000)="c1117463f1968517817439c5bbdc8ed7517a79b8b95ca0489b76357b0a9acecc6001601820c9cdf2e2f62ea29d4ec40911d18b52d385ab6c65a2e249607a8cfa6af754cc4f50ac6c2a04a80243fc8eba6e6a4e5bbcc3418bdc4b4582f53a49b3c85fecd7f445f50f6ddd21a1314f3d91b858c6c101b7cc555cbab5b1af6e3d9c6dc0ff2b54c4e684a4166e35f2ebef04c7b1af6da7072e0781ac0a213774cab8742df3f9", &(0x7f0000000100), &(0x7f00000001c0), &(0x7f0000000240)="a8f3d230d9a006fc5643ce540d218a45931b5b05091557652c58362927b5ce1f1d943f2c17eb8fe0b1680f4fe177f673e16c9d14d8860b4f107cde68cd6711388462adec6c10bdecee1bb067fc21f2d7e915c3707b0233058a6247380fa101fa8fa9a5be2f44703bdbd4667e4cf5dc864852e4014cea9315a1aece9c79b03db51d83781f2f10e50f1ea48e377c800e4fdf895189e509933661604dd3ab97df405c5ffe5e81ed21c58037447d23913275102168446eb0809bb1") 22:58:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vga_arbiter\x00', 0x1, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x200, 0x0) ioctl$TCSETXW(r1, 0x5435, &(0x7f0000000340)={0x7, 0x3, [0x2, 0x9, 0x7, 0x3ff, 0xfb], 0x80}) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) accept(r2, &(0x7f0000000140)=@can={0x1d, 0x0}, &(0x7f00000002c0)=0x80) setsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000300)={@empty, r3}, 0x14) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x204c4000}, 0xc, &(0x7f0000000540)={&(0x7f0000000780)={0x16c, 0xa, 0x2, 0x0, 0x101, 0x25dfdbfd, {0x0, 0x0, 0x2}, [@generic="0824500dd1fa3f994b703dfb7715762d70cb33b3e9882489803f498eadcfff15a7d95d8fc79fb9c9f95f8b2e2fc3866054c92d241e978155107977f037aaecb316e21187c59532891e2794ae321dbec2bd53f5479d4ee83813ed9651af9d2e118acd030e5ed11d55296c6b979649f9c664412209765400a4a79d1dc965a0056ec1107394f06150727a9c6c1a8e7c9e710f4317d1d659d4", @generic="43cf5d8dc94c8039fb4de0ca736978d3815edff4f6147cba2ae274759912958fc205b6ebf6d567f99b0a3ada83c14ec2243a4a7616dbb6205c68e584d1c3b2c37e5a753e0fedf6782e210e075a772834b34dd414773ad23264e3672ee91e78b9681441255948d48f4b2f274bf4afc807cb3e9805bda7d6ec972fd247e03239ee28658d5dde7f7a4ea6e7a5c8b3fbf987900a807b90afa482ea10c54ec52b2ae92c5f22fa4ed1cdf054b4e64421f428117b1b46d2bf7beb97f78df3ba812819"]}, 0x16c}, 0x1, 0x0, 0x0, 0xc800}, 0x30004040) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="006340c0000000000000000000000000000000000000000000780000000000000018000000000000000000000000000000000000f240487e6035f365225755f19ad24ab71f9b25d577d6f9d50cabafb12a5a944d45eb9804d72b4c45c405c30bde15d7775b4a7de97cb035640cab3986346ede6f72c6aafdab5d7c19fd70a237192de986205a589bb8054e6810538c89f830a4de94f4f2a1050c957f296b42568a492f24a254f88534975ee8b013c6", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/22], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000035feffff00000000"]], 0x0, 0x0, 0x0}) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x44, 0x0, 0x0, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3a}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8253}]}, 0x44}, 0x1, 0x0, 0x0, 0xf4beab659242ee5f}, 0x40000) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='G\x00') 22:58:29 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:29 executing program 1: socket$packet(0x11, 0x3, 0x300) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r0, 0x0, r1, 0x0, 0x1003, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x6, 0x15000}, 0x4) socketpair$unix(0x1, 0x40000000000001, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = fcntl$dupfd(r3, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) sendmmsg(r6, &(0x7f00000092c0), 0x4ff, 0x0) 22:58:29 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) getsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) r6 = dup2(r4, r5) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xb0, r3, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER={0x68, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x93}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}]}]}, @TIPC_NLA_MEDIA={0x20, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x89a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x93}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xb0}}, 0x40000c0) 22:58:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x406, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000140)=[@enter_looper], 0x0, 0x0, 0x0}) [ 815.518191] binder_alloc: 6610: binder_alloc_buf size 4840 failed, no address space [ 815.526729] binder: 6612:6614 unknown command -1069522176 [ 815.538013] binder: 6612:6614 ioctl c0306201 20000080 returned -22 [ 815.547909] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 815.559337] binder: 6610:6616 transaction failed 29201/-28, size 4096-739 line 3137 22:58:29 executing program 0: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r2 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x0) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x4, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x40000}]) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x200) io_cancel(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0xad, r4, &(0x7f0000000200)="3703c23a7a7e1777e857c25755a0f227d18eaa954c95d4f8f46b744c29bc5d2cbc556149589e376434f7d404862ee151cd21b74034e2539209605448a452b7cc47505d02197b6f270507b06cc3d4d6668bf3f27a086341c75d2305e8b44ad7581fd442ec55ed3b17e7a9b4af6a0e1921afaae3255d91e7a7ce2d497214777ee03f2b173dbcf4bee02e075bf8bc68e22db5669c1206daa9aae6ba36019b6041eb11bbc94727c54561be2e08dbe88f7ef59cde4396fdec00b5a513c9b86ca280c218118a4414afc7e2b459d11d780da3613dc9356f34c9d77da323fc23345c516009a2cd050b54508e1e293156803b8fe52c2117f221", 0xf5, 0x8, 0x0, 0x2}, &(0x7f0000000040)) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r6, 0x0, 0x0, 0x41, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x12b) write$binfmt_elf64(r6, &(0x7f0000000640)=ANY=[], 0xffffff9c) r7 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r7, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) accept$inet(r7, &(0x7f0000000140)={0x2, 0x0, @dev}, &(0x7f0000000380)=0x10) recvmsg(r6, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000300)={{0x7c, @local, 0x4e24, 0x3, 'none\x00', 0x8, 0x5, 0x1a}, {@multicast1, 0x4e21, 0x0, 0x10000, 0x8001, 0x5}}, 0x44) rmdir(&(0x7f0000000600)='./bus\x00') ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000500)={0x8, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="e3c5044000000020"], 0x4d, 0x0, &(0x7f0000000480)="7ffffe9b22468691fcee57ad146ac313f816c5be50ca15cf1bc088cef5b781e4c1063db14e8a8cc0824a893abc8c6198617c649cdf513e349771054855f4a7ee59b3cde4362310de83932abd4b"}) [ 815.596144] binder: undelivered TRANSACTION_ERROR: 29201 22:58:29 executing program 0: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:29 executing program 0: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x806) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) r4 = dup2(r1, r3) ioctl$sock_SIOCADDRT(r4, 0x890b, &(0x7f0000000480)={0x0, @can={0x1d, 0x0}, @llc={0x1a, 0xfaf1, 0x2, 0xe5, 0x20, 0x42, @random="189b72ddc2ec"}, @isdn={0x22, 0x9, 0x9, 0x2, 0x7f}, 0x5, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x3, 0xf596, 0x200}) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000500)={@loopback, @rand_addr="10a75804789afea58f083fd494b11876", @remote, 0x7ff80, 0x5, 0xe0, 0x500, 0x4, 0x4040118, r5}) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000600)) r6 = accept4(r2, &(0x7f0000000000)=@ax25={{0x3, @rose}, [@bcast, @remote, @netrom, @rose, @default, @default, @bcast, @null]}, &(0x7f0000000140)=0x80, 0x0) getsockopt$inet_mreqsrc(r6, 0x0, 0x25, &(0x7f0000000180)={@empty, @empty, @multicast1}, &(0x7f0000000200)=0xc) [ 815.803326] binder: BINDER_SET_CONTEXT_MGR already set [ 815.826678] binder: 6651:6653 ioctl 40046207 0 returned -16 22:58:30 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:30 executing program 0: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:30 executing program 0: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:30 executing program 0: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:30 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) getsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) r6 = dup2(r4, r5) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xb0, r3, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER={0x68, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x93}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}]}]}, @TIPC_NLA_MEDIA={0x20, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x89a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x93}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xb0}}, 0x40000c0) 22:58:30 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:30 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) getsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) r6 = dup2(r4, r5) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xb0, r3, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER={0x68, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x93}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}]}]}, @TIPC_NLA_MEDIA={0x20, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x89a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x93}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xb0}}, 0x40000c0) 22:58:30 executing program 4: getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0)={@local}, 0x0) pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfb120eb7) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='\x00\x00t/netstap\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) setsockopt$inet6_udp_int(r3, 0x11, 0xab, &(0x7f00000003c0)=0x7fff, 0x4) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000400)=""/117) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000001c0)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00') dup(r5) sendmmsg(r2, &(0x7f00000092c0), 0x1d2, 0x0) ioctl$RTC_VL_READ(0xffffffffffffffff, 0x80047013, &(0x7f0000000600)) write$binfmt_misc(r1, &(0x7f0000000300)={'syz0', "244b3e3fe26ceed3271d64aa76f328295ac05779f79ccf173ba30b61260febd4f33b815293174c2e8168fad8df7140567c366b16f995950b8548d1dd52cb57b03c0b2cd5893244f8cb58bef11b957fc0950caacd9f3c18840014e3a7ff2f619fa6c2e3f5ff"}, 0x69) write$P9_RVERSION(r4, &(0x7f0000000380)=ANY=[@ANYBLOB="1380000065ffff0000000006003950323030303ff295e16d1b89f5112dd3ba66fa9e7c4855c47af8c2341ca08267050f7900"/63], 0x13) bind$inet(0xffffffffffffffff, 0x0, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x40800, 0x0) open(0x0, 0x0, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='\x00\x00t/netstap\x00') write$selinux_user(r6, &(0x7f0000000180)={'system_u:object_r:sulogin_exec_t:s0', 0x20, 'sysadm_u\x00'}, 0x2d) fdatasync(0xffffffffffffffff) 22:58:30 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r4, 0xc018620c, &(0x7f0000000000)={0x3}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 22:58:30 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000300)={{0x33fc420dbecd658f, @broadcast, 0x4e20, 0x4, 'fo\x00', 0x0, 0x2, 0x3a}, {@remote, 0x4e20, 0x0, 0x9, 0x2, 0x6be}}, 0x44) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000480)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) r5 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r5, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) fcntl$dupfd(r1, 0x0, r5) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) read(r6, &(0x7f0000000200)=""/250, 0x50c7e3e3) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}, &(0x7f0000000100)=0x10) ioctl$PPPIOCGFLAGS1(r6, 0x8004745a, &(0x7f0000000600)) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r6, 0xc018620c, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 816.580659] binder: BINDER_SET_CONTEXT_MGR already set [ 816.585687] binder_alloc: 6677: binder_alloc_buf size 4840 failed, no address space [ 816.585694] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 816.585732] binder: 6677:6681 transaction failed 29201/-28, size 4096-739 line 3137 [ 816.586114] binder: undelivered TRANSACTION_ERROR: 29201 22:58:30 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x452cf0b17d5fa7ca, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) [ 816.654299] binder: 6651:6655 ioctl 40046207 0 returned -16 [ 816.664619] binder_alloc: 6683: binder_alloc_buf size 4840 failed, no address space [ 816.687033] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) 22:58:30 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 816.737899] binder: 6702:6703 unknown command 0 [ 816.738405] binder: 6683:6693 transaction failed 29201/-28, size 4096-739 line 3137 [ 816.767206] binder: 6702:6703 ioctl c0306201 20000080 returned -22 [ 816.780566] binder: BINDER_SET_CONTEXT_MGR already set 22:58:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) prlimit64(r2, 0x9, &(0x7f0000000000)={0xff0, 0xffffffffffff0001}, &(0x7f0000000040)) [ 816.799916] binder: 6702:6707 ioctl 40046207 0 returned -16 [ 816.815130] binder: 6702:6707 unknown command 0 [ 816.823200] binder: 6702:6707 ioctl c0306201 20000080 returned -22 22:58:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000040)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r2, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x4c, r3, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x9902}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x1}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xfffffffb}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0xff}, @SEG6_ATTR_DSTLEN={0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0xa432}]}, 0x4c}, 0x1, 0x0, 0x0, 0x200000c0}, 0x80) r4 = gettid() r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x3b) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r5, 0x0, 0x0) setpgid(r4, r5) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 22:58:30 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 816.862654] binder: 6713:6714 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 816.872662] binder: 6713:6714 transaction failed 29201/-22, size 120-24 line 3199 [ 816.888220] binder: undelivered TRANSACTION_ERROR: 29201 22:58:31 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) getsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) r6 = dup2(r4, r5) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xb0, r3, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER={0x68, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x93}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}]}]}, @TIPC_NLA_MEDIA={0x20, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x89a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x93}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xb0}}, 0x40000c0) 22:58:31 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000100)={{0x3c, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e22, 0x3, 'fo\x00', 0x0, 0xffffff80, 0x3c}, {@dev={0xac, 0x14, 0x14, 0x17}, 0x4e20, 0x4, 0x8, 0x8, 0x2}}, 0x44) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000080000000000000002000000000000000700000000000000852a747000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000000000000000000001747b9ad1b15ba7d22ac64000000000000004c256fa1a515b7c30fc2599de05e67d757b1b968ce20504cec86ef425d94f7d79d011229e92bd920107db7a441b7e758"], @ANYBLOB="1600"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 22:58:31 executing program 4: getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0)={@local}, 0x0) pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfb120eb7) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='\x00\x00t/netstap\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) setsockopt$inet6_udp_int(r3, 0x11, 0xab, &(0x7f00000003c0)=0x7fff, 0x4) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000400)=""/117) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000001c0)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00') dup(r5) sendmmsg(r2, &(0x7f00000092c0), 0x1d2, 0x0) ioctl$RTC_VL_READ(0xffffffffffffffff, 0x80047013, &(0x7f0000000600)) write$binfmt_misc(r1, &(0x7f0000000300)={'syz0', "244b3e3fe26ceed3271d64aa76f328295ac05779f79ccf173ba30b61260febd4f33b815293174c2e8168fad8df7140567c366b16f995950b8548d1dd52cb57b03c0b2cd5893244f8cb58bef11b957fc0950caacd9f3c18840014e3a7ff2f619fa6c2e3f5ff"}, 0x69) write$P9_RVERSION(r4, &(0x7f0000000380)=ANY=[@ANYBLOB="1380000065ffff0000000006003950323030303ff295e16d1b89f5112dd3ba66fa9e7c4855c47af8c2341ca08267050f7900"/63], 0x13) bind$inet(0xffffffffffffffff, 0x0, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x40800, 0x0) open(0x0, 0x0, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='\x00\x00t/netstap\x00') write$selinux_user(r6, &(0x7f0000000180)={'system_u:object_r:sulogin_exec_t:s0', 0x20, 'sysadm_u\x00'}, 0x2d) fdatasync(0xffffffffffffffff) 22:58:31 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) getsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) r6 = dup2(r4, r5) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xb0, r3, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER={0x68, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x93}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}]}]}, @TIPC_NLA_MEDIA={0x20, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x89a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x93}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xb0}}, 0x40000c0) 22:58:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x211) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000200000000000000000000000000000000000010000000f4ffff00"/76], 0x0, 0x0, 0x0}) [ 817.415048] binder: undelivered TRANSACTION_ERROR: 29201 22:58:31 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 817.465051] binder_alloc: 6734: binder_alloc_buf size -13194139529216 failed, no address space [ 817.484858] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) 22:58:31 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:31 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 817.507552] binder: 6734:6742 transaction failed 29201/-28, size -13194139529216-0 line 3137 [ 817.530939] binder: undelivered TRANSACTION_ERROR: 29201 [ 817.541392] binder_alloc: 6734: binder_alloc_buf size -13194139529216 failed, no address space 22:58:31 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 817.571342] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) 22:58:31 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00'}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2e3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x2001) ioctl$LOOP_SET_STATUS64(r4, 0x1277, &(0x7f0000000300)={0x600, 0x60000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "abb4291ede5e270dd3f0a272134e83bbe886c41fc6faced4210500000000000000ffffff7ffff7ef0900020000d14704000000000000000000000013003e00", "141f2b09000000000000002850c94200ffff0000230000000000000200", "00801000f1ffffff194809ff1f48b823eb000000000000004f6fce49370600ce"}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r4, 0x400c6615, &(0x7f0000000000)={0x0, @adiantum}) [ 817.617093] binder: 6734:6742 transaction failed 29201/-28, size -13194139529216-0 line 3137 [ 817.651800] binder: undelivered TRANSACTION_ERROR: 29201 [ 817.711275] binder_alloc: 6773: binder_alloc_buf size 4840 failed, no address space [ 817.759944] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 817.777347] binder: 6773:6778 transaction failed 29201/-28, size 4096-739 line 3137 [ 817.789959] binder: undelivered TRANSACTION_ERROR: 29201 22:58:32 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) getsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) r6 = dup2(r4, r5) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xb0, r3, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER={0x68, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x93}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}]}]}, @TIPC_NLA_MEDIA={0x20, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x89a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x93}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xb0}}, 0x40000c0) 22:58:32 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00'}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:32 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) prlimit64(r2, 0x9, &(0x7f0000000000)={0xff0, 0xffffffffffff0001}, &(0x7f0000000040)) 22:58:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000010000000000000e30200000000000000000000000000000000ee00"/76], 0x0, 0x0, 0x0}) 22:58:32 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) getsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) r6 = dup2(r4, r5) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xb0, r3, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER={0x68, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x93}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}]}]}, @TIPC_NLA_MEDIA={0x20, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x89a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x93}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xb0}}, 0x40000c0) 22:58:32 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00'}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0xfffffe35}}}], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r4, 0x0, r5, 0x0, 0x1003, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) splice(r2, 0x0, r3, 0x0, 0x1003, 0x0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r2, 0x8983, &(0x7f0000000000)={0x1, 'veth0_to_bond\x00', {}, 0x1ff}) 22:58:32 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 818.346123] binder_alloc: 6795: binder_alloc_buf size 189184 failed, no address space [ 818.351482] binder: 6799:6803 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 818.351540] binder: 6799:6803 transaction failed 29201/-22, size 120-24 line 3199 [ 818.385015] binder: 6793:6800 got transaction with invalid offset (4294966837, min 80 max 120) or object. 22:58:32 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0xd2000, 0x0) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000100)={0x7, 0x8}) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) getsockopt$inet_mtu(r5, 0x0, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000003000010000000000000e302000000aaa01472f4a7b1bcdc1823d5ec38b50000000000000000"], 0x0, 0x0, 0x0}) [ 818.394777] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 818.394822] binder: 6795:6796 transaction failed 29201/-28, size 189184-0 line 3137 [ 818.396316] binder: undelivered TRANSACTION_ERROR: 29201 [ 818.396859] binder: undelivered TRANSACTION_ERROR: 29201 [ 818.408067] binder: 6799:6811 got transaction with invalid offset (4294966837, min 80 max 120) or object. [ 818.408340] binder: 6799:6811 transaction failed 29201/-22, size 120-24 line 3199 22:58:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r1) add_key$keyring(0x0, 0x0, 0x0, 0x0, r1) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r1) r2 = add_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, r1) keyctl$get_keyring_id(0x0, r2, 0x4) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/22, 0x16}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) flistxattr(r0, &(0x7f0000000200)=""/205, 0xcd) write(r4, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000380)=0xc) ioctl$SIOCGIFHWADDR(r4, 0x8927, &(0x7f0000000180)) [ 818.443104] binder: undelivered TRANSACTION_ERROR: 29201 22:58:32 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) getsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair(0x8, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)='lo\x00\x96o\xd6Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') splice(r1, 0x0, r2, 0x0, 0x1003, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000740)={0x0, 0xffffffffffffff51, 0x0, 0x0, 0x4d9}) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000600)) r6 = dup2(r4, r5) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xffffff9c) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x6}, 0x100) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xb0, r3, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER={0x68, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x93}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}]}]}, @TIPC_NLA_MEDIA={0x20, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x89a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x93}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xb0}}, 0x40000c0) 22:58:32 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) [ 818.486695] binder: 6793:6800 transaction failed 29201/-22, size 120-24 line 3199 [ 818.499106] binder: undelivered TRANSACTION_ERROR: 29201 [ 818.523819] binder: 6823:6824 got transaction with too large buffer [ 818.535582] binder_alloc: 6814: binder_alloc_buf size 1486374794008990440 failed, no address space [ 818.551219] binder: 6823:6824 transaction failed 29201/-22, size 120-24 line 3295 [ 818.568585] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 818.578123] binder: 6814:6826 transaction failed 29201/-28, size 4096-1486374794008986339 line 3137 22:58:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000600)) ioctl$BLKFLSBUF(r1, 0x1261, &(0x7f0000000040)=0xb7) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$UI_DEV_CREATE(r2, 0x5501) creat(&(0x7f0000000080)='./file0\x00', 0x10) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB="0401000016001703000000000000000000000000000000000000000000000c01ac1414bb00000000000000000000000000000000000000000000000004000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000aa000000006c000000fe880000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0015000000000000000000"], 0x104}}, 0x0) 22:58:33 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:33 executing program 4: pipe(&(0x7f0000000200)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = dup(r0) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000080)="c41a5044011d34cf6bad25bd4759e0cca87d8a14a7238df5a52e4b83a2981d5ae1b31ece63bb437545bea450828bb77ed3571fc0631ad1f068d65eb41da634579d5e9e570c369f1420a3b4a1fe8b704a0f267c778e2ee76786c1efdd07c11e5700bc6959911cc28bf942bd825fb72182cff07a8fe66a4e59cc831621f002ca3e8d26e6b34dc3035eb4de4caa133e13ccf2aa9cdeedf9a5dc6697cd87b6009bc5c4983a402efc581292f8a53102e3ae9d3d821b5ae705727a40d1a67bd6957ec79d787a9cd13a78f4d69da65a69339fb317cf520f1fcb50c1db3743da2f8d4db59f1ae8224f2fd6a4231679ec2d64023cf779cabbb8537f8709c4f717a91bf258") close(r1) socket$inet(0x10, 0x2, 0x0) syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x80000) write(0xffffffffffffffff, &(0x7f0000000000)="fc0000001c00071bab09250009000700079d08fe01000000001e7e93210001c000000000000600000000000000039815fa2c1ec286706ba79bb94b46fe0000000a0002", 0x43) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mtu(r7, 0x0, 0xa, &(0x7f0000ff0ffc)=0x3, 0x46) sendto$inet(r7, 0x0, 0x0, 0x0, &(0x7f0000fd9ff0)={0x2, 0x4e20}, 0x10) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x400, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = fcntl$dupfd(r8, 0x0, r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = fcntl$dupfd(r10, 0x0, r10) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) r13 = fcntl$dupfd(r12, 0x0, r12) ioctl$PERF_EVENT_IOC_ENABLE(r13, 0x8912, 0x400200) r14 = socket$inet6_tcp(0xa, 0x1, 0x0) r15 = fcntl$dupfd(r14, 0x0, r14) ioctl$PERF_EVENT_IOC_ENABLE(r15, 0x8912, 0x400200) 22:58:33 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(r0, 0x0, 0x0) 22:58:33 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x28201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'bpq0\x00', 0x420000015001}) write$tun(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="0000020000000000000060758d31409200442c00fe800000000000000000000000000000ff0200000000000000fe8000"/71], 0xff23) 22:58:33 executing program 4: r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e75781500000000f601000800000007000000402c1100000000000900005fd436b97c07000000000000000000000400385a5800040000000000000000fa0000800060000061a86c0c9d87eb866dc2b97498404364ea0d4bd05015d258a86bb60dca19d9e1b4d9e3"], 0x5b) 22:58:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000000)=0x0) setpriority(0x5, r4, 0x5) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0xfffffddd, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000080000000000000000000000000000000000000000000000000000000000000010000000000000e30200"/76], 0x0, 0x0, 0x0}) [ 819.221262] ------------[ cut here ]------------ [ 819.227531] WARNING: CPU: 1 PID: 6859 at mm/page_alloc.c:3069 __alloc_pages_nodemask+0x11d7/0x14b0() [ 819.240544] binder: undelivered TRANSACTION_ERROR: 29201 [ 819.267481] Kernel panic - not syncing: panic_on_warn set ... [ 819.267481] [ 819.274995] CPU: 1 PID: 6859 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 819.281916] 0000000000000000 97c1770d818fd580 ffff8801bb2ff130 ffffffff81aad1a1[ 819.288106] binder: undelivered TRANSACTION_ERROR: 29201 [ 819.295092] [ 819.297002] 0000000000000000 ffffffff82835ee0 ffffffff82885260 0000000000000bfd [ 819.305017] ffffffff813d12d7 ffff8801bb2ff210 ffffffff813a48c2 0000000041b58ab3 [ 819.313030] Call Trace: [ 819.315604] [] dump_stack+0xc1/0x120 [ 819.320948] [] ? __alloc_pages_nodemask+0x11d7/0x14b0 [ 819.327767] [] panic+0x1b9/0x37b [ 819.332763] [] ? add_taint.cold+0x16/0x16 [ 819.338539] [] ? warn_slowpath_common.cold+0x5/0x20 [ 819.345188] [] warn_slowpath_common.cold+0x20/0x20 [ 819.351743] [] warn_slowpath_null+0x2a/0x30 [ 819.357693] [] __alloc_pages_nodemask+0x11d7/0x14b0 [ 819.364348] [] ? kasan_kmalloc.part.0+0xc6/0xf0 [ 819.370645] [] ? save_stack_trace+0x26/0x50 [ 819.376596] [] ? kasan_kmalloc.part.0+0x62/0xf0 [ 819.382893] [] ? kasan_kmalloc+0xb7/0xd0 [ 819.388583] [] ? class_read+0x341/0x950 [ 819.394195] [] ? policydb_read+0xc3b/0x2280 [ 819.400146] [] ? security_load_policy+0x23c/0x9c0 [ 819.406617] [] ? __vfs_write+0x116/0x3d0 [ 819.412308] [] ? __alloc_pages_direct_compact+0x220/0x220 [ 819.419474] [] ? save_stack_trace+0x26/0x50 [ 819.425424] [] ? kasan_kmalloc.part.0+0x62/0xf0 [ 819.431720] [] ? kasan_kmalloc+0x20/0xd0 [ 819.437410] [] ? __kmalloc+0x141/0x330 [ 819.442923] [] ? class_read+0x2c0/0x950 [ 819.448536] [] ? policydb_read+0xc3b/0x2280 [ 819.454483] [] ? security_load_policy+0x23c/0x9c0 [ 819.460962] [] ? sel_write_load+0x175/0xf90 [ 819.466927] [] ? __vfs_write+0x116/0x3d0 [ 819.472629] [] ? vfs_write+0x182/0x4e0 [ 819.478152] [] ? SyS_write+0xdc/0x1c0 [ 819.483588] [] ? entry_SYSCALL_64_fastpath+0x1e/0x9a [ 819.490315] [] ? sel_write_load+0x175/0xf90 [ 819.496265] [] ? __vfs_write+0x116/0x3d0 [ 819.501962] [] ? vfs_write+0x182/0x4e0 [ 819.507477] [] ? SyS_write+0xdc/0x1c0 [ 819.512907] [] ? quarantine_put+0xda/0x180 [ 819.518770] [] alloc_kmem_pages+0x12/0x20 [ 819.524546] [] kmalloc_order+0x21/0x70 [ 819.530069] [] kmalloc_order_trace+0x1f/0x1a0 [ 819.536200] [] __kmalloc+0x1c2/0x330 [ 819.541542] [] str_read+0x2b/0x130 [ 819.546717] [] perm_read.isra.0+0x1b5/0x2c0 [ 819.552682] [] ? read_cons_helper.isra.0+0x990/0x990 [ 819.559422] [] ? memcpy+0x46/0x50 [ 819.564529] [] class_read+0x341/0x950 [ 819.569962] [] ? perm_read.isra.0+0x2c0/0x2c0 [ 819.576087] [] ? debug_object_active_state+0x380/0x380 [ 819.583018] [] policydb_read+0xc3b/0x2280 [ 819.588802] [] ? mark_held_locks+0xb1/0x100 [ 819.594756] [] ? get_page_from_freelist+0x9d8/0x1d00 [ 819.601488] [] ? perm_read.isra.0+0x2c0/0x2c0 [ 819.607622] [] ? string_to_av_perm+0x90/0x90 [ 819.613673] [] ? security_load_policy+0x103/0x9c0 [ 819.620146] [] ? check_preemption_disabled+0x3c/0x200 [ 819.626979] [] ? check_preemption_disabled+0x3c/0x200 [ 819.633798] [] ? kasan_kmalloc+0xb7/0xd0 [ 819.639483] [] ? kmem_cache_alloc_trace+0x123/0x2d0 [ 819.646130] [] security_load_policy+0x23c/0x9c0 [ 819.652433] [] ? native_set_pgd+0x50/0x50 [ 819.658235] [] ? security_get_bools+0x610/0x610 [ 819.664533] [] ? vmap_page_range_noflush+0x517/0x780 [ 819.671264] [] ? alloc_vmap_area.isra.0+0x810/0x810 [ 819.677909] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 819.684738] [] ? check_stack_object+0x114/0x160 [ 819.691034] [] ? __check_object_size+0x222/0x332 [ 819.697421] [] sel_write_load+0x175/0xf90 [ 819.703197] [] ? sel_read_bool+0x240/0x240 [ 819.709058] [] ? trace_hardirqs_on+0x10/0x10 [ 819.715094] [] __vfs_write+0x116/0x3d0 [ 819.720608] [] ? sel_read_bool+0x240/0x240 [ 819.726468] [] ? __vfs_read+0x3c0/0x3c0 [ 819.732071] [] ? check_preemption_disabled+0x3c/0x200 [ 819.738890] [] ? check_preemption_disabled+0x3c/0x200 [ 819.745711] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 819.752537] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 819.759102] [] ? __sb_start_write+0x14f/0x310 [ 819.765224] [] vfs_write+0x182/0x4e0 [ 819.770564] [] SyS_write+0xdc/0x1c0 [ 819.775821] [] ? SyS_read+0x1c0/0x1c0 [ 819.781250] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 819.787722] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 819.794987] Kernel Offset: disabled [ 819.798644] Rebooting in 86400 seconds..