8173dbe8f946b25457fce628f899fd6170a1649c2435193721ead82fe4740ee2764f8309737c523b5f9cdaa98e205e61204faa23233c6b9e66f94843d40a34d8601390ab080b41e46fe9cca929692992913c09e1474a79e7a1daea807d062559d6477601cc57ad199827d49d08e1ca50f5c94a664b210a7cd22ac28db51f21164a3674476be36c6582ccee15fc25f47ea0674071a05f089f1ed7caae09b41b92755bff74172b23266addfd5d5b23029f7bfbb16e54898e64db5dd3bac6b5836b5eff7d5ed1275e045772a3b107b42797d689c149dc821a7dae9dfaea18b5bfdc1231af2cf25611df4a8b44e67483e6321ce74cbcbc0819084d1c2b9c9a0ec9da302dba32ba2252f2d9c3d9276b323fe623234ad7b2af8358fb16f775eb3adb93ffecf775382c3b6463ecc2f09091f1db43a53dcfcb4a24a3399576cf3eb516bea36f1276e23796f2eaa9c3a4b8b997e839381e48fdf46b562fbd19fa8ab4b02a10bf24fff6241609ad2779582f90305a4fac14ef4facaa40eaebc33d99a3a3cd578ef7f7729860d452e35d37d14f621cf007927ecac108434c7f99a7b788b573ce18efa81dd0bacdf9c62707305d12e8f30ee273fd8112c13ff847c444e6ea98c7d5f0cca15f361375c358aaa37b750d2d9f74189920ce7b73650c9554c8c67ed0f0b7f88b9788c2df002e3a86e83079d6a3a04570c22858b25e95ebf88f5d11de6c50da916f94390afe05eeb1fbbc50d2306e49dcf559f97fda2e9d89d00ca504c76040c7cd7e80563606c5d24f43961eb029ca036d2cad249c4b4327728d1455c11679bd13e1f72c2c1747ec0136d418256d61543a914e46e2cd0ab1d619295c0521079fa048c35305e61294782620db754b59351f6b37e485576dcc3e72a6a9c2b5886ba1d7f9ddc585416df814d41d01b22b33ee36c7cdab2721421627d22090b2aa8a0cb5682d0918b300d12b56afd7fa26e287c85ca8d456a41d65a6f9307910aecbaa9abae9048540a60f47d052024c3bfdabdc084e48410dc9d481bf43a1e6d00c05865138617b08bb494766e621625857843697aaa9ae27ee928aa5d5d617b760a3e88336bfbbe10efb1ed91d8fdaa5542fd47f96deb8dc9435670b405f9f3f613b09b16c139b2641a167d32ed6113cd2e24b1d1e41201f7b921b55d7cddd1c20254c77387972bfc70db499fba28dc271c61c2f1357b8b146a5eb7701d2582783b72d6b02201a284cf1cc3c4ca6ecd3a7230943da4a7bd14d601c260dc2ea83857073cf14b785f80fbe19c64bd78270c28055018f5494b40674a6b8332f789452dad12161914fefeaea0e510a3ee9a09ee562d52537039377c0fb3c05d4c7e05af8816584222c8"}) ptrace$setregs(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000140)) getsockopt$IP_VS_SO_GET_TIMEOUT(r2, 0x0, 0x486, &(0x7f00000000c0), &(0x7f0000000100)=0xc) [ 883.937393] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:09 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:09 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x9000, 0x1000000020000) [ 884.325417] binder_alloc: binder_alloc_mmap_handler: 1799 20001000-20004000 already mapped failed -16 [ 884.346483] binder_alloc: 1799: binder_alloc_buf, no vma [ 884.348016] binder: BINDER_SET_CONTEXT_MGR already set 13:35:09 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40106309}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:09 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x1000100000010, 0x2, 0x0) write(r1, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) tee(r0, r1, 0x9, 0x3) 13:35:09 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x1000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:09 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:09 executing program 1: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x1df28000000) r1 = socket$inet6(0xa, 0x6, 0x0) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x3f, 0x301801) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000080)={0x3, &(0x7f0000000040)=[{}, {}, {}]}) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r3 = dup(r1) recvfrom$inet(r3, &(0x7f00000003c0)=""/131, 0x83, 0x0, &(0x7f0000000480)={0x2, 0x0, @dev}, 0x10) r4 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r4, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") shutdown(r1, 0x0) [ 884.415550] binder: 1799:1840 ioctl 40046207 0 returned -16 [ 884.421631] binder: undelivered TRANSACTION_COMPLETE [ 884.430578] binder: undelivered TRANSACTION_ERROR: 29189 [ 884.444624] binder: undelivered transaction 503, process died. 13:35:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x1000100000010, 0x2, 0x0) write(r1, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) tee(r0, r1, 0x9, 0x3) [ 884.504993] binder: 1843:1847 BC_ACQUIRE_DONE node 505 has no pending acquire request 13:35:10 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:10 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x7, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x1000100000010, 0x2, 0x0) write(r1, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) tee(r0, r1, 0x9, 0x3) 13:35:10 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000001740)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000240)='trusted.overlay.opaque\x00', &(0x7f0000000280)='y\x00', 0x2, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000100)={0x0, 0x7, 0x0, 0x101, 0x6}, &(0x7f0000000140)=0x18) openat$dir(0xffffffffffffff9c, &(0x7f0000001700)='./file0\x00', 0x400, 0x80) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000180)={r3, @in6={{0xa, 0x4e21, 0xde44, @ipv4={[], [], @multicast1}, 0x10000}}, 0x8, 0x100, 0x4, 0x7, 0xa2}, 0x98) write$FUSE_INTERRUPT(r2, &(0x7f0000000440)={0x10, 0xfffffffffffffffe, 0x4}, 0x10) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x5}, 0xab) writev(r1, &(0x7f0000001680)=[{&(0x7f0000000480)="f46534547211a562b49ff96c4d708786e82ed0321ee334c68693c236edb3f9833d1d4bdd42c2d1d317d8fe3c", 0x2c}, {&(0x7f00000004c0)="648aa39d794a13cad45c614d", 0xc}, {&(0x7f0000000500)="ef28870792efd4644698684f08d1666bfa9caa58837146ff4cb2606761ae6124af0fabac4833c9d2e1bc08a0298d122ff2ed29ae307cf399ef8f736daddc257373d3dce5d6211afdd3f9ddaff4fed9f4f6aee9a03490f60d9061373e83c57bd2301d4b34ed8173492433214709162587320098bf4c29f31d37c5fe624b5cd0c4726f6df4f191ac089b535619039f04ba5806627552a0ced1cc0ca2423bc8a4fae56124472b4ae7672c74c1c814430654075c60", 0xb3}, {&(0x7f00000005c0)="ed009c560b6b7cd7dfe2d7b02524034cb14c5bd755c37bfe53afd5f35f87506090f77c0c0610b240d9446c91e911fa5eb3cfb2a266a35a5db2a3ebb8236f199fc7af473f249f9b87a875f64bbdfc37a98a02ad6e7bde51b4741087db2a8cd69468c703e8a21bc928ed187a6882f8c2b8f3dde84dd337bf1bae2c47b32bfff830b7e44a35317de77c46e7f383324d3b4c055d3c49e3dfb3227309310a35d4bb7263e7b0a9190658a0201f1f8dd91adba687aff7f1512ece536eb2d4c3f235", 0xbe}, {&(0x7f0000000680)="510f5605b4a1b326ea153a2a2c57465e373d2f7a3ff1a322b80b3632fe55e839069e9143bd9f8883f640423ee26b46e608425e1da9540f742fdf41cefc71e6b7a80b7cfe3ed3ac6526634ca44621ee0817e20279b23f385551ed799a8139beee9393c1bd8fe921d5c52cc9a893966f0213c387c5cf9e482ce864b893c57ec91bc6597f9277b30c6e6fd9c62134fbf40749d04b5d6df292a6cc4767238e8ef3a5ba9957ec39647075f13d7b405fe148a60e2ab8889c881698759e6297522ae09c28a46fe1956daccfa8b085d076dc3bf389b8620e2fb90c3e534b7d27d0c7865fd03299aa31a28ed66232b811c7c38fd7aa7f19f822d7be0c1bbcc9e65c8b21a5d4625859b3dc2f771dc2806f3a695a21e10d18f62f41b3e318d73ee95aa94adf4ec6b09d271b1617968be71c091f70e50d007c4037bb797c79a429e2737362537669799da16fcfe1a54d2a76bb7de430dcdb2cc40855f9339727fb0bf170150b3fdce164c40e0ffdc7c15b6e8c12e5c689e7eadbc12feedb2dcc8e3efa336540cf2066ca01974243114988ffbe0f6530483b1b48a7bbba6076cb3af7dcf2e8f5a3a0dbb6da45d2757d7d6c8c26db3f3f0091ee1a6737b8204ae49c0391c07240221b30c83adc615b0507877392b0deb04fca0a133cf31f4fba60d3f4ea15a3ea3ac8dc01aab76181349e097a5e7a51880d3ead77fce6179f5d3e5c45e75c2c57da932135c14bc4d686833fc2a8147fff8e21358f19ce8b5cbfd0ed7f686b213f6c173e95deab889ad79b0a8c24a6aea71c98aa90504a8e1f48a0c1bcd87c835796b61a8299d8db999b077d43bd19fa114b68bba86bf5de82b6683f5f070a7d354032e0e165bb7be448d251276237cf4c496f5620566831c808fef45ac3754cec651b2ba77a49b2e41c6f0a71aa40196d832e3e101e110c722353188471a5c60d3cc539591b5320e1c3c2708119cbfbffd7a6198ef6139a2463f718edc5e5c9d2d3c24f7e04880c7e4d138c309a00c28604a9e0ff6683094abfbd9a4df25ccca409cf5d82c748618f29818207efde1dedbb86264af43d5d2ec89cc29708511f0c21642ae6dc6d5b08dcd97fbc2730023b81931bbdbdd8e33a75e81b92ed89b1a7a3fd03cbfcc59d330c45a1645ba45eaaf7ce256e4feae9dbe654c3db53aa067ed9b542db33df20f15101b2897f67532ed7afaf3d5957e4f65665eddacfdfbfce73a3c26e859b6dfc4536d879c8622b5f4358290f22189f94bc87bbabd0ac171d13fa0d7e3c6c80c754f01bfd79345b59ece15c6363f4c52c8846527de40c9490d7fdccdf80eef2b1bf4dcad40256d6a3e8698941af1587b808bfcd61f12ed73adbb90bde9c061062e5bf65a500abab53babe9d11adf2643a4adc528764ff4192a66b73e297a9c71b9447bd595c588c15df2417053e81a9d75a64795efad8d3c18d963c018fc6b2daac3428e8724791209e107f921e958ea5ed79dd117c99712456b15b569a1f33e841fd5cae43cb390072ae113fbf1c155894e0398b7aff8f9973d4cfcf25b06c1e7aefce2155a53313bd862d3fc24a7e7d30ae479ae5abbe2ec1f8e571881e2d6a7a952896ee4ede4ef0a932db3d10f72ccd33b541e4eaa1977681ee07bbabb37630c614df527f5433b5be8b5ec8ca8cc96815acf379fd8bf10f0663f53b3e8e613406891097df1edff992a538d45f70a81afeadd2de808b16d5c94aeffd2bf9d08a5ae63099c17b21aa32da6146cdce1960d919291a4c98116fe565185a60d780aa544dfdc87e6cc5c1e47c91f3a31bea6eaccc2fff2366c9db197e33585e626d99cbe5922af5d8ab67a624331429eb16d2c422eece3c1a65e2ee8e831b2b13dbb979a977123f2076ce36b0c1daa369f3a6dc4a4e0a0f7043cfcf31d88820ab3fda16e7296997ec4a1f9a1ec40c82df34ba3c86d77374b25477e86d09ac1d525b56b06b6ecbe7e73fc1ddb6a2496c59a3539627151f9ff6824cf3752fa1db4304716e9711e6429499669bf03df2a58699cbf3a2688a58fe2de9f89abe3de9bcdeca1a9f2c5acd2b62a1be43bd4c2035e4c721e059f057ae9182bb012ad3415bb6dff37876340adfcf6ffed96d079dbfb5584506b7dcb0de8f1cb7b116cec79522097bd7935d75a685f2cb49c90c208d5fc6fcd232095c0e43c28dc4fd80e654da383980cf85d5c64f32645b2e48e0176b2c672cd6c10130b4657385c139258bd0d5376a239a7990d5237fff3b767f655db80b000e7653d2c6e24219476ba2befd3b6436a6a697255067e6d56f5931f806a35374e2023d5879e15c9bad8bbf5d8b69e325f91f05945064f67a8b9e3ac33fd433c1e7083c0c3df11d3451c17d559aa0af446ae159a068315d33344bb633d7e4abf9121175dc086d366b15ee5ec300889a14f70dbd6bbbb416375c09bc66ec8c12b584d719fbed5b862fccdc7a8aaf7aefb8cfa8cea59e3bb5963e3acb6e29e995345c60d6a256515e069418ba14ef7c6c25583730e4944da7167ae15a90fd38b66e5190e967b68c56c084079a82c166500d6a11273b08d668c5985cf08e6ed9e50b5f5011ec9c187c53595942b0a1c51397c5973c22dae73fd4cc8e073eecaaee61856f328affbb8998599c4d0010b20509c88ce31893aa5ed40ceb868c2daa079335c90c600069e61a2dcebc9e92d188e69fd8dae9c020058fb0d776d52f508cd1f335396a773ef37a95b6b1167cb97eabd32628b3da74a1df0ef52b71fc77ebfe4e7a519c6f386235bb54f7f60eedccd563a9fdc0fba38bfa7898cd937e3d0e71886cc012e3a4211fe4795b17bd9cf880806cbf58bdca12287938351dde46a105d86f9f51f292b0e437197ed0e09781a61b9ff56f08f1419bf93a9f53dfe21ed5b0b0355ecd8de76653639d385a18d7e2c91ebc4c0874d0130ca53d7f49e347aafdc2c0b9bec3d79299dab8a76e61515b3f6930e05c9bf1ea5bf619f708e7cbca747676cb3e929855a293242a48688181bffa16b87dca0452a47a29adc70c853812259b27db216e5b54f23f61c5662ad7190b905c9365c414620ee527caf9fe5fa7a0088f4e33a5c6c8d56347ab67baaf6b6dc50f8df73e2ef1151b0fcf88ba8c2127f8ee951c8de94ab1b429ac60ad91a5e5a0a104560dd18fec4dfd996262afd7a10277a1573e388537f559fd616207908d011077da1eadbe1f3c9bebf15edf89bd78fc49daff64eaf78dcfbe8d8a0ce6310f07824fc5e42fee4d56b48c9193b8907bfedc3e5d568a58fe9fdc79f716e36e1cf112e3c5436f10c98ac56ccd5cbae21aa9a88fa49cef862fedf9389b1653cc685ef5735916cd6449e1900396aebb160b8631baa18602160a0874750d2302a55a0b19e6a81236fd232163fed6d212a962cc44d38a895a3ffcea141819ef4a3a60a3fe43e707b84581ae3baa7289282af72c7410b91e6ea5be87ecdd91c3f7e3c3e3768e087155d0144ff19ac83f1f9ef8c5ca178f98ca3e162bc1d491831905408c99f3f09ad5d03ee2d3b4f4e25bb246a00beb703ba04b8bdfcf22480187b28bc298a7e7ef10fc0d25a98933553dcaf7784f6a55b4637036b8556a9c3206b2715371ebb90e5915698946a98cd98738ce7e40e585813927e45b438161f53cb65177a16838d5ef58eb7cdceaeb7f83a38000953403a9bccb278727bded4ec8793ad774bbb81ed524a40e339b3d7386f21d5af1a55891304c34297911aab24eb185137872569bc0a16aeaeb934bbdd437032798004cfc76d4357d393ae09ff1cef66b4114e6972e97be45cd5bc317b20af41f66d6d580e270ecef108d05b2f3580a54c766fa1414879dc76fb7a806396daf02750fe3ab0479fb5cb7731c883a3556758fce693312f4ecdd38460da4a8b42d1bad074f448d15320349fe8b0dedec0ed905d0ffd349867256d9cd82efa29041daf53e6eafc57344b98c63389fc303d985708e9946ca7f7f054110f6be5affa1066ffed503bf0d3f15eaf43a31bf27d9d3d54eb7146e86247ebda63038963e2df2cfdfa1be0de4b1e8de3ff27c0c84b4f8dbb4e1c1c9f9671378869c770c407584b2731fa31663f4629bbda723a595f9a0a9b78a88807ea2e9b50aa46242caaf6252d5c9e0f3bf414664e3aa2e2bf128160a5d44bb0c405efaea07979a820b789efae6b1d61e5e85b77d697216e31a69ea93c0eca3e52b527cf2a73cc1c8ffdf3c0e69ecfd2b1f90113d7cdbaaab9379c8e81e221aa8289b5e5b8e462e319c019b481a57c4730ede00f6523657df09582b5e950f08890ec36dadbb87b338e51882eabeee6e78080d5f346a9179d36673b768fdafc380d9c2365355a3583dbbc8a49cff266485e0ab41dad29310c39a8b3afa6098aad4fdef12c9dfd696e305c7e4be45895760f966f4a106a8b8ea2200c699b6cfb1bb1a095a711295304604fd046330694432ffb2bc7d14b8a3297d93e6706c8178b97fed3b0b27962f5c74143a862f38c4af65d9e56a17ffe118944150ca8baab839de3c1e314f632dd1acf1bd4b0d07008734c786b8d8565f14bce3ec5ab30587fac26cb852bbdcf80801745a90eb521def1955cb8e9c598a724d1357ae6504ad9f950a7ba58839b0e2aebb11c9351a98eedea6d5993b2e37fd270743b02fb1865c3254ac5bb969e961d328bf013415f17876fed4fbb36d7b0c423ae0e9e4d303f515cf7d17dc70cbe78268e9c64ba8b43d7b367aa96fdddd8d943057720633385872bee488e7763cc4f1b639424aa526bf0700381055edc482f1dfcdb5be18d3ddd24f3fc223f54a482bfcf60407669424ffd395beaab1583320896d92fc7733c4b205f3cc74d313a2ca8403e546704086f895d72f465956563547e9883d43a64bd4e3978c9b4f9620468611306c4ab79ceac71a5d24cc70b186a4cd722ccfd1faee473f0c554f639f8941955f79561beaef250876fadf828d02a11e111a73d29b91030bd633ff9c5422b0652c7846f86de0dc6e5f4fb665a10ac5c56f0df127d84dd890dd30d6b04375c602296105cfe4e1ead215cdd04d03cbbebb80eed8fa1dcbf2f17b3775357aeb7f4949d6e1fe2385260df9f2871c5f604b5107e86651dcd9d99108ef9e0f7a8f2f7971cacaa6473772b436bf3f55451d1c15ce51522f348374adf4980925aa9b74ca8ca32c90dceb3184aa539cc8b0bbe364f4b4cbe66ee73527eb6102ee14fbc4266cb861fd136ff4dfc5608496ad2e057e637ef0443d760a5eb706dd3c5b1e1a062f1294a3a0b1c8859d34533ab9200c1fc7ff1d05d2a645392df2541274af8a07fedb7102d0acaac554c4f878e13370b202e1f20f9bd72a31300d293bf6a23c274d4adf223775776d22d514183096727bf0d7307fd7a9fe0dbec27c881193c810d3770e785b9fd39169338fea6d266121b52ee9009151993c8df2c5d84e77254ea7d20cc7147296818ed4c1e8838d432eae4e8380942d01cc9533a369ca1a7215862280552f82ae72cd36279b3782d2dfa8235026d89be3ce6ea0a8a1296edc1e49e443cba533576f6161131568e47b5dae60a621a5ac6848611b1f834b19a5a9b09c680961a462df96c83f90824453372ca0f1b970d1537cc73c9c4988646847c909a4b04c3eae1ab3a4ca602e3beccfc447e67276f0f18aa8937f9b65b51710272d944205a63c03e4de4b8733fe1c1c04760e35b4d59f773927d79b43653656f87221790731af5a78896380713d8bc56591f02af61b0d0309726c345eb6a7a2e73a8ecd699ec45c328a322e0eb6603a3ca2480866a3dfe0e6b8962f74aebcc19a", 0x1000}], 0x5) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f0000000380)={'broute\x00', 0x0, 0x3, 0x25, [], 0x7, &(0x7f00000002c0)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000340)=""/37}, &(0x7f0000000400)=0x78) socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$inet6_int(r4, 0x29, 0xcb, &(0x7f0000000080)=0x100000000, 0x4) syz_open_dev$vcsa(&(0x7f0000001780)='/dev/vcsa#\x00', 0x100000000, 0x101000) 13:35:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x1000100000010, 0x2, 0x0) write(r1, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) tee(r0, r1, 0x9, 0x3) 13:35:10 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 885.285023] binder_alloc: binder_alloc_mmap_handler: 1843 20001000-20004000 already mapped failed -16 [ 885.295269] binder: BINDER_SET_CONTEXT_MGR already set [ 885.300601] binder: 1843:1871 ioctl 40046207 0 returned -16 [ 885.306941] binder_alloc: 1843: binder_alloc_buf, no vma [ 885.312431] binder_transaction: 2 callbacks suppressed [ 885.312449] binder: 1843:1872 transaction failed 29189/-3, size 0-0 line 2970 [ 885.325571] binder: undelivered TRANSACTION_COMPLETE 13:35:10 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40106308}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:10 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x3, 0x385240) ioctl$DRM_IOCTL_GET_UNIQUE(r0, 0xc0106401, &(0x7f00000001c0)={0x35, &(0x7f0000000180)=""/53}) syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000000)='./file0\x00', 0x40000000000e900, 0xaaaa949, &(0x7f0000000040)=[{&(0x7f0000000200)="eb2c906d6b66732e666174000405010a02000274f1f8", 0x16}], 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00e8377ee4976aac9217ee45e23a366acf34d7ba1fb1bec502f74738f1e3868a3c0692e266a47937991b38d934c0eca3b2bcca75fba3057873f1d7c25d0852234cf8f7c013491a0bc5f213022a3acd2765"]) 13:35:10 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0xc77b6d8591, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:10 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xf4ffffff00000000, 0x1000000020000) 13:35:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x1000100000010, 0x2, 0x0) write(r1, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) tee(r0, r1, 0x9, 0x3) 13:35:10 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 885.335420] binder: undelivered TRANSACTION_ERROR: 29189 [ 885.340958] binder: undelivered transaction 506, process died. 13:35:10 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 885.442269] binder: 1884:1885 BC_INCREFS_DONE node 508 has no pending increfs request 13:35:11 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x4000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 885.486894] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 885.494152] FAT-fs (loop3): Filesystem has been set read-only [ 885.500431] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 885.508497] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 885.515902] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) 13:35:11 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 885.531381] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) 13:35:11 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:11 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x10000000, 0x1000000020000) [ 885.562070] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:11 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 885.786674] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 885.793971] FAT-fs (loop3): Filesystem has been set read-only [ 885.800636] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 885.808931] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 885.816749] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 885.833031] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 885.840909] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 886.236267] binder_alloc: binder_alloc_mmap_handler: 1884 20001000-20004000 already mapped failed -16 [ 886.245991] binder: BINDER_SET_CONTEXT_MGR already set [ 886.246011] binder_alloc: 1884: binder_alloc_buf, no vma [ 886.256880] binder: 1884:1906 transaction failed 29189/-3, size 0-0 line 2970 [ 886.257384] binder: 1884:1905 ioctl 40046207 0 returned -16 [ 886.264520] binder: undelivered TRANSACTION_COMPLETE [ 886.275802] binder: undelivered TRANSACTION_ERROR: 29189 13:35:11 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x630d}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:11 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:11 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'veth1_to_bond\x00', &(0x7f0000000000)=@ethtool_stats={0x45}}) close(r2) close(r1) pipe(&(0x7f0000000040)) 13:35:11 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x400300, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:11 executing program 0: r0 = socket(0x0, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:11 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3e00000000000000, 0x1000000020000) [ 886.290050] binder: undelivered transaction 509, process died. 13:35:11 executing program 0: r0 = socket(0x1000100000010, 0x0, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:11 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:11 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x600, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 886.445945] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 886.470624] FAT-fs (loop3): Filesystem has been set read-only [ 886.483987] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) 13:35:11 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f0000000000)={0x7b, 0x0, [0xc0010015, 0x6e864762]}) 13:35:11 executing program 0: socket(0x1000100000010, 0x2, 0x0) write(0xffffffffffffffff, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 886.492360] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 886.501561] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 886.531775] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) 13:35:12 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080), 0x0) [ 886.552167] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 886.559879] kvm [1931]: vcpu0, guest rIP: 0xfff0 unimplemented HWCR wrmsr: 0x6e824622 [ 887.170228] binder_alloc: binder_alloc_mmap_handler: 1919 20001000-20004000 already mapped failed -16 [ 887.180065] binder: BINDER_SET_CONTEXT_MGR already set [ 887.185649] binder: 1919:1937 ioctl 40046207 0 returned -16 [ 887.191517] binder_alloc: 1919: binder_alloc_buf, no vma [ 887.197145] binder: 1919:1938 transaction failed 29189/-3, size 0-0 line 2970 [ 887.204827] binder: undelivered TRANSACTION_COMPLETE [ 887.211455] binder: undelivered TRANSACTION_ERROR: 29189 13:35:12 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40046307}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:12 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x100000000000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:12 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:12 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xa0000, 0x1000000020000) 13:35:12 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080), 0x0) 13:35:12 executing program 1: syz_emit_ethernet(0x7a, &(0x7f0000000040)={@local, @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "1ef086", 0x44, 0x2c, 0x0, @ipv4={[], [], @dev}, @local, {[], @gre}}}}}, &(0x7f0000000000)) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000380)='/dev/mixer\x00', 0x20800, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e23, 0x8, @remote, 0xffff}}, 0xffffffff}, &(0x7f0000000480)=0x90) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000540)={r1, 0x48, &(0x7f00000004c0)=[@in={0x2, 0x4e24, @loopback}, @in6={0xa, 0x4e22, 0x9, @remote, 0x9}, @in6={0xa, 0x4e21, 0x9, @mcast1, 0x401}]}, &(0x7f0000000580)=0x10) [ 887.223761] binder: undelivered transaction 512, process died. 13:35:12 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080), 0x0) 13:35:12 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$vsock_stream(0x28, 0x1, 0x0) io_setup(0x8, &(0x7f0000000140)=0x0) io_submit(r1, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000140), 0x5ee}]) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xc1b, 0x28c8c2) ioctl$DRM_IOCTL_MODESET_CTL(r2, 0x40086408, &(0x7f0000000040)={0x1}) 13:35:12 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x300000000000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 887.322498] binder: 1951:1952 DecRefs 0 refcount change on invalid ref 0 ret -22 13:35:12 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:12 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c", 0x10) 13:35:12 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c", 0x10) [ 887.442269] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 887.453716] FAT-fs (loop3): Filesystem has been set read-only [ 887.460608] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 887.469559] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 887.477374] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 887.500257] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 887.525947] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 888.111926] binder_alloc: binder_alloc_mmap_handler: 1951 20001000-20004000 already mapped failed -16 [ 888.121574] binder: BINDER_SET_CONTEXT_MGR already set [ 888.126985] binder: 1951:1968 ioctl 40046207 0 returned -16 [ 888.132843] binder_alloc: 1951: binder_alloc_buf, no vma [ 888.138476] binder: 1951:1969 transaction failed 29189/-3, size 0-0 line 2970 [ 888.146666] binder: 1951:1968 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 888.154397] binder: undelivered TRANSACTION_COMPLETE 13:35:13 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40046302}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:13 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000280)={{0x2, 0x1, 0xffff, 0x81, 'syz1\x00', 0x1}, 0x0, [0x81, 0x4, 0x401, 0x5, 0x9, 0x857f, 0x9, 0x0, 0xd3, 0xccd, 0x400, 0x82d7, 0x6, 0x8000, 0x0, 0x81, 0x3ff, 0x4, 0x1000, 0x80, 0x5, 0x8, 0xffffffff00000001, 0x7ff, 0xffffffffffffd248, 0x6, 0xfffffffffffffff7, 0x4, 0x8001, 0x1, 0x401, 0x2, 0x200, 0x7, 0x1000, 0xcc, 0x4, 0x80000001, 0x6, 0x4, 0x8, 0xfffffffffffffffb, 0x7ff, 0x79, 0x7, 0x8000, 0x1f1, 0x6fa, 0x200, 0xfffffffffffffffa, 0x6, 0x10000, 0x1, 0x8, 0x5, 0x0, 0x80, 0x200, 0x9, 0x5, 0x2b1, 0x60000000000000, 0x7f, 0x0, 0x0, 0x5, 0x3, 0x1, 0xffffffff859e376d, 0x20, 0xfffffffffffffff7, 0xfffffffffffffffa, 0x9012, 0x1fffffffc0000, 0x3, 0x3, 0x16, 0x9, 0x5, 0x2, 0x401, 0x5, 0x5, 0xfffffffffffffffe, 0x3, 0x7, 0x6, 0x80000000, 0x40, 0x4, 0x1ff, 0x19, 0x0, 0x6, 0x100, 0x8, 0x0, 0x4, 0x7fffffff, 0x3, 0x101, 0x1, 0x9, 0x5, 0x3, 0x6000000, 0x3, 0x10000, 0x7, 0x9f, 0x3, 0x7, 0x7, 0x0, 0x3b, 0x5, 0x9, 0x1, 0x800000000000000, 0x2, 0x2, 0x6, 0x6, 0x5, 0x8, 0x9fb, 0x2, 0x7ff]}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045113, &(0x7f0000000080)={{0x0, 0x2}, {0xfffffffffffffffd}}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(r0, &(0x7f0000000780)={0x6, 0x118, 0xfa00, {{0xffffffffffffffd0, 0x3eb7, "d89d745d95e482c12cdcb5bbcdbd694f6ce29871672ec1fd349b0e569061a0bf1c5557546f7aec1b8ce46f712068d96c56d5c074bf0cdd986bbf55e6b7ba503fa729838e737e9affb70a6e8b706cf2691e3931a28e623c67b83b80cb8aafc8b1213d6f22b3d0ce80d58afc75667fe76d3e05a3201be2beae9a4901efecb9fb6fe13dee46a68acbf0dd837a67589b0a351554be4f6a130fa9413f1883d50b4fe5317c7f6f5a2921e76696e9dd69c2dd107bd7120494ffa628ca06d357a70e1c1347c68d28f1baee940fa9446ea02216164719ef1c144512ae1c5c01353cba0bd396700b10b74f78d4ac0448008bf1791f5ba7423fd8992de55c412c862079bac1", 0xcd, 0xffffffff, 0x9cd, 0x9, 0x5, 0x9, 0xadbc, 0x1}, r1}}, 0x120) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000140)={0x9, 0x108, 0xfa00, {r1, 0x82, "bccf9b", "fbb5c2d524e459ef5489a35c7c7a75dd993c5930c30621175a74601380e119a881dc7d75727233f82ad48e12affd0458531f971ed5a4debc5fbdb1e655c7e3603977dd56a13a5749d9568036566103024e32b94474fd9d3ae0b1376960b6f12bbac99eecd4c0430a5199ce40187ec94f0fb4bcd15aa873649308b49b2d24c7927938cf69186c0e25dc1c4fa88861e00cc0eed214da8826e342ce4f33189014a47b9fd0e4fa3d7c76305ed7249b54d31a873c344437e3ba4928272dbeee7cad3fb4a985e29673deafdef7e899c75f9701629c314871fe10c77a83618234576eeb63692ac8db53cec38941de00d6a0b2980003cef9d980c953f569278f9ae7505b"}}, 0x110) 13:35:13 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x3f000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:13 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:13 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c", 0x10) 13:35:13 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x100000, 0x1000000020000) [ 888.160620] binder: undelivered TRANSACTION_ERROR: 29189 [ 888.173462] binder: undelivered transaction 515, process died. [ 888.240201] binder: BC_ACQUIRE_RESULT not supported 13:35:13 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d", 0x18) 13:35:13 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000200)={0x0, @in={{0x2, 0x0, @broadcast}}, 0x0, 0x3f}, &(0x7f00000003c0)=0x90) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000380)=0x40, 0x12) keyctl$join(0x1, &(0x7f00000005c0)={'\x00', 0x1}) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x47744279}, r3, 0xffffffffffffffff, r0, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f00000000c0), &(0x7f0000000140)=0x14) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000000)) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f00000008c0)=ANY=[]) close(0xffffffffffffffff) [ 888.266778] binder: 1978:1979 ioctl c0306201 20000140 returned -22 [ 888.289739] binder_alloc: binder_alloc_mmap_handler: 1978 20001000-20004000 already mapped failed -16 [ 888.321929] binder: BINDER_SET_CONTEXT_MGR already set 13:35:13 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:13 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x2000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:13 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d", 0x18) [ 888.346173] binder: 1978:1979 ioctl 40046207 0 returned -16 [ 888.347798] binder_alloc: 1978: binder_alloc_buf, no vma [ 888.385569] binder: 1978:1984 transaction failed 29189/-3, size 0-0 line 2970 13:35:13 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x60, 0x2000) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000180)=0x234134be61d0d157, 0x4) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") name_to_handle_at(r1, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000580)={0xc9, 0x7, "97434443e6f559a7dae4810913e956fa35b67761151ca088bec4ac50f0399fc5900516a446bf01c9bdc24df19a9f6623c0b5e1718cb0556c3b5cbb4611d1e7e9ce8683bc3ef4b2052ae56f5ec73dc9976f1a967f00b1acbcd2756d4279302927b7beabc7bede3b6412446f03af1b08744d2da77fccf9a00850236fcbd58c90b5a64e316161bdec253511f99575f899b91f20c3791f3306001715651924b673f76e61080f4910199b10ea0c3614a2b8b27ba26052c2988627b7437328ff231fdb4e"}, &(0x7f0000000300), 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r3, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB="2c7766646e863d", @ANYRESHEX=r3, @ANYBLOB=',\x00']) write$P9_RREADDIR(r3, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) write$P9_RGETATTR(r3, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) lsetxattr$system_posix_acl(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000540)='system.posix_acl_access\x00', &(0x7f0000000e80), 0x24, 0x0) [ 888.390478] binder: undelivered TRANSACTION_COMPLETE [ 888.407102] binder: undelivered TRANSACTION_ERROR: 29189 13:35:13 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40086303}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 888.438947] binder: undelivered transaction 518, process died. [ 888.451705] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.465771] FAT-fs (loop3): Filesystem has been set read-only [ 888.472203] 9pnet: Insufficient options for proto=fd 13:35:13 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d", 0x18) [ 888.494838] 9pnet: Insufficient options for proto=fd 13:35:14 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:14 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = semget$private(0x0, 0x1, 0x1) semctl$SETVAL(r1, 0x3, 0x10, &(0x7f0000000100)=0x3f) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mmap(&(0x7f0000000000/0xef9000)=nil, 0xef9000, 0x2000005, 0x32, 0xffffffffffffffff, 0x0) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000000), &(0x7f0000000040)=0x4) r3 = dup(r0) inotify_add_watch(r3, &(0x7f00000000c0)='./file0\x00', 0x4000100) ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f00000002c0)=""/4096) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_CHANNEL_POLICY(r4, 0x112, 0x8, &(0x7f0000000080), &(0x7f00000001c0)=0x4) 13:35:14 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x2000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 888.515445] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.547953] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.560080] binder: 2002:2004 BC_FREE_BUFFER u0000000000000000 no match [ 888.563248] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.592503] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 888.602920] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:14 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xf, 0x1000000020000) 13:35:14 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836", 0x1c) 13:35:14 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, {0xffffffffffffffff, 0xffffffff, 0x3}}, 0xa) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000340)=0x0) perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0xffffffffffffff14, 0x993, 0x3, 0x7fff, 0x0, 0x6, 0x1, 0xe, 0x3, 0x101, 0xff, 0xfffffffffffffff9, 0x200, 0x7, 0x8000, 0x7, 0x0, 0x1f, 0x3f, 0x6, 0x10000, 0x0, 0x3, 0x265b, 0x1, 0x8000, 0x9, 0x1, 0x9, 0x80000001, 0x8, 0x5bc, 0x7, 0x1000, 0x20, 0x8, 0x0, 0x3, 0x5, @perf_bp={&(0x7f0000000280), 0xd}, 0x10000, 0x1f, 0x1ff, 0x2, 0xffffffff00000000, 0x0, 0x19c3f149800}, r2, 0xa, 0xffffffffffffff9c, 0x3) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x2, 0x1a}, 0x20) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20020000}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="40000000350004002abd7000fbdbdf250c00000096e66bc1f9ab265a200005000000080013000000000000000000175525d7159cce6edc79548ee462a606c368e45d9ca24080e714e3d3bf5309e28b83880312b02332ceafa067700960ffff0755bb828627a25fd70bab10ba6b3266a462184a93123f618d47953855b628db9455a0df37917d15f7fed653b6a8ae4be5682b712b36f3ec400a80957d002796381e070467f145026589af4a3d3a347c46b7e203935f930615c0fa85f2ca4df9595739e15925ea194210f0d36263e9435f8a", @ANYRES32=r3, @ANYBLOB="0c0024000600000000000000000000"], 0x40}, 0x1, 0x0, 0x0, 0x40040}, 0x1) 13:35:14 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:14 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836", 0x1c) 13:35:14 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:14 executing program 1: capset(&(0x7f000043fff8)={0x19980330}, &(0x7f0000092000)) bpf$PROG_LOAD(0xa, &(0x7f00000ba000)={0x0, 0x3, &(0x7f0000346fc8), &(0x7f0000f6bffb)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x6, 0x400040) clock_gettime(0x0, &(0x7f0000000d80)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000000cc0)=[{{&(0x7f0000000040)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/11, 0xb}], 0x1, &(0x7f0000000140)=""/226, 0xe2, 0x1f}, 0x7f}, {{&(0x7f0000000240)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000780)=[{&(0x7f00000002c0)=""/144, 0x90}, {&(0x7f0000000380)=""/171, 0xab}, {&(0x7f0000000440)=""/17, 0x11}, {&(0x7f0000000480)=""/99, 0x63}, {&(0x7f0000000500)=""/239, 0xef}, {&(0x7f0000000600)=""/114, 0x72}, {&(0x7f0000000680)=""/249, 0xf9}], 0x7, 0x0, 0x0, 0x7e0f}, 0xff}, {{&(0x7f0000000800)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000880)=""/11, 0xb}, {&(0x7f00000008c0)=""/221, 0xdd}, {&(0x7f00000009c0)=""/207, 0xcf}, {&(0x7f0000000ac0)=""/164, 0xa4}], 0x4, &(0x7f0000000bc0)=""/248, 0xf8, 0x80000000}}], 0x3, 0x12022, &(0x7f0000000dc0)={r1, r2+30000000}) [ 888.846573] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.853901] FAT-fs (loop3): Filesystem has been set read-only [ 888.862018] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.870685] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.878265] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.886044] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.893446] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.901242] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.908732] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 888.925683] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 888.933815] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 889.358939] binder_alloc: binder_alloc_mmap_handler: 2002 20001000-20004000 already mapped failed -16 [ 889.368991] binder: BINDER_SET_CONTEXT_MGR already set [ 889.374369] binder: 2002:2031 ioctl 40046207 0 returned -16 [ 889.380377] binder_alloc: 2002: binder_alloc_buf, no vma [ 889.386007] binder: 2002:2032 transaction failed 29189/-3, size 0-0 line 2970 [ 889.393610] binder: 2002:2031 BC_FREE_BUFFER u0000000000000000 no match [ 889.400739] binder: undelivered TRANSACTION_COMPLETE 13:35:14 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x6344}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:14 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836", 0x1c) 13:35:14 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:14 executing program 1: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x100000001, 0x183080) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x10001}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value={r1, 0xfffffffffffeffff}, 0x8) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x3a, &(0x7f0000000a00)={@remote}, &(0x7f0000000700)=0x14) 13:35:14 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x91856d7bc7000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:14 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3d00000000000000, 0x1000000020000) [ 889.406735] binder: undelivered TRANSACTION_ERROR: 29189 [ 889.419348] binder: undelivered transaction 521, process died. 13:35:14 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x6c400, 0x0) write(r0, &(0x7f0000000400)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r0, r1, 0x0, 0x10000) lsetxattr$trusted_overlay_opaque(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0xffffffffffffffce, 0x0) 13:35:14 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be38", 0x1e) [ 889.496753] binder: 2045:2046 unknown command 25412 [ 889.516267] binder: 2045:2046 ioctl c0306201 20000140 returned -22 13:35:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be38", 0x1e) [ 889.532227] audit: type=1800 audit(1539092114.990:405): pid=2049 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor1" name="file0" dev="sda1" ino=16563 res=0 [ 889.554597] audit: type=1804 audit(1539092114.990:406): pid=2049 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor1" name="/root/syzkaller-testdir378980853/syzkaller.vqonxz/907/file0" dev="sda1" ino=16563 res=1 13:35:15 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:15 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0xe000040000000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 889.595647] binder_alloc: binder_alloc_mmap_handler: 2045 20001000-20004000 already mapped failed -16 [ 889.627008] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 889.641267] binder: BINDER_SET_CONTEXT_MGR already set 13:35:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be38", 0x1e) [ 889.663729] binder: 2045:2046 ioctl 40046207 0 returned -16 [ 889.669711] audit: type=1800 audit(1539092114.990:407): pid=2049 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor1" name="file0" dev="sda1" ino=16563 res=0 [ 889.683453] FAT-fs (loop3): Filesystem has been set read-only [ 889.691319] binder: undelivered transaction 524, process died. [ 889.703608] binder: undelivered TRANSACTION_COMPLETE [ 889.705462] binder: 2045:2056 transaction failed 29189/-22, size 0-0 line 2855 13:35:15 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x6348}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:15 executing program 0 (fault-call:1 fault-nth:0): r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 889.735842] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 889.745465] binder: undelivered TRANSACTION_ERROR: 29189 [ 889.754215] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) 13:35:15 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 889.785785] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 889.824901] binder: 2063:2065 unknown command 25416 13:35:15 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x2000000000000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 889.832721] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 889.840606] binder: 2063:2065 ioctl c0306201 20000140 returned -22 [ 889.866923] binder_alloc: binder_alloc_mmap_handler: 2063 20001000-20004000 already mapped failed -16 13:35:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 889.881546] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 889.908195] binder_alloc: 2063: binder_alloc_buf, no vma [ 889.931053] binder: BINDER_SET_CONTEXT_MGR already set 13:35:15 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x1000000, 0x1000000020000) [ 889.966059] binder: 2063:2075 unknown command 25416 [ 889.969985] binder: undelivered TRANSACTION_COMPLETE [ 889.985286] binder: undelivered transaction 527, process died. [ 889.992233] binder: 2063:2075 ioctl c0306201 20000140 returned -22 [ 890.007197] binder: 2063:2065 ioctl 40046207 0 returned -16 [ 890.016139] binder: 2063:2069 transaction failed 29189/-3, size 0-0 line 2970 [ 890.026744] binder: undelivered TRANSACTION_ERROR: 29189 [ 890.041177] audit: type=1804 audit(1539092115.500:408): pid=2049 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor1" name="/root/syzkaller-testdir378980853/syzkaller.vqonxz/907/file0" dev="sda1" ino=16563 res=1 13:35:15 executing program 1: pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RLERRORu(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="106fe640939a936b36ed3a0000737cfd4e476128be48401d032e2b64c3875887dc7cb2dbcd4970a28095a7652715b5a5926d8b3412829d2acf8b1d3c4f84f17bf71a258106b46bc55b50676e0d66422b2940bc52bed4b0c8eb0fff490f27a78c0a15d1ff05a001000000000000000000000000007a4f6ef8a9451a35d77f6e375c58530c8b2bb4172ec81e9fc529cdc45d011752630c02ca26ce67becad7c6e68c819354f80a4f6a753fb975c099773743c6a5fc5f035fecaadf330d09a338cd31ec9ef04a30a8719e121cf7d8dfec7314d05b25fc31a9d575d9c82bb7329c9d8ac9d301da76223f906d094bb5698b56dd4f4b04a6883006bbdad566ed44daff7ea734b3a7715e9833f851435f3c88ec237b42b6f15a362abff2841063e1"], 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$setpipe(r1, 0x407, 0x0) vmsplice(r1, &(0x7f0000000100)=[{&(0x7f0000001600)="30452b3b7d9fd0ef3efcfc586530f09d6f488648f53357349e94239fa560f3aaebc5a0083640d4b6ef0fccfb413728b1938578658151f389cde1602c345e5840b5ea6896917182edab41f084eb0bdc426ca79365b5840ce21651076d287014fb1326470983c07b498dd72193393e22488590f55405bef65131793a7eea199f13419f6001dfdb6d19cc879a479ae33ef1f44ebd9325b23161f54192ab51c33724ee0f6dbfc054aa3e4de5193e4afc58e8eb66200f0fdfce2b9b6c2ccd1cea512c9dd8e3c26770268a3f7e81a3b54d91d209260b9196431da499527489ad83cdd2baab232a9fb80940d8cd97294b8ed5ad231ec8dccd08f7af624d326e346fe79461e92423d71a53b8ca7b680a177740019248ed5f531f05b8d023177492aa3459e2a7499a66488be968d133dba9fe203ae5514dfd984bf4743bcf2dd4d833c0461bdc4c109fce82e506978384892c969278ebb1c779752ba504c252aa3d3d81ff6326d01b55c8c247f9be724b497bacc07748c637a47e38fb3dc43ebb756c5bc3947377f491976c35bee12623cbc842fe147dcb3e6f800a563e136a06c36b63e7c4bc842e3960240a412d2398112bd35824a1c07346ea0e237d2b60687d5d6e620ed7c84cba093c630848fe70d210dee38067c38e6cdb8f13fe61365509950659a944b451845b995af2301ecb058c0d66de267da5cfcdf7f4ef31b7543c2010a5af1bb0e7e23f5575ca1d2c38dbdae6cbf414ff19e1f9563aa853100d75d99c1a1bbece8d41fa6b8d366705d546b6f1a686c204a48d54cf24ccf5783437bb71acac83bc7661aefbe006b245253a1adb6d83ad3953b5223848ead7c044b59906c6d7a4272f664a646aa1011ab8da2edbf048e96ec54fadfc60dc1c5e18ab3d2597851850fc787834280b0ac080f29e1eee490cd8f845852139161f0d5a822309f7e87d145caff26db6982f9856119faed08f572139b345423a5c489a4b092626e67f6cab4334c2349bfb9fbf9aa6a0a6f3f2042bcd0ab15b6ddc42c6e98972241f82e069a369daf55b9b99a8d0384787fba866d7d903b5bc8e9c84dc6f8e3db1fb754be53dfa7a0b44d9096f02509408fc0bcf2bc0c7b06af0e2f7ea49232c0784a4d8d76689088496b929f6c55b06aca640274f65d05f9e05e0aaf1b3591489ab52a9eda35c9694a8f1641fc3c30c6895cb75608a7e585e5d2e39207a9422af3d57a7d0116e09db02c352e2d7bbf69b980fc4047a4e6c02358db975ad620f87be979184d50edb96653210f70717cc770ae8d315e9486dec70f839de99b3b2e539cb951d78c6c86b27d19aa3978618b581e39a448dd1db987278ead9d694929f11f65f737601758d3cf9ce93e3c6b5e79e2f45a34fc16dbe72603a5a350602643a676af9bd6476e71a4f026592b1cb70399d4e1ed9237430336f059f6c3c9b2f4bb72c95103a27bffebbc01ded9a6295d69d35bf2c28089d89703a71ed5fbff717d3d31be5ca03137338e167bd5a010f87eb67664342181b83f7ef7e005b626055eaf478d4c069b99035fe75f63f667a67d2cf4fbc70548b84d9a9b85be4d3b217b17b5c42cad3ce297a5a71fc547beda35257c1b10bc4448355d46057b15810b657de514575baf9389d938ebc6354b50e809b35112adeff635aaa442ec28978238ea5497797444df3223d5f19b48f2068e605e8d39aff1055ff91de58318dde8d260ac9abd83646397393a2b4046f83e7fa6524c223fed6695857e73f21ec4c6cb780421cc8f696ca7c21bb4cd324f1ad473f623f4385b0fd395d5ce7b6bac359b6b1aacecb912ac863075cb00bea6cbea2d96648567d621c46560b2614c14914424878f4ef5da499282fd4188d05b2ea1cffa126972571efb5ffcaf12f7e209267550acf1d3774b71ca0c0b647e25d09bcc1ce7b8a7df75615126e0433f162efb3b80d49367c99648d49ab08efedcfbde6dc3b24f235c4b12065a495285bff917b29bd4aba905afdac4c99bb5e5dff51dda74322a413bfd9e38e47e8d0ed0008b76d3f92a8be86f0c7796e073b2a1e4499ee2fc7cff6a17b2c43b8f43b63cd7710b61656dc7602d4a8e1689a4ecc25ee522b841817db6bd3f2e94005c38c2e1b787e3b329dba630979505efe0c98f73440cc698b89b5668e045bbb6fffb85dbc4265b72907afac8197dcf4e3ff6b3ca6f3fa3f7ca96303a3b33dddf043abfc621d164f68bde3b95ceada3ad2dbfb60785ae6983a61adcf05d48264da1af2401a5415bd059d7e3fc0f21b927bbca0b7bde0862e2e434e6be3bdbb0cfd52762d143551d108a34a7bb31632ff0866c9c7ff2573e53552d405099efe360bc7e704a39102c2062806a8fd928723fe9638e2ebf8e16c0063d51352ec2a4df51dbfb2e946567c048b5ea4f5d85885864e4b54d3d7072aafe633425f9a7fd553dbed42cfbff530fa9b9e1f1cd69e3f0c6f28061fced168211b20fa58a808391af35f837dcca370fad21014086781a5a459799aafb6ae9065119c1ebeb3bd7f218785bc85da894301cfd7a889cc63746fff202044c12b3852291804ab1276342670def863b1bda617b3ef9d773655f1e260c692f6c842d87366944c11b3d21a5bbf276717f89d036030f8784c268fcf37fe0c9f8859b754018a4d7c781e4e03483680f96e6f8b54f9c06d16cfea196c18e8be35d0ed9c9927860566c209225913caafde0a479e67d493f76d2d387216c4117ad121a33228592b99f55dfd5c78537db7ca4a4003b18938d78c2ff2ade194d77ac86fab14d1078183b4ba07465db978b03b088be451602c7f98cfa84688c540abab29abfb1a232f604f3f827a3368686fb982488c1c22b1761da6a442c49877f2b0612510c6150e91eaf797ae6976915a81521df6413923978de53822c5ba4ba6c955730a5113f77153d4cc8457afd2cc9731fbd88215c92becad8d7b1083f296cc4a8e35d5bdf21fc39060775ab56e8ee10b740375752eca9dc66212d026f4b65ca8e362288c1597867ca7e2ffceef5cc8e2ed11e05cb036ce1355123203b47326ed69ae08fd5dc311ca0cc809afc3e42152e63d04570b3f61519c43f4340e2a2838f0e0d9c98262fc42b09d4d31b6519425376138c5d86b5ae8798fd835f33475abd06f32f4d7a4bb49ebfeaa330b048ffec07c1d7551fc36cbed074fc38240b0607b711aa335328936cedf514fac454f3d2b6d014229d75de2c7a679c9a04a5bb264b58d7ff8c5c80ad1f137e2572adcf7b7a1145273b387c24f1c35b8c2e62d595947a6276d66f627650d76a1a88e75894ba404ecb1168e29730b90c6d8d9eb660264fa9d36c38395b6c69504e3761499eeff30a7ce06282b12061cb42f093d98ba046886124c895184e13358acb03b36312763f864bd2052df1c51feef10a18a0d25640974b5e2e1898938a2e1add6d7ab0fc5bcedfa3a471ffeab697656dae994bfb06beb58511523b79fb45c764120d5f34009c1fbae23d17fd44c3d56d9eedc8c62c21354e378377cd80fb5eda2e4372469f262ee73a562571692f141d57c9a5aa4a37ab8bf40ed461a1973604af7ffe345ad9ba260c2a9e4a362c97d66f37054c72ddb1f355b3f3ff9f6806b959bb6", 0xa01}], 0x1, 0x0) close(r1) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000200)) fsetxattr$security_ima(r2, &(0x7f0000000140)='security.ima\x00', &(0x7f0000000180)=@md5={0x1, "7733b6a2c48fb457e66617dbd06b49dd"}, 0x11, 0x3) read$FUSE(r0, &(0x7f00000005c0), 0x1000) 13:35:15 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="effdffff1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:15 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0xa0018000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:15 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x400c630f}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 890.066771] audit: type=1800 audit(1539092115.500:409): pid=2049 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor1" name="file0" dev="sda1" ino=16563 res=0 13:35:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="9f0000201e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:15 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x6000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="e03f03001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 890.188610] binder: 2084:2086 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 13:35:15 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:15 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setpriority(0xfffffffffffffffd, 0x0, 0x7) unshare(0x8000000) r1 = dup(r0) ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000000180)={0x8001, 0x3, 0x1, 0x4, 0x3, 0x190c}) r2 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000140)={0x0, 0x1, 0xb}) mq_timedreceive(r2, &(0x7f0000000000)=""/24, 0x18, 0x0, 0x0) fcntl$setsig(r0, 0xa, 0x2) syz_open_dev$dspn(&(0x7f0000000200)='/dev/dsp#\x00', 0x3, 0x200) r3 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x80, 0x0) faccessat(r3, &(0x7f0000000100)='./file0\x00', 0x4, 0x1000) mq_timedreceive(r2, &(0x7f0000000040)=""/50, 0x32, 0x0, &(0x7f00000000c0)={0x77359400}) mq_timedsend(r2, &(0x7f0000000100), 0x0, 0x0, 0x0) prctl$setfpexc(0xc, 0x20000) 13:35:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="0f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 890.972088] binder_alloc: binder_alloc_mmap_handler: 2084 20001000-20004000 already mapped failed -16 [ 890.995304] binder: BINDER_SET_CONTEXT_MGR already set [ 891.000902] binder_alloc: 2084: binder_alloc_buf, no vma [ 891.007362] binder: 2084:2106 ioctl 40046207 0 returned -16 [ 891.013583] binder: 2084:2107 transaction failed 29189/-3, size 0-0 line 2970 13:35:16 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xd000000, 0x1000000020000) 13:35:16 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="c00000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:16 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x300, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:16 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:16 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40486311}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 891.021807] binder: undelivered TRANSACTION_COMPLETE [ 891.028921] binder: undelivered TRANSACTION_ERROR: 29189 [ 891.042279] binder: undelivered transaction 530, process died. 13:35:16 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="100000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:16 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="effd00001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 891.118702] binder: 2115:2116 got transaction to context manager from process owning it [ 891.136896] binder: 2115:2116 transaction failed 29201/-22, size 0-0 line 2846 [ 891.162119] binder: 2115:2116 ioctl c0306201 20000140 returned -14 13:35:16 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:16 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x700, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 891.194948] binder_alloc: binder_alloc_mmap_handler: 2115 20001000-20004000 already mapped failed -16 13:35:16 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="c00e00001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 891.239150] binder: BINDER_SET_CONTEXT_MGR already set [ 891.259093] binder: 2115:2116 ioctl 40046207 0 returned -16 [ 891.276531] binder_alloc: 2115: binder_alloc_buf, no vma 13:35:16 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, &(0x7f0000000140)) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000380)={0x79, 0x0, [0x52, 0x100, 0x3]}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000282c"]) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 891.289050] binder: undelivered TRANSACTION_COMPLETE [ 891.295020] binder: 2115:2123 transaction failed 29189/-3, size 0-0 line 2970 [ 891.302689] binder: undelivered transaction 533, process died. [ 891.312761] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 891.333985] binder: undelivered TRANSACTION_ERROR: 29189 [ 891.335535] FAT-fs (loop3): Filesystem has been set read-only 13:35:16 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40046304}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 891.385426] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 891.403769] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 891.420010] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) 13:35:16 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xe000, 0x1000000020000) 13:35:16 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1fc00e001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:16 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x400e0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:16 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:16 executing program 1: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) write$FUSE_INTERRUPT(0xffffffffffffffff, &(0x7f0000000080)={0x10}, 0x10) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-vsock\x00', 0x2, 0x0) socket$key(0xf, 0x3, 0x2) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000000200)={{0xf000, 0x4000, 0xe, 0x5, 0x101, 0x4, 0x2, 0xab8, 0x1, 0x4, 0xfffffffffffffffc, 0xffffffffffffffc0}, {0x0, 0x4, 0x1f, 0xffffffffffffffa7, 0x7, 0x0, 0x3, 0x7, 0x8, 0x8, 0x6b36, 0x80}, {0x1, 0x10000, 0x3, 0x3, 0xfff, 0x80000001, 0x8, 0x1, 0x7fff, 0x7fffffff, 0x3ff, 0x9}, {0x1000, 0x0, 0xc, 0x7ff, 0x40, 0x3, 0x40, 0x4a87, 0x6, 0x0, 0xfffffffffffffffe, 0x20}, {0x10000, 0x6000, 0x3, 0x2, 0x1c200, 0x40, 0x7ff, 0x2, 0x7fffffff, 0x5, 0x8, 0xffffffffffffffff}, {0x2000, 0x6000, 0xd, 0x10000, 0x1, 0x400, 0x0, 0xf667, 0x1, 0x9, 0x838, 0x8000}, {0x6000, 0x0, 0x0, 0x7, 0x0, 0x7c5, 0x7, 0xd23, 0x9, 0x100000000, 0x4, 0xc5e9}, {0x0, 0x0, 0x1f, 0x81, 0x5, 0x0, 0x672a, 0x1, 0xffffffff, 0xfffffffffffffff9, 0xfffffffffffffff7}, {0xf001, 0x1001}, {0x0, 0x100000}, 0x4, 0x0, 0x4000, 0x40, 0x9, 0x4100, 0x2000, [0xffffffffffffffc1, 0x101, 0x7fff, 0x3]}) r1 = syz_open_procfs(0x0, &(0x7f0000000100)="2f65786500000000000409004bddd9de91be10ee9ed554fa07424adee9cbc699ec2ca576e50000bcd7a071fb35331ce39c5ad0cf73770bd4246847a1914e4fb0aa9b15eaa94bcd0e700ed63b44338e84ad4ec2f11f6f2adb8dc2fdb18231446f43142ebe700b2231e8fceed6b22a373c9409675ac8d0b53033123fb3037d66241aafe0f880e7a51d1b036ade315a544d2581fe8653d0cff54369df8c2fce21dcb1cb965669f9a75345ac3479cd51dc7de364c9c272c83ed9e666ca25aad2e7a26e3d6c62d0f8b9065cfca311c06d0744db265aa0e486707c51fd108c0c6ccae6ff42274af94d30fce8836ff9d00bdd") socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0xc020660b, 0x730204) [ 891.454186] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 891.473521] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:17 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0a00001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:17 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0f00001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:17 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000c001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:17 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:17 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x201, 0x0) read(r1, &(0x7f0000000340)=""/197, 0xff18) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r0, r1, 0x0) dup2(r4, r2) 13:35:17 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x200000000000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 892.236977] binder_alloc: binder_alloc_mmap_handler: 2138 20001000-20004000 already mapped failed -16 [ 892.246837] binder: BINDER_SET_CONTEXT_MGR already set [ 892.252242] binder_alloc: 2138: binder_alloc_buf, no vma [ 892.257895] binder: 2138:2168 transaction failed 29189/-3, size 0-0 line 2970 [ 892.265416] binder: 2138:2167 ioctl 40046207 0 returned -16 [ 892.271760] binder: undelivered TRANSACTION_COMPLETE [ 892.279815] binder: undelivered TRANSACTION_ERROR: 29189 13:35:17 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x4008630a}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 892.289959] binder: undelivered transaction 537, process died. [ 892.333277] binder: BC_ATTEMPT_ACQUIRE not supported [ 892.339080] binder: 2169:2170 ioctl c0306201 20000140 returned -22 [ 892.349663] binder_alloc: binder_alloc_mmap_handler: 2169 20001000-20004000 already mapped failed -16 [ 892.360384] binder: BINDER_SET_CONTEXT_MGR already set [ 892.366372] binder: 2169:2170 ioctl 40046207 0 returned -16 [ 892.372813] binder_alloc: 2169: binder_alloc_buf, no vma [ 892.379447] binder: 2169:2171 transaction failed 29189/-3, size 0-0 line 2970 [ 892.387878] binder: BC_ATTEMPT_ACQUIRE not supported [ 892.393803] binder: undelivered TRANSACTION_COMPLETE [ 892.400232] binder: undelivered transaction 541, process died. [ 892.407578] binder: 2169:2170 ioctl c0306201 20000140 returned -22 [ 892.414456] binder: undelivered TRANSACTION_ERROR: 29189 13:35:17 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x38, 0x1000000020000) 13:35:17 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0600001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:17 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:17 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000013000/0x4000)=nil, 0x4000, 0x84, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000100)=""/16, 0x10}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0x11, &(0x7f00000000c0)=@assoc_value, 0x8) close(r2) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(r1) ioctl$RTC_WKALM_RD(r2, 0x80287010, &(0x7f0000000040)) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x10040, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) 13:35:17 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x500000000000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:17 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40406300}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:18 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1ff000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 892.554126] binder: 2175:2176 got transaction to context manager from process owning it [ 892.576900] binder: 2175:2176 transaction failed 29201/-22, size 0-0 line 2846 [ 892.588382] binder: 2175:2176 ioctl c0306201 20000140 returned -14 13:35:18 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 892.607492] binder_alloc: binder_alloc_mmap_handler: 2175 20001000-20004000 already mapped failed -16 13:35:18 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0081001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:18 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0xa0010000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 892.653078] binder: BINDER_SET_CONTEXT_MGR already set 13:35:18 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000e80)={&(0x7f0000000040), 0xc, &(0x7f0000000e40)={&(0x7f0000000080)={0x28, r1, 0x30f, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}]}]}, 0x28}}, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)=ANY=[]}, 0x1, 0x0, 0x0, 0x80}, 0x4) readv(r0, &(0x7f00000003c0)=[{&(0x7f00000000c0)=""/191, 0xbf}, {&(0x7f0000000180)=""/104, 0x68}, {&(0x7f0000000200)=""/100, 0x64}, {&(0x7f0000000ec0)=""/4096, 0x1000}, {&(0x7f0000000280)=""/242, 0xf2}, {&(0x7f0000000380)=""/27, 0x1b}], 0x6) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000600)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000001}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x44, r2, 0xa, 0x70bd2a, 0x25dfdbfd, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2f}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0x44}}, 0x8811) [ 892.684236] binder: 2175:2176 ioctl 40046207 0 returned -16 [ 892.684269] binder_alloc: 2175: binder_alloc_buf, no vma 13:35:18 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0200001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 892.741252] binder: undelivered TRANSACTION_COMPLETE [ 892.747172] binder: undelivered transaction 544, process died. [ 892.749032] binder: 2175:2192 transaction failed 29189/-3, size 0-0 line 2970 [ 892.775248] binder_alloc: 2175: binder_alloc_buf, no vma [ 892.783196] binder: 2175:2176 transaction failed 29189/-3, size 0-0 line 2970 [ 892.807114] netlink: 'syz-executor1': attribute type 1 has an invalid length. [ 892.816203] binder: undelivered TRANSACTION_ERROR: 29189 [ 892.835607] binder: 2175:2176 ioctl c0306201 20000140 returned -14 [ 892.855262] netlink: 'syz-executor1': attribute type 1 has an invalid length. 13:35:19 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x9000000000000000, 0x1000000020000) 13:35:19 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0xa0010000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:19 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:19 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x5000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:19 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0c00001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:19 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40086310}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:19 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000f001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 893.578190] binder: 2216:2218 BC_DEAD_BINDER_DONE 0000000000000000 not found 13:35:19 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000000670007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:19 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:19 executing program 1: r0 = socket$inet6(0xa, 0x10000000005, 0x9000000001fffbfc) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rfkill\x00', 0x210001, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000380)={0x0, 0xffffffff}, &(0x7f00000003c0)=0x8) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000400)={r2, @in6={{0xa, 0x4e21, 0x7, @mcast2, 0x7}}}, &(0x7f00000004c0)=0x84) r4 = dup(r0) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000000)={@in={{0x2, 0x4e22, @remote}}, 0x40, 0x3, 0x9, "d732a79fd2366eba15a3816d01e750fb39d3db2be26b8b8e1d31b649b282db10455c9557c43a880c28a64b50c0b8fa03351196b14beed1b705008d32e8d958a57f1d2e4a5fee2f7c9abba9e4c99140bc"}, 0xd8) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") syz_mount_image$msdos(&(0x7f0000000100)='msdos\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="646d61736b3d30303030303003000000000000003030303030303030302c00a06b209a6aec83f1be329aaf8f9a1163440635d3cd91dcc755a065b265ad5186a3fd347fb1037a4eaa5195a2b3bf31c5beedcb7d9ecd44eb14256c963a0e99b7a3ae6381a98bc48f2e2918f97ba411c22298a79cc58d428e133ebbdd868c77c647d40a8b821db1696c2e1560794d6e87416bfd9c417bd50f1d323d6f649648f69f000000008290e72108292a6435faeb3775780c6015d0456b55264d81df66bdcbf20000"]) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000006c0)=ANY=[@ANYRESHEX=r1, @ANYRESOCT=r1, @ANYRES32=r4, @ANYRESHEX=0x0, @ANYRES64=r0, @ANYRESDEC=r4, @ANYRESDEC=r2, @ANYRES16, @ANYRESDEC=r4]) setsockopt$bt_BT_POWER(r4, 0x112, 0x9, &(0x7f00000001c0)=0x5, 0x1) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000780)={r3, @in={{0x2, 0x4e21, @rand_addr}}}, 0x84) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x40082406, &(0x7f0000000180)='dmask') ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000002c0)=0x0) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f0000000340)={0x1, 0x6, r5, 0x101, r6, 0x2ea, 0x0, 0x2}) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$SG_SET_COMMAND_Q(r7, 0x2271, &(0x7f0000000240)) 13:35:19 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x3f00, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:19 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0500001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 893.736738] FAT-fs (loop1): Unrecognized mount option "dmask=000000" or missing value [ 893.851812] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 893.869705] FAT-fs (loop3): Filesystem has been set read-only [ 893.880625] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 893.890703] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) 13:35:19 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3e000000, 0x1000000020000) 13:35:19 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0b00001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:19 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:19 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.stat\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000100)={0xdc, r1, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0xd}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x4}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x80000001}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xb6}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x8}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffffffffeff}]}, 0xdc}}, 0x480d1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f0000000040), 0xfd86) 13:35:19 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x500, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 893.898573] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 893.914560] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 893.922995] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 894.191649] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 894.199052] FAT-fs (loop3): Filesystem has been set read-only [ 894.205442] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 894.213480] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 894.221078] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 894.239370] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 894.246971] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 894.376259] binder_alloc: binder_alloc_mmap_handler: 2216 20001000-20004000 already mapped failed -16 [ 894.386478] binder_alloc: 2216: binder_alloc_buf, no vma [ 894.386588] binder: BINDER_SET_CONTEXT_MGR already set [ 894.391981] binder: 2216:2262 transaction failed 29189/-3, size 0-0 line 2970 [ 894.405697] binder: undelivered TRANSACTION_COMPLETE [ 894.410902] binder: undelivered TRANSACTION_ERROR: 29189 [ 894.416872] binder: 2216:2261 ioctl 40046207 0 returned -16 13:35:19 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x9, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:19 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000013c0)={{{@in=@local, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000014c0)=0xe8) r1 = creat(&(0x7f00000002c0)='.\x00', 0x0) fchmodat(r1, &(0x7f0000000400)='./file0\x00', 0x75) r2 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000000c0), &(0x7f0000000340), 0x0, 0xfffffffffffffffd) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000100)=@req={0x1, 0x4, 0x100}, 0x10) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x5) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000040)) modify_ldt$read_default(0x2, &(0x7f0000000600)=""/188, 0xbc) add_key(&(0x7f0000000840)='.dead\x00', &(0x7f0000000880), &(0x7f0000000980)="230a9f39cc653f325ca55f5787f4dfa82952ff9605f0c4094900dde4e7", 0x1d, r2) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000001c0)=@assoc_value={0x0}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={r3, 0x68, &(0x7f0000000300)=[@in={0x2, 0x4e20, @multicast1}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e21, 0x0, @empty, 0x6}, @in={0x2, 0x4e23, @multicast2}, @in6={0xa, 0x4e22, 0x0, @empty, 0x81}]}, &(0x7f0000000380)=0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000003c0), 0xffffffffffffffff) mknod(&(0x7f0000000a00)='./file0\x00', 0x461, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000006c0)=[&(0x7f0000000540)='\x00'], &(0x7f00000002c0)=[&(0x7f0000000240)=']\x00']) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000140)={0x0, 'ip6_vti0\x00', 0x4}, 0x18) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, &(0x7f0000000000)) unshare(0x400) 13:35:19 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00f0001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:19 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0xffffffffa0018000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:19 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:19 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xf4ffffff, 0x1000000020000) [ 894.425558] binder: undelivered transaction 549, process died. 13:35:19 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000013c0)={{{@in=@local, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000014c0)=0xe8) r1 = creat(&(0x7f00000002c0)='.\x00', 0x0) fchmodat(r1, &(0x7f0000000400)='./file0\x00', 0x75) r2 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000000c0), &(0x7f0000000340), 0x0, 0xfffffffffffffffd) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000100)=@req={0x1, 0x4, 0x100}, 0x10) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x5) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000040)) modify_ldt$read_default(0x2, &(0x7f0000000600)=""/188, 0xbc) add_key(&(0x7f0000000840)='.dead\x00', &(0x7f0000000880), &(0x7f0000000980)="230a9f39cc653f325ca55f5787f4dfa82952ff9605f0c4094900dde4e7", 0x1d, r2) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000001c0)=@assoc_value={0x0}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={r3, 0x68, &(0x7f0000000300)=[@in={0x2, 0x4e20, @multicast1}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e21, 0x0, @empty, 0x6}, @in={0x2, 0x4e23, @multicast2}, @in6={0xa, 0x4e22, 0x0, @empty, 0x81}]}, &(0x7f0000000380)=0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000003c0), 0xffffffffffffffff) mknod(&(0x7f0000000a00)='./file0\x00', 0x461, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000006c0)=[&(0x7f0000000540)='\x00'], &(0x7f00000002c0)=[&(0x7f0000000240)=']\x00']) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000140)={0x0, 'ip6_vti0\x00', 0x4}, 0x18) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, &(0x7f0000000000)) unshare(0x400) 13:35:20 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:20 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x40030000000000, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f1914001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 894.565077] binder: undelivered transaction 552, put_user failed [ 894.593792] binder: 2275:2276 ioctl c0306201 20000140 returned -14 [ 894.640091] binder_alloc: binder_alloc_mmap_handler: 2275 20001000-20004000 already mapped failed -16 13:35:20 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000000f0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 894.760149] binder: BINDER_SET_CONTEXT_MGR already set [ 894.770969] binder_alloc: 2275: binder_alloc_buf, no vma [ 894.791518] binder: 2275:2276 ioctl 40046207 0 returned -16 13:35:20 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x5, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:20 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0900001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 894.814248] binder: undelivered TRANSACTION_COMPLETE [ 894.820537] binder: 2275:2287 transaction failed 29189/-3, size 0-0 line 2970 [ 894.837015] binder: undelivered TRANSACTION_ERROR: 29189 13:35:20 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:20 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r3, 0x6, 0x4000000000014, &(0x7f00000000c0)=0x80400000001, 0x240) connect$inet(r3, &(0x7f0000000200)={0x2, 0x0, @remote}, 0x10) sendto$inet(r3, &(0x7f0000000100), 0xffffffffffffff1f, 0x0, 0x0, 0x56c3) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x13, &(0x7f00000001c0)={0x2000}, 0x3f3) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x30}) close(r3) dup3(r1, r2, 0x0) setxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x3) [ 894.944801] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 894.968742] FAT-fs (loop3): Filesystem has been set read-only [ 894.979698] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 894.988080] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 894.989047] binder: undelivered transaction 555, put_user failed [ 894.995527] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 895.019277] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 895.027202] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 895.034493] binder: 2300:2301 ioctl c0306201 20000140 returned -14 13:35:20 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3f00, 0x1000000020000) 13:35:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0005001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:20 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000b001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 895.061815] binder_alloc: binder_alloc_mmap_handler: 2300 20001000-20004000 already mapped failed -16 [ 895.075837] binder: BINDER_SET_CONTEXT_MGR already set [ 895.083132] binder: 2300:2301 ioctl 40046207 0 returned -16 [ 895.093512] binder_alloc: 2300: binder_alloc_buf, no vma [ 895.099894] binder: undelivered TRANSACTION_COMPLETE [ 895.106612] binder: undelivered TRANSACTION_ERROR: 29189 13:35:20 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:20 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x25, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0009001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:20 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:20 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 895.237683] binder: undelivered transaction 558, put_user failed [ 895.250524] binder: 2321:2322 ioctl c0306201 20000140 returned -14 [ 895.261411] binder_alloc: binder_alloc_mmap_handler: 2321 20001000-20004000 already mapped failed -16 [ 895.271892] binder: BINDER_SET_CONTEXT_MGR already set [ 895.277839] binder: 2321:2322 ioctl 40046207 0 returned -16 13:35:20 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:20 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3d1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:20 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 895.283824] binder_alloc: 2321: binder_alloc_buf, no vma [ 895.290950] binder: undelivered TRANSACTION_COMPLETE [ 895.298584] binder: undelivered TRANSACTION_ERROR: 29189 [ 895.381142] binder: undelivered transaction 561, put_user failed [ 895.388081] binder: 2334:2337 ioctl c0306201 20000140 returned -14 [ 895.399635] binder_alloc: binder_alloc_mmap_handler: 2334 20001000-20004000 already mapped failed -16 [ 895.410230] binder: BINDER_SET_CONTEXT_MGR already set [ 895.416369] binder: 2334:2337 ioctl 40046207 0 returned -16 [ 895.423049] binder: undelivered TRANSACTION_COMPLETE [ 895.429880] binder: undelivered TRANSACTION_ERROR: 29189 [ 895.466247] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 895.476847] FAT-fs (loop3): Filesystem has been set read-only [ 895.495483] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 895.507013] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) 13:35:21 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x50, 0x1000000020000) 13:35:21 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0007001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:21 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000600)='status\x00') ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000001080)) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$KVM_S390_VCPU_FAULT(r1, 0x4008ae52, &(0x7f0000000040)=0x7dbd) 13:35:21 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:21 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:21 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 895.514400] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 895.530597] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 895.539074] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:21 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000a001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 895.602482] binder: undelivered transaction 564, put_user failed [ 895.611211] binder: 2340:2342 ioctl c0306201 20000140 returned -14 [ 895.629705] binder_alloc: binder_alloc_mmap_handler: 2340 20001000-20004000 already mapped failed -16 13:35:21 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 895.655427] binder: BINDER_SET_CONTEXT_MGR already set [ 895.661321] binder: undelivered TRANSACTION_COMPLETE [ 895.674553] binder: 2340:2342 ioctl 40046207 0 returned -16 13:35:21 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:21 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000d001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:21 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3aa, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:21 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0003001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 895.840792] binder: undelivered transaction 567, put_user failed [ 895.863912] binder: 2365:2366 ioctl c0306201 20000140 returned -14 [ 895.910220] binder_alloc: binder_alloc_mmap_handler: 2365 20001000-20004000 already mapped failed -16 [ 895.929712] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 895.951679] FAT-fs (loop3): Filesystem has been set read-only [ 895.961436] binder: BINDER_SET_CONTEXT_MGR already set [ 895.980168] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 895.994157] binder: 2365:2366 ioctl 40046207 0 returned -16 [ 896.011444] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 896.011452] binder_alloc: 2365: binder_alloc_buf, no vma [ 896.041843] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 896.056798] binder: undelivered TRANSACTION_COMPLETE [ 896.064422] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 896.071895] binder_transaction: 4 callbacks suppressed [ 896.071913] binder: 2365:2370 transaction failed 29189/-3, size 0-0 line 2970 [ 896.085658] binder_release_work: 1 callbacks suppressed [ 896.085665] binder: undelivered TRANSACTION_ERROR: 29189 [ 896.148321] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 896.165468] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 896.186102] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 896.197671] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) 13:35:24 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xc00, 0x1000000020000) 13:35:24 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:24 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:24 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0006001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:24 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x751648d9, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:24 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000600)='status\x00') ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000001080)) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$KVM_S390_VCPU_FAULT(r1, 0x4008ae52, &(0x7f0000000040)=0x7dbd) [ 898.763256] FAT-fs (loop3): error, fat_get_cluster: detected the cluster chain loop (i_pos 16) 13:35:24 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0e00001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 898.832229] binder: undelivered transaction 570, put_user failed [ 898.870734] binder: 2380:2381 ioctl c0306201 20000140 returned -14 13:35:24 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:24 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 898.918538] binder_alloc: binder_alloc_mmap_handler: 2380 20001000-20004000 already mapped failed -16 13:35:24 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0800001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 898.966961] binder: BINDER_SET_CONTEXT_MGR already set [ 898.996552] binder: 2380:2381 ioctl 40046207 0 returned -16 [ 899.029580] binder_alloc: 2380: binder_alloc_buf, no vma 13:35:24 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:24 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f1419001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 899.058959] binder: 2380:2397 transaction failed 29189/-3, size 0-0 line 2970 [ 899.075395] binder: undelivered TRANSACTION_COMPLETE [ 899.158133] binder: undelivered TRANSACTION_ERROR: 29189 13:35:25 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x35000000, 0x1000000020000) 13:35:25 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0b0300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:25 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0ec0001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:25 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x63, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:25 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:25 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:25 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0700001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 899.851330] binder: undelivered transaction 573, put_user failed [ 899.867450] binder: 2410:2411 ioctl c0306201 20000140 returned -14 [ 899.886412] binder_alloc: binder_alloc_mmap_handler: 2410 20001000-20004000 already mapped failed -16 13:35:25 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0d00001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 899.910189] binder: BINDER_SET_CONTEXT_MGR already set 13:35:25 executing program 1: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x50, 0x1000000020000) 13:35:25 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 899.931643] binder: 2410:2411 ioctl 40046207 0 returned -16 [ 899.934481] binder_alloc: 2410: binder_alloc_buf, no vma [ 899.961611] binder: undelivered TRANSACTION_COMPLETE [ 899.967540] binder: 2410:2418 transaction failed 29189/-3, size 0-0 line 2970 13:35:25 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="170300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:25 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x2, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 899.994910] binder: undelivered TRANSACTION_ERROR: 29189 [ 900.096745] binder: undelivered transaction 576, put_user failed [ 900.117523] binder: 2434:2435 ioctl c0306201 20000140 returned -14 [ 900.143402] binder_alloc: binder_alloc_mmap_handler: 2434 20001000-20004000 already mapped failed -16 [ 900.164437] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 900.176283] binder: BINDER_SET_CONTEXT_MGR already set [ 900.180106] FAT-fs (loop1): error, invalid access to FAT (entry 0x000006c6) [ 900.189459] FAT-fs (loop1): Filesystem has been set read-only [ 900.195770] FAT-fs (loop1): error, invalid access to FAT (entry 0x000006c6) [ 900.196029] FAT-fs (loop3): Filesystem has been set read-only [ 900.203565] FAT-fs (loop1): error, invalid access to FAT (entry 0x000006c6) [ 900.209192] binder: 2434:2435 ioctl 40046207 0 returned -16 [ 900.217888] FAT-fs (loop1): error, invalid access to FAT (entry 0x000006c6) [ 900.229237] binder_alloc: 2434: binder_alloc_buf, no vma [ 900.234827] binder: 2434:2437 transaction failed 29189/-3, size 0-0 line 2970 [ 900.236628] binder: undelivered TRANSACTION_COMPLETE [ 900.242989] FAT-fs (loop1): error, invalid access to FAT (entry 0x000006c6) [ 900.248512] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 900.254698] FAT-fs (loop1): error, invalid access to FAT (entry 0x000006c6) [ 900.269340] binder: undelivered TRANSACTION_ERROR: 29189 [ 900.284888] FAT-fs (loop1): error, invalid access to FAT (entry 0x000006c6) [ 900.292342] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 900.298073] FAT-fs (loop1): error, invalid access to FAT (entry 0x000006c6) [ 900.315641] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) 13:35:25 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3800, 0x1000000020000) 13:35:25 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0400001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:25 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:25 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="080300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:25 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x7, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:25 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) r3 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xffff, 0x0) accept$inet(r3, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) [ 900.349598] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 900.370227] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:25 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0300001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:25 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000e001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 900.445652] binder: undelivered transaction 579, put_user failed [ 900.451898] binder: 2445:2446 ioctl c0306201 20000140 returned -14 13:35:26 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000e001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:26 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0a0300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:26 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 900.498230] binder_alloc: binder_alloc_mmap_handler: 2445 20001000-20004000 already mapped failed -16 [ 900.515524] binder_alloc: 2445: binder_alloc_buf, no vma [ 900.523416] binder: 2445:2449 transaction failed 29189/-3, size 0-0 line 2970 [ 900.530933] binder: BINDER_SET_CONTEXT_MGR already set 13:35:26 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0005001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 900.576013] binder: 2445:2446 ioctl 40046207 0 returned -16 [ 900.576212] binder: undelivered TRANSACTION_COMPLETE [ 900.610155] binder: undelivered TRANSACTION_ERROR: 29189 [ 900.674249] device nr0 entered promiscuous mode [ 900.796260] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 900.803411] FAT-fs (loop3): Filesystem has been set read-only [ 900.825366] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 900.845699] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 900.853023] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 900.900027] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 900.915334] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 900.935397] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 900.942680] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:26 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x2, 0x1000000020000) 13:35:26 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0004001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:26 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:26 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="030300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:26 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 901.071841] binder: undelivered transaction 582, put_user failed [ 901.088472] binder: 2476:2479 ioctl c0306201 20000140 returned -14 [ 901.106248] binder_alloc: binder_alloc_mmap_handler: 2476 20001000-20004000 already mapped failed -16 [ 901.127533] binder_alloc: 2476: binder_alloc_buf, no vma 13:35:26 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) r3 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xffff, 0x0) accept$inet(r3, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:26 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0019141e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:26 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c0300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:26 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 901.154486] binder: BINDER_SET_CONTEXT_MGR already set [ 901.165294] binder: 2476:2479 transaction failed 29189/-3, size 0-0 line 2970 [ 901.173235] binder: 2476:2478 ioctl 40046207 0 returned -16 [ 901.174398] binder: undelivered TRANSACTION_COMPLETE [ 901.185382] binder: undelivered TRANSACTION_ERROR: 29189 13:35:26 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3bc, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:26 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000061e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:26 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="100300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 901.283055] binder: undelivered transaction 585, put_user failed [ 901.293019] binder: 2492:2493 ioctl c0306201 20000140 returned -14 [ 901.333779] binder_alloc: binder_alloc_mmap_handler: 2492 20001000-20004000 already mapped failed -16 [ 901.352243] device nr0 entered promiscuous mode [ 901.379586] binder: BINDER_SET_CONTEXT_MGR already set [ 901.396109] binder: 2492:2493 ioctl 40046207 0 returned -16 [ 901.406986] binder_alloc: 2492: binder_alloc_buf, no vma [ 901.431213] binder: undelivered TRANSACTION_COMPLETE [ 901.437540] binder: 2492:2498 transaction failed 29189/-3, size 0-0 line 2970 [ 901.455834] binder: undelivered TRANSACTION_ERROR: 29189 13:35:27 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x170, 0x1000000020000) 13:35:27 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000071e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:27 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:27 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="021000030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:27 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:27 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) r3 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xffff, 0x0) accept$inet(r3, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:27 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0002001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:27 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000b001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:27 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 902.011529] binder: undelivered transaction 588, put_user failed [ 902.035852] binder: 2505:2511 ioctl c0306201 20000140 returned -14 13:35:27 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020900030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:27 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000f01e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 902.093130] binder_alloc: binder_alloc_mmap_handler: 2505 20001000-20004000 already mapped failed -16 [ 902.136784] binder: BINDER_SET_CONTEXT_MGR already set [ 902.142170] binder: 2505:2516 ioctl 40046207 0 returned -16 [ 902.150221] device nr0 entered promiscuous mode [ 902.182918] binder_alloc: 2505: binder_alloc_buf, no vma [ 902.199273] binder: 2505:2511 transaction failed 29189/-3, size 0-0 line 2970 13:35:27 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 902.227503] binder: undelivered TRANSACTION_COMPLETE [ 902.234018] binder: undelivered TRANSACTION_ERROR: 29189 [ 902.306847] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 902.314085] FAT-fs (loop3): Filesystem has been set read-only [ 902.320821] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 902.329333] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 902.337650] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 902.358971] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 902.395405] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:27 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x60000, 0x1000000020000) 13:35:27 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0003001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:27 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020200030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:27 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x751648df, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:27 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 902.553384] binder: undelivered transaction 591, put_user failed [ 902.578439] binder: 2533:2541 ioctl c0306201 20000140 returned -14 [ 902.639281] binder_alloc: binder_alloc_mmap_handler: 2533 20001000-20004000 already mapped failed -16 [ 902.666750] binder: BINDER_SET_CONTEXT_MGR already set [ 902.672421] binder: 2533:2538 ioctl 40046207 0 returned -16 [ 902.679971] binder_alloc: 2533: binder_alloc_buf, no vma 13:35:28 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) r3 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xffff, 0x0) accept$inet(r3, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:28 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000a1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:28 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020302030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:28 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 902.686179] binder: 2533:2541 transaction failed 29189/-3, size 0-0 line 2970 [ 902.694903] binder: undelivered TRANSACTION_COMPLETE [ 902.701482] binder: undelivered TRANSACTION_ERROR: 29189 13:35:28 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3a6, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:28 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00c00e1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:28 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020306030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 902.843090] binder: undelivered transaction 594, put_user failed [ 902.852077] binder: 2554:2555 ioctl c0306201 20000140 returned -14 [ 902.874182] binder_alloc: binder_alloc_mmap_handler: 2554 20001000-20004000 already mapped failed -16 [ 902.899135] binder: BINDER_SET_CONTEXT_MGR already set [ 902.912298] binder: 2554:2558 ioctl 40046207 0 returned -16 [ 902.935232] binder_alloc: 2554: binder_alloc_buf, no vma [ 902.940586] device nr0 entered promiscuous mode [ 902.940795] binder: 2554:2559 transaction failed 29189/-3, size 0-0 line 2970 [ 902.945317] binder: undelivered TRANSACTION_COMPLETE [ 902.985232] binder: undelivered TRANSACTION_ERROR: 29189 13:35:28 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x34000000, 0x1000000020000) 13:35:28 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:28 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000a001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:28 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x4, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:28 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300400c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:28 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) r3 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xffff, 0x0) accept$inet(r3, &(0x7f0000000080), &(0x7f00000000c0)=0x10) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:28 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0008001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 903.506484] binder: undelivered transaction 597, put_user failed [ 903.514573] binder: 2567:2568 ioctl c0306201 20000140 returned -14 [ 903.551185] binder_alloc: binder_alloc_mmap_handler: 2567 20001000-20004000 already mapped failed -16 13:35:29 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000c1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:29 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 903.591734] binder: BINDER_SET_CONTEXT_MGR already set [ 903.622730] binder: 2567:2568 ioctl 40046207 0 returned -16 [ 903.661166] binder_alloc: 2567: binder_alloc_buf, no vma 13:35:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000811e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 903.677393] binder: 2567:2587 transaction failed 29189/-3, size 0-0 line 2970 [ 903.695275] device nr0 entered promiscuous mode [ 903.706177] binder: undelivered TRANSACTION_ERROR: 29189 [ 903.711749] binder: undelivered TRANSACTION_COMPLETE 13:35:29 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 903.741085] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 903.764120] FAT-fs (loop3): Filesystem has been set read-only [ 903.800533] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 903.828235] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 903.846814] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 903.873788] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 903.911616] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:29 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xfffffff4, 0x1000000020000) 13:35:29 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020303030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:29 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x500, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000d1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:29 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 904.039592] binder: undelivered transaction 600, put_user failed [ 904.064828] binder: 2595:2602 ioctl c0306201 20000140 returned -14 [ 904.151011] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 904.168640] FAT-fs (loop3): Filesystem has been set read-only [ 904.176575] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 904.188476] binder_alloc: binder_alloc_mmap_handler: 2595 20001000-20004000 already mapped failed -16 [ 904.198726] binder_alloc: 2595: binder_alloc_buf, no vma [ 904.204397] binder: 2595:2602 transaction failed 29189/-3, size 0-0 line 2970 [ 904.211989] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 904.212376] binder: BINDER_SET_CONTEXT_MGR already set [ 904.224587] binder: 2595:2601 ioctl 40046207 0 returned -16 [ 904.230944] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 904.238956] binder: undelivered TRANSACTION_COMPLETE [ 904.247204] binder: undelivered TRANSACTION_ERROR: 29189 [ 904.268261] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) 13:35:29 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000031e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:29 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:29 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020307030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:29 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x2003) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) readahead(r1, 0x10000, 0xffffffffffff384d) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="06000000"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 904.296997] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:29 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x10000000000000, 0x1000000020000) 13:35:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000051e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:29 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020305030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 904.381463] binder_alloc: 2615: binder_alloc_buf, no vma [ 904.392892] binder: 2615:2616 transaction failed 29189/-3, size 0-0 line 2970 [ 904.409956] binder: 2615:2616 unknown command 6 [ 904.415043] binder: 2615:2616 ioctl c0306201 20000140 returned -22 13:35:29 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000d001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 904.469434] binder: BINDER_SET_CONTEXT_MGR already set [ 904.497403] binder_alloc: 2615: binder_alloc_buf, no vma [ 904.513415] device nr0 entered promiscuous mode [ 904.519879] binder: 2615:2620 ioctl 40046207 0 returned -16 [ 904.526589] binder: 2615:2621 transaction failed 29189/-3, size 0-0 line 2970 [ 904.526849] binder: 2615:2631 unknown command 6 13:35:30 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000b1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:30 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020304030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 904.565519] binder: 2615:2631 ioctl c0306201 20000140 returned -22 [ 904.581661] binder: undelivered TRANSACTION_ERROR: 29189 [ 904.596561] binder: undelivered TRANSACTION_ERROR: 29189 [ 904.707267] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 904.726784] FAT-fs (loop3): Filesystem has been set read-only [ 904.739827] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 904.757820] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 904.774106] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 904.808390] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 904.821510] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:30 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:30 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x400001, 0x0) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f00000000c0)) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000000)) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:30 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:30 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0007001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:30 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:30 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xc000000000000, 0x1000000020000) 13:35:30 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000f001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 905.037005] binder: 2639:2643 ioctl 80086601 20000000 returned -22 [ 905.058002] binder: undelivered transaction 606, put_user failed [ 905.064189] binder: 2639:2643 ioctl c0306201 20000140 returned -14 [ 905.113746] binder: 2639:2643 ioctl 80086601 20000000 returned -22 [ 905.121077] binder: BINDER_SET_CONTEXT_MGR already set 13:35:30 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:30 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300020c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:30 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0006001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 905.155244] binder: 2639:2654 ioctl 40046207 0 returned -16 [ 905.175500] binder_alloc: 2639: binder_alloc_buf, no vma [ 905.196775] binder: 2639:2643 transaction failed 29189/-3, size 0-0 line 2970 13:35:30 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000000f7ffffff5c69"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 905.214963] binder: undelivered TRANSACTION_COMPLETE [ 905.222461] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 905.222643] binder: undelivered TRANSACTION_ERROR: 29189 [ 905.234531] device nr0 entered promiscuous mode [ 905.240916] FAT-fs (loop3): Filesystem has been set read-only [ 905.251016] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) 13:35:30 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000e1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 905.276392] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 905.299410] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 905.349504] binder_send_failed_reply: 2 callbacks suppressed [ 905.349514] binder: send failed reply for transaction 609 to 2665:2667 [ 905.363705] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 905.369729] binder: 2665:2667 ioctl c0306201 20000140 returned -14 [ 905.380713] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:31 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:31 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300100c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:31 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:31 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x8000000, 0x1000000020000) 13:35:31 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0009001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:31 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f00000004c0)=""/4096, 0x1000}], 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="000000000000005c49000000000000000000000000000000003aab3ab3"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) getsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f00000000c0)=""/50, &(0x7f0000000180)=0x32) [ 905.631466] binder_alloc: binder_alloc_mmap_handler: 2665 20001000-20004000 already mapped failed -16 [ 905.641202] binder: BINDER_SET_CONTEXT_MGR already set [ 905.646661] binder: 2665:2666 ioctl 40046207 0 returned -16 [ 905.652825] binder: undelivered TRANSACTION_COMPLETE 13:35:31 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000c001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 905.750460] binder: 2678:2679 unknown command 0 [ 905.763115] binder: 2678:2679 ioctl c0306201 20000440 returned -22 13:35:31 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:31 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0203000310000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 905.818059] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 905.825434] FAT-fs (loop3): Filesystem has been set read-only [ 905.827932] binder_alloc: binder_alloc_mmap_handler: 2678 20001000-20004000 already mapped failed -16 [ 905.831655] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 905.886308] binder: BINDER_SET_CONTEXT_MGR already set [ 905.890684] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 905.904696] binder: 2678:2685 ioctl 40046207 0 returned -16 [ 905.907586] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c6) [ 905.921199] binder: 2678:2679 unknown command 0 [ 905.927473] device nr0 entered promiscuous mode 13:35:31 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00f0001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:31 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x200001, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000200)={&(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0], 0x4, 0x7, 0x6, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0c63000085cf1926baf4e5d3d69181b4abcf22ad2dde11e43caf53c467165829f6057b05b6bd5be7a7a283f5f0ee9a52f42b0282bad861cfa49a69da74e10e4a710bf988955ce9e12df3a5ce180b65d1a5a480dec13dd64a09c71e8426ac54b73a354d8d77af70adb5eee95b7ec654a5667ef72e8101d204f11989f9341ac1a4277cfb5b2e3f35a0e3a46b4e763e8c9d862fde39183685afcce15d55"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 905.931820] binder: 2678:2679 ioctl c0306201 20000440 returned -22 [ 905.943686] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 905.959186] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:31 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000f1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 906.126631] binder: undelivered transaction 613, put_user failed [ 906.137482] binder: 2698:2700 ioctl c0306201 20000140 returned -14 [ 906.281266] binder_alloc: binder_alloc_mmap_handler: 2698 20001000-20004000 already mapped failed -16 [ 906.291068] binder: BINDER_SET_CONTEXT_MGR already set [ 906.296681] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 906.296688] binder_alloc: 2698: binder_alloc_buf, no vma [ 906.308419] binder: 2698:2699 ioctl 40046207 0 returned -16 [ 906.314284] binder_transaction: 1 callbacks suppressed [ 906.314300] binder: 2698:2700 transaction failed 29189/-3, size 0-0 line 2970 13:35:31 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) 13:35:31 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000700000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:31 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xc000, 0x1000000020000) 13:35:31 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:31 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0014191e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:31 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001e30000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) [ 906.327607] binder: undelivered TRANSACTION_COMPLETE [ 906.333995] binder_release_work: 2 callbacks suppressed [ 906.334002] binder: undelivered TRANSACTION_ERROR: 29189 13:35:31 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000091e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:31 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c002000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 906.445052] binder_alloc: binder_alloc_mmap_handler: 2712 20001000-20004000 already mapped failed -16 [ 906.460471] binder: BINDER_SET_CONTEXT_MGR already set [ 906.470773] binder: 2712:2713 ioctl 40046207 0 returned -16 [ 906.481193] binder_alloc: 2712: binder_alloc_buf, no vma 13:35:32 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 906.510616] binder: undelivered TRANSACTION_COMPLETE [ 906.519260] binder: 2712:2715 transaction failed 29189/-3, size 0-0 line 2970 [ 906.526778] binder: undelivered transaction 616, process died. 13:35:32 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000ec01e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 906.556176] binder: undelivered TRANSACTION_ERROR: 29189 [ 906.556545] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 906.586802] FAT-fs (loop3): Filesystem has been set read-only 13:35:32 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x800) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x27, &(0x7f0000000000)='ppp0*usereth1wlan0\\trusted-systemeth0%\x00', 0x0}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)=r2, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0xffffffffffffffbf, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:32 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c020000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 906.604530] device nr0 entered promiscuous mode [ 906.604758] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 906.636029] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 906.665858] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 906.698176] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 906.712515] binder: 2730:2736 transaction failed 29189/-22, size 0-0 line 2855 [ 906.735449] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:35:32 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:32 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:32 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000b1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:32 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x100e, 0x1000000020000) 13:35:32 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000fffffffb00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:32 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000031e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:32 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000081e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:32 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000200000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:32 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:32 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) [ 907.204047] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 907.226953] FAT-fs (loop3): Filesystem has been set read-only [ 907.235432] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 907.250297] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 907.258929] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 907.274437] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 907.305338] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:35:32 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x6, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r3 = socket$inet6(0xa, 0x3, 0x20000000021) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r4 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r4, 0x107, 0x7, &(0x7f0000000000)=0x2, 0x4) bind$packet(r4, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r4, 0x107, 0x5, &(0x7f0000001000), 0xc5) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x9}, 0x1c) sendto$inet6(r3, &(0x7f0000000000), 0xfedf, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @local}, 0x1a) r5 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f00000004c0)={0x30, {{0xa, 0x4e20, 0x8000, @loopback, 0x7f}}, 0x1, 0x9, [{{0xa, 0x4e22, 0x80000000, @local, 0x8000}}, {{0xa, 0x4e20, 0x4, @loopback, 0x1}}, {{0xa, 0x4e20, 0xfffffffffffffffd, @mcast1, 0x9}}, {{0xa, 0x4e21, 0xefc, @ipv4={[], [], @remote}, 0x1}}, {{0xa, 0x4e22, 0x0, @remote, 0x3ff}}, {{0xa, 0x4e24, 0x0, @mcast1, 0x3}}, {{0xa, 0x4e24, 0x3, @empty, 0x401}}, {{0xa, 0x4e23, 0xfffffffffffffe00, @dev={0xfe, 0x80, [], 0x18}, 0x5}}, {{0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x1f}, 0x7}}]}, 0x510) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000002000001000000001000000000000005c49"], 0x8d, 0x0, &(0x7f00000001c0)="ea18504793b8f722c7db830266ec6f05f8980377d02c550aa486d6cdffa4fed620ac733e35a156d6c127d6bb0a5aaa4947802888a9371a3a3d1d34b546947a856bbb0eff6756f10e01a0b73a81c9860bac7cc6dd5a692b4c752b21427c9a88f4092b07ba8ddd69c34df8aa1f9a6116455aa5b6bb9775f5e5eb429f8a66d82ec7d0cd714843452c625a7c4e6ab2"}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:32 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000091e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:32 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:32 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x700000000000000, 0x1000000020000) 13:35:32 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000001a00000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:32 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) [ 907.451302] binder_alloc: binder_alloc_mmap_handler: 2730 20001000-20004000 already mapped failed -16 [ 907.461391] binder: BINDER_SET_CONTEXT_MGR already set [ 907.468290] binder: 2730:2768 transaction failed 29189/-22, size 0-0 line 2855 [ 907.476442] binder: 2730:2731 ioctl 40046207 0 returned -16 13:35:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000d1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000a1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:33 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000020000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:33 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) close(0xffffffffffffffff) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0x12) 13:35:33 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000c1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 907.669851] binder: undelivered transaction 622, put_user failed [ 907.678739] binder: 2780:2781 ioctl c0306201 20000140 returned -14 [ 907.725996] binder_alloc: binder_alloc_mmap_handler: 2780 20001000-20004000 already mapped failed -16 [ 907.751674] binder: BINDER_SET_CONTEXT_MGR already set [ 907.760754] binder: 2780:2794 ioctl 40046207 0 returned -16 [ 907.766777] binder_alloc: 2780: binder_alloc_buf, no vma [ 907.777404] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 907.797589] binder: 2780:2781 transaction failed 29189/-3, size 0-0 line 2970 [ 907.798400] FAT-fs (loop3): Filesystem has been set read-only 13:35:33 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) fstat(r1, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000000670007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:33 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c7fffffff0000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 907.829905] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 907.845084] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 907.887414] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 907.905541] binder: undelivered transaction 625, put_user failed [ 907.917193] binder: 2801:2802 ioctl c0306201 20000140 returned -14 13:35:33 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x1a0ffffffff, 0x1000000020000) 13:35:33 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:33 executing program 1: openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0x12) 13:35:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000041e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:33 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c070000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 907.933377] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 907.933484] binder_alloc: binder_alloc_mmap_handler: 2801 20001000-20004000 already mapped failed -16 [ 907.942534] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 908.006984] binder: BINDER_SET_CONTEXT_MGR already set [ 908.016248] binder_alloc: 2801: binder_alloc_buf, no vma [ 908.016975] binder: undelivered TRANSACTION_COMPLETE [ 908.031407] binder: 2801:2802 ioctl 40046207 0 returned -16 [ 908.045478] binder: 2801:2803 transaction failed 29189/-3, size 0-0 line 2970 13:35:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000071e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 908.052860] binder: undelivered TRANSACTION_ERROR: 29189 13:35:33 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000340)={0x0, 0x96, "f8db011b49610cb4d747011962186edb18ea05ab08e9d7de65b1886b53b65a998f5a1cad647439b50cd32e6d6a567548d91556b8793ac15aaf7a94b65c81e066c3ad070917d0a922724dd1b8650d9abba050b27b607bbe87a0beda79e502809bc38ef286fcbfab0ee6e7f0fbccf66f38040be6742daf3b58460fa0e7cc3dafa214862effe0a9295ebd36b7eeda60721b2bf9ccc740aa"}, &(0x7f00000002c0)=0x9e) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000004c0)={r3, @in={{0x2, 0x4e23, @multicast2}}, 0x7f, 0x20, 0xffffffff, 0x0, 0x8}, &(0x7f0000000400)=0x98) r4 = syz_open_dev$audion(&(0x7f0000000580)='/dev/audio#\x00', 0x41, 0x8000) ioctl$NBD_SET_SIZE(r4, 0xab02, 0x4) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x100000001}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000180)={r5, 0xcb, "539c69d52698e23c054f46c6949003eaf897e7d612db1010ec55d08415f568646959e27353f5fe45593bb2a2bfe6c8338f6bbdc80ed52feaddc5101c0153e5a4464e030b57e8bc782e2936317090b4751878c644f69f9db502a9d504a288f03612f00440c6a8ecc42a7069e86eb35b2893fb5f863e9eab3d15afae92da0e5f0deb476dafba9c8ece6f64f26003c829a1f33892433d2a31d68e8d89e6daca5970b438b368455c20acb9c2786ca56bc15df689287c0a3d3d7d9f90e34947259168d34afe73889a874ba5eaea"}, &(0x7f0000000280)=0xd3) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:33 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000f1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:33 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000003f00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 908.202436] device nr0 entered promiscuous mode [ 908.214380] binder: undelivered transaction 628, put_user failed [ 908.226123] binder: 2822:2828 ioctl c0306201 20000140 returned -14 13:35:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000061e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 908.253853] binder_alloc: binder_alloc_mmap_handler: 2822 20001000-20004000 already mapped failed -16 [ 908.292917] binder: BINDER_SET_CONTEXT_MGR already set 13:35:33 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000400e000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 908.326822] binder: 2822:2828 ioctl 40046207 0 returned -16 [ 908.352233] binder_alloc: 2822: binder_alloc_buf, no vma [ 908.374054] binder: undelivered TRANSACTION_COMPLETE [ 908.380237] binder: 2822:2831 transaction failed 29189/-3, size 0-0 line 2970 [ 908.547033] binder: undelivered TRANSACTION_ERROR: 29189 13:35:34 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x2000000000000, 0x1000000020000) 13:35:34 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:34 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030ca00100000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:34 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000000f0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:34 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:34 executing program 1: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0x12) 13:35:34 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000051e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:34 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000021e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 908.981036] binder: 2840:2848 transaction failed 29189/-22, size 0-0 line 2855 13:35:34 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f00000e1e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:34 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:34 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000040000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:34 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f000000670007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 909.208190] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 909.215529] FAT-fs (loop3): Filesystem has been set read-only [ 909.221736] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 909.229604] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:34 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x300f000000000000, 0x1000000020000) 13:35:34 executing program 1: openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0x12) 13:35:34 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000000f0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:34 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000070000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 909.263708] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 909.286825] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 909.294119] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 909.524038] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 909.531649] FAT-fs (loop3): Filesystem has been set read-only [ 909.538165] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 909.546337] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 909.553753] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 909.571844] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 909.579815] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:35 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:35 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:35 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e000ff1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:35 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000050000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:35 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100"}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:35 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3700, 0x1000000020000) [ 909.774334] binder_alloc: binder_alloc_mmap_handler: 2840 20001000-20004000 already mapped failed -16 [ 909.783944] binder: BINDER_SET_CONTEXT_MGR already set [ 909.783978] binder: 2840:2883 transaction failed 29189/-22, size 0-0 line 2855 [ 909.796995] binder: undelivered TRANSACTION_ERROR: 29189 [ 909.803225] binder: undelivered TRANSACTION_ERROR: 29189 [ 909.805194] binder: 2840:2882 ioctl 40046207 0 returned -16 13:35:35 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0d07f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 909.896456] binder: 2895:2896 unknown command 0 [ 909.907604] binder: 2895:2896 ioctl c0306201 20000140 returned -22 [ 909.925930] binder_alloc: binder_alloc_mmap_handler: 2895 20001000-20004000 already mapped failed -16 13:35:35 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000400e00000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:35 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 909.970330] binder: BINDER_SET_CONTEXT_MGR already set [ 909.984899] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 909.992153] FAT-fs (loop3): Filesystem has been set read-only [ 910.004141] binder: 2895:2896 ioctl 40046207 0 returned -16 13:35:35 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:35 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0b07f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 910.023212] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 910.028706] binder: undelivered TRANSACTION_COMPLETE [ 910.030623] binder: 2895:2906 unknown command 0 [ 910.039187] binder: undelivered transaction 634, process died. [ 910.049580] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 910.062578] binder: 2895:2906 ioctl c0306201 20000140 returned -22 [ 910.069953] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:35 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c060000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:35 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x2000, 0x0) ioctl$IOC_PR_PREEMPT(r3, 0x401870cb, &(0x7f00000000c0)={0x1000, 0x101, 0x2, 0xffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0x0, r3, 0x0, 0xd, &(0x7f0000000240)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) r5 = getuid() r6 = getegid() ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000400)=0x0) stat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000006c0)=0x0, &(0x7f0000000700), &(0x7f0000000740)) fcntl$getownex(r2, 0x10, &(0x7f0000000780)={0x0, 0x0}) r11 = getuid() stat(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r3, &(0x7f0000000980)={&(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="b37efda9f6f6df99aa101b3f8d268cd114f76649dcd57f9a03ea3e867d8d5a60b7db180c6718c9c7e5586b7421631760ba6a5471dd8225a4d1e468cb91db29b311d2d4c519ca869c963e1e3bff884d06ccd49f888f06e3795bf48ba951a2a7234981b93ad5b4476736c5c0faba28a9818d5348b480fe27043dfc00a4ef809e4d722ece5ede396d7c9016c7b405a6b38fc30228d526a7f28ecc2b87dfd4d7ca0b58b47fc41075bacccd2e2563cb6804ff82a39172cbbb", 0xb6}, {&(0x7f0000000480)="8ce2452cb6fb663d9653be400eac6a3c92452034dfd544b33d958c791d6ceaa386735d4b90efbc1c97adb2c1940ccbe7ca1762a0e59453f8db0d116d96746d83bef983db9acf7f39dc8c000827e20cea45ae1387f3fbd6b93419c138e97ddc58561f01277d2159c783306a54c24aad4a3e4284961d75269e677e2d929518aa710fb728aad952f2c12d86806baa49654e666e7ffe7f80d281d0ec0594967343d23084f6c4c5455caf9d824b", 0xab}, {&(0x7f0000000540)="3d036c59a03d6d63e39ea0e5282e98f717e273d4330eda1c6ce93a065a6f3c615712dff9e06d1d52d275fa32e836e7f59c3cbe2907945cb8eaa07d23cac63efe1ef0d48af1f4b4e32093bdfba58290d0b5335734145ae4b0fb278a6ace2163547008f284d9bcfd1eedf71ed4fc4873579da088c4a0d4501a3ee53dbe5194335b1a338fbebb6a577867402be1544f909a82f9fe9bd3d18ea6", 0x98}], 0x3, &(0x7f0000000880)=[@rights={0x30, 0x1, 0x1, [r0, r3, r2, r2, r2, r0, r3]}, @rights={0x18, 0x1, 0x1, [r1, r0]}, @rights={0x18, 0x1, 0x1, [r2, r0]}, @cred={0x20, 0x1, 0x2, r4, r5, r6}, @cred={0x20, 0x1, 0x2, r7, r8, r9}, @cred={0x20, 0x1, 0x2, r10, r11, r12}, @rights={0x28, 0x1, 0x1, [r1, r2, r1, r3, r2]}, @rights={0x10}], 0xf8, 0xa65828327c7d0aff}, 0x8000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c630100"], 0x6, 0xfffffdfd, &(0x7f0000000000)="4a7f2e6ef0f2"}) [ 910.097273] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 910.104599] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:35 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x7, 0x1000000020000) 13:35:35 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0807f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:35 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:35 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) [ 910.202134] binder: 2915:2918 unknown command 90892 [ 910.223170] binder: 2915:2918 ioctl c0306201 20000140 returned -22 13:35:35 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0c07f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:35 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030cfbffffff0000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 910.274706] binder_alloc: 2915: binder_alloc_buf, no vma [ 910.289944] binder: BINDER_SET_CONTEXT_MGR already set [ 910.313774] binder: 2915:2921 transaction failed 29189/-3, size 0-0 line 2970 13:35:35 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0607f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 910.325776] binder: 2915:2918 ioctl 40046207 0 returned -16 [ 910.350591] binder: undelivered TRANSACTION_COMPLETE [ 910.356727] binder: undelivered TRANSACTION_ERROR: 29189 [ 910.362264] binder: undelivered transaction 636, process died. 13:35:35 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:35 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:35 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000001a0ffffffff00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 910.443839] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:35 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0207f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:36 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) socketpair(0x3, 0x1, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKROGET(r3, 0x125e, &(0x7f0000000040)) [ 910.489911] FAT-fs (loop3): Filesystem has been set read-only [ 910.501465] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 910.519040] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 910.528384] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 910.538167] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 910.555662] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 910.563383] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 910.587712] binder: undelivered transaction 639, put_user failed [ 910.601456] binder: 2946:2947 ioctl c0306201 20000140 returned -14 [ 910.611402] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 910.647868] binder_alloc_mmap_handler: 1 callbacks suppressed [ 910.647888] binder_alloc: binder_alloc_mmap_handler: 2946 20001000-20004000 already mapped failed -16 [ 910.649610] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 910.663443] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 910.677888] binder: BINDER_SET_CONTEXT_MGR already set [ 910.683193] binder: 2946:2947 ioctl 40046207 0 returned -16 13:35:36 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xe00, 0x1000000020000) 13:35:36 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x0, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:36 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0507f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:36 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030cffffffffa001000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 910.693086] binder_alloc: 2946: binder_alloc_buf, no vma 13:35:36 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0707f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:36 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000001000/0x2000)=nil) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000200)=0xc) r3 = getgid() r4 = geteuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000003c0)=0x0) shmctl$IPC_SET(r1, 0x1, &(0x7f00000004c0)={{0x7, r2, r3, r4, r5, 0x6, 0x6}, 0x10000, 0xc7ae, 0x10000, 0x17bd, r6, r7, 0xa62c}) r8 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r9 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x100, 0x0) bind$nfc_llcp(r9, &(0x7f0000000180)={0x27, 0x0, 0x1, 0x5, 0x0, 0x6, "9684b6b68c7f7f38cf656144fc8d4b9d72a3add5b72eb7c5fce552bda51c6842ce38eca8bb520c061a1273345fdb6c52f101ca71571d825f0578f6e08d4adc", 0x39}, 0x60) r10 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r10, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r10, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) write$P9_RWRITE(r9, &(0x7f0000000040)={0xb, 0x77, 0x1, 0xfffffffffffff800}, 0xb) [ 910.751102] binder: undelivered TRANSACTION_ERROR: 29189 [ 910.761069] binder: undelivered TRANSACTION_COMPLETE 13:35:36 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0a07f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:36 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:36 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000003400000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 910.855406] binder: undelivered transaction 642, put_user failed [ 910.871889] binder: 2965:2966 ioctl c0306201 20000140 returned -14 13:35:36 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0f07f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) [ 910.924723] binder_alloc: binder_alloc_mmap_handler: 2965 20001000-20004000 already mapped failed -16 [ 910.957271] binder: BINDER_SET_CONTEXT_MGR already set [ 910.973084] binder: 2965:2966 ioctl 40046207 0 returned -16 [ 911.006203] binder_alloc: 2965: binder_alloc_buf, no vma [ 911.015799] binder: undelivered TRANSACTION_COMPLETE [ 911.041955] binder: undelivered TRANSACTION_ERROR: 29189 13:35:37 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x8000000000000, 0x1000000020000) 13:35:37 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000340000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0907f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:37 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:37 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:37 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0407f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 911.773637] binder: undelivered transaction 645, put_user failed [ 911.790805] binder: 2993:2995 ioctl c0306201 20000140 returned -14 13:35:37 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:37 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c003f00000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 911.826456] binder_alloc: binder_alloc_mmap_handler: 2993 20001000-20004000 already mapped failed -16 13:35:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0307f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 911.891315] binder: BINDER_SET_CONTEXT_MGR already set [ 911.934083] binder: 2993:2996 ioctl 40046207 0 returned -16 [ 911.939914] binder: undelivered TRANSACTION_COMPLETE [ 911.946425] device nr0 entered promiscuous mode 13:35:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0e07f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:37 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 912.092983] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 912.108265] FAT-fs (loop3): Filesystem has been set read-only [ 912.129596] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 912.150534] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 912.166009] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 912.199297] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 912.218983] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:37 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3b000000, 0x1000000020000) 13:35:37 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c030000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:37 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f00000000c0)={'U+', 0x771}, 0x28, 0x1) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063077f000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x200000, 0x0) 13:35:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e000ff1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:35:37 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 912.304219] binder: 3027:3028 unknown command 2131190528 [ 912.313894] binder: 3027:3028 ioctl c0306201 20000440 returned -22 13:35:37 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff030000000c000000005307a33d6c390836be381b", 0x1f) 13:35:37 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:37 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c050000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0f0000000c000000005307a33d6c390836be381b", 0x1f) 13:35:38 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff050000000c000000005307a33d6c390836be381b", 0x1f) 13:35:38 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0a0300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 912.580658] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 912.597052] FAT-fs (loop3): Filesystem has been set read-only [ 912.605828] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 912.613963] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 912.629102] device nr0 entered promiscuous mode [ 912.634652] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:38 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x20000, 0x1000000020000) 13:35:38 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c004003000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 912.684801] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 912.692873] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 912.984706] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 912.992014] FAT-fs (loop3): Filesystem has been set read-only [ 912.998233] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 913.007000] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 913.014345] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 913.040397] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 913.048835] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 913.094700] binder: BINDER_SET_CONTEXT_MGR already set [ 913.100207] binder: 3027:3061 ioctl 40046207 0 returned -16 [ 913.106466] binder: 3027:3034 unknown command 2131190528 [ 913.111976] binder: 3027:3034 ioctl c0306201 20000440 returned -22 13:35:38 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:38 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02c00e000c000000005307a33d6c390836be381b", 0x1f) 13:35:38 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="030300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:38 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000500000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:38 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100"}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:38 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x4000000, 0x1000000020000) 13:35:38 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020a00000c000000005307a33d6c390836be381b", 0x1f) 13:35:38 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="080300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 913.233807] binder: undelivered transaction 648, put_user failed [ 913.272220] binder: 3073:3074 ioctl c0306201 20000140 returned -14 13:35:38 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000200000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 913.318076] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 913.326045] FAT-fs (loop3): Filesystem has been set read-only [ 913.333170] binder_alloc: binder_alloc_mmap_handler: 3073 20001000-20004000 already mapped failed -16 [ 913.350481] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 913.357279] device nr0 entered promiscuous mode [ 913.358109] binder: BINDER_SET_CONTEXT_MGR already set [ 913.368992] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 913.377293] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 913.386547] binder_alloc: 3073: binder_alloc_buf, no vma [ 913.403332] binder: 3073:3081 ioctl 40046207 0 returned -16 [ 913.413695] binder: undelivered TRANSACTION_COMPLETE 13:35:38 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020d00000c000000005307a33d6c390836be381b", 0x1f) [ 913.420530] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 913.428303] binder_transaction: 2 callbacks suppressed [ 913.428321] binder: 3073:3083 transaction failed 29189/-3, size 0-0 line 2970 13:35:38 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000300000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:38 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="100300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 913.466673] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 913.498934] binder: undelivered TRANSACTION_ERROR: 29189 13:35:39 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x400000, 0x0) r4 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, 0x8010, r2, 0x0) r5 = mmap$binder(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x1, 0x10, r3, 0x3f) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f00000003c0)={0x0}) r7 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x10010, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000780)={0x110, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000340), &(0x7f0000000380)=[0x0, 0x40, 0x0, 0x20, 0x38]}, 0x1}}, @increfs_done={0x40106308, r4, 0x3}, @acquire, @increfs_done={0x40106308, r5, 0x1}, @increfs_done={0x40106308, r6, 0x2}, @dead_binder_done={0x40086310, 0x2}, @dead_binder_done={0x40086310, 0x1}, @acquire_done={0x40106309, r7}, @reply_sg={0x40486312, {{0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x38, &(0x7f00000004c0)=[@fda={0x66646185, 0x3, 0x4, 0x30}, @fd={0x66642a85, 0x0, r0, 0x0, 0x2}, @fd={0x66642a85, 0x0, r3}], &(0x7f0000000400)=[0x38, 0x38, 0x40, 0x30, 0x28, 0x0, 0x0]}, 0x3}}, @increfs={0x40046304, 0x4}], 0xd9, 0x0, &(0x7f0000000680)="a2b9b049b0a9ee0289db4b4ee39e94ae38358acde2aa0377b91e441debcffacaea0f9aef31256a6dc4e4be756d7dd9d4fc0cbfeba501b2f79183cceb2a131ad9eef6cfa1fb831ba29687a70628253591f4d2babe8f52b4f5eaa8bea7ce92c1b9be1c95f3819055bf3f95426bd795e32716730d2ec1768774b700c5c45a97c9d630911261311bd2e852eb0119b11ad5f6d298aacfd2240a03cafdbea4d3d53022e41b09e62754d592f81e74ed5ac2019ee041c78ee3e395e5eda51d504ae9237e1d21fdf26b71c4c627c3baeb5e3954bf83f7d8a66a8ecdc6b8"}) ioctl$TCXONC(r3, 0x540a, 0xfc) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e20, 0x8d, @dev={0xfe, 0x80, [], 0x21}, 0xe89a}}, 0x7, 0x10001, 0x2000000000, 0xffffffffffffffe0, 0xc}, &(0x7f0000000240)=0x98) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000280)={r8, 0x40}, &(0x7f00000002c0)=0x8) r9 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xf37b, 0x262000) getsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000040), &(0x7f00000000c0)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000080000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='$c\x00\x00'], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) ioctl$BINDER_THREAD_EXIT(r9, 0x40046208, 0x0) 13:35:39 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x90000000, 0x1000000020000) 13:35:39 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000010000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:39 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0b0300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 913.597378] binder: 3094:3095 transaction failed 29189/-22, size 0-40 line 2855 [ 913.637168] binder: 3094:3095 got transaction to invalid handle [ 913.683202] binder: 3094:3101 unknown command 25380 [ 913.685226] binder: 3094:3095 transaction failed 29201/-22, size 0-0 line 2855 [ 913.695851] binder: 3094:3101 ioctl c0306201 20000140 returned -22 [ 913.741644] binder: 3094:3105 got transaction with unaligned buffers size, 1 [ 913.765325] binder: 3094:3105 transaction failed 29201/-22, size 0-40 line 3015 [ 913.794909] binder: BINDER_SET_CONTEXT_MGR already set [ 913.825252] binder: 3094:3101 got transaction to invalid handle [ 913.845520] binder: 3094:3095 ioctl 40046207 0 returned -16 [ 913.845531] binder: 3094:3107 unknown command 25380 [ 913.845550] binder: 3094:3107 ioctl c0306201 20000140 returned -22 [ 913.863022] binder: undelivered TRANSACTION_ERROR: 29201 [ 913.864273] binder: 3094:3101 transaction failed 29201/-22, size 0-0 line 2855 [ 913.878619] binder: undelivered TRANSACTION_ERROR: 29201 13:35:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:39 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030ce00004000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:39 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="170300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:39 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff021419000c000000005307a33d6c390836be381b", 0x1f) 13:35:39 executing program 2: r0 = socket$inet6(0xa, 0x800000000000006, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:39 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020081000c000000005307a33d6c390836be381b", 0x1f) [ 914.005353] binder: undelivered transaction 656, put_user failed [ 914.011599] binder: 3109:3116 ioctl c0306201 20000140 returned -14 13:35:39 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c0300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:39 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c040000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:39 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020700000c000000005307a33d6c390836be381b", 0x1f) [ 914.095623] binder_alloc: binder_alloc_mmap_handler: 3109 20001000-20004000 already mapped failed -16 [ 914.120239] binder: BINDER_SET_CONTEXT_MGR already set [ 914.136444] binder: 3109:3116 ioctl 40046207 0 returned -16 [ 914.136471] binder_alloc: 3109: binder_alloc_buf, no vma [ 914.159882] device nr0 entered promiscuous mode [ 914.183498] binder: undelivered TRANSACTION_COMPLETE [ 914.185209] binder: 3109:3118 transaction failed 29189/-3, size 0-0 line 2970 [ 914.245406] binder: undelivered TRANSACTION_ERROR: 29189 13:35:39 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x37, 0x1000000020000) 13:35:39 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000700000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:39 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020ec0000c000000005307a33d6c390836be381b", 0x1f) 13:35:40 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:40 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020200030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:40 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c630061fca0157892c7b194e3f2531ab9cf601b"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:40 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000100000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:40 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020900000c000000005307a33d6c390836be381b", 0x1f) [ 914.708739] binder: 3139:3141 unknown command 1627415308 [ 914.714282] binder: 3139:3141 ioctl c0306201 20000140 returned -22 [ 914.740516] binder_alloc: binder_alloc_mmap_handler: 3139 20001000-20004000 already mapped failed -16 13:35:40 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200f0000c000000005307a33d6c390836be381b", 0x1f) [ 914.768722] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 914.780874] FAT-fs (loop3): Filesystem has been set read-only [ 914.788769] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 914.795348] binder: BINDER_SET_CONTEXT_MGR already set [ 914.798164] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:40 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000060000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:40 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="021000030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 914.813966] binder: 3139:3141 ioctl 40046207 0 returned -16 [ 914.814003] binder_alloc: 3139: binder_alloc_buf, no vma [ 914.836633] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 914.842780] binder: undelivered TRANSACTION_COMPLETE [ 914.849847] binder: undelivered transaction 659, process died. 13:35:40 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$IPT_SO_GET_REVISION_MATCH(r3, 0x0, 0x42, &(0x7f00000000c0)={'NETMAP\x00'}, &(0x7f0000000180)=0x1e) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x319000, 0x0) ioctl$VT_WAITACTIVE(r4, 0x5607) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 914.863152] binder: 3139:3147 transaction failed 29189/-3, size 0-0 line 2970 [ 914.871788] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 914.881505] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 914.889210] binder: undelivered TRANSACTION_ERROR: 29189 [ 914.910266] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 914.942785] device nr0 entered promiscuous mode [ 914.952417] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 914.987287] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 915.001880] binder: undelivered transaction 662, put_user failed [ 915.018989] binder: 3158:3159 ioctl c0306201 20000140 returned -14 [ 915.026128] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:40 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3600000000000000, 0x1000000020000) 13:35:40 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020900030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:40 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020f00000c000000005307a33d6c390836be381b", 0x1f) [ 915.046686] binder_alloc: binder_alloc_mmap_handler: 3158 20001000-20004000 already mapped failed -16 [ 915.087386] binder: BINDER_SET_CONTEXT_MGR already set [ 915.092747] binder: 3158:3161 ioctl 40046207 0 returned -16 [ 915.105314] binder_alloc: 3158: binder_alloc_buf, no vma [ 915.110848] binder: 3158:3162 transaction failed 29189/-3, size 0-0 line 2970 [ 915.133795] binder: undelivered TRANSACTION_COMPLETE [ 915.139700] binder: undelivered TRANSACTION_ERROR: 29189 [ 915.296936] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 915.326017] FAT-fs (loop3): Filesystem has been set read-only [ 915.346576] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 915.356471] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 915.371010] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 915.397772] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 915.412977] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:40 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) 13:35:40 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000003f0000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:40 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020305030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:40 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020c00000c000000005307a33d6c390836be381b", 0x1f) 13:35:40 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x7fff) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:40 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x800000000000000, 0x1000000020000) 13:35:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000e000c000000005307a33d6c390836be381b", 0x1f) [ 915.542234] binder: undelivered transaction 665, put_user failed [ 915.552003] binder: 3178:3179 ioctl c0306201 20000140 returned -14 [ 915.562038] binder_alloc: binder_alloc_mmap_handler: 3178 20001000-20004000 already mapped failed -16 [ 915.572177] binder: BINDER_SET_CONTEXT_MGR already set [ 915.577722] binder: 3178:3179 ioctl 40046207 0 returned -16 [ 915.583879] binder_alloc: 3178: binder_alloc_buf, no vma 13:35:41 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c1ef839cec400000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:41 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020306030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 915.628611] binder: undelivered TRANSACTION_COMPLETE [ 915.634285] binder: 3178:3182 transaction failed 29189/-3, size 0-0 line 2970 [ 915.667246] binder: undelivered TRANSACTION_ERROR: 29189 13:35:41 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) sysfs$1(0x1, &(0x7f0000000000)='ppp1selfeth0\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) r3 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0xe7, 0x105100) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000004c0)={0x0, @in6={{0xa, 0x4e22, 0x27, @dev={0xfe, 0x80, [], 0xa}, 0x2}}, 0xffffffff, 0x1}, &(0x7f0000000240)=0x90) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000002c0)={r4, 0x2}, 0x8) setsockopt$RDS_GET_MR_FOR_DEST(r3, 0x114, 0x7, &(0x7f0000000340)={@vsock={0x28, 0x0, 0xffffffff, @host}, {&(0x7f0000000180)=""/157, 0x9d}, &(0x7f00000000c0), 0x10}, 0xa0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c630072662c62e90d53d95f063a81b81564db078246cef6b925687cebc4a2d9015acd8a3700"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 915.712212] device nr0 entered promiscuous mode 13:35:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020009000c000000005307a33d6c390836be381b", 0x1f) 13:35:41 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030cfffffffb0000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 915.752621] binder: 3197:3198 unknown command 1912627980 [ 915.757196] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 915.781954] FAT-fs (loop3): Filesystem has been set read-only [ 915.787837] binder: 3197:3198 ioctl c0306201 20000140 returned -22 [ 915.801824] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 915.821352] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 915.831978] binder_alloc: binder_alloc_mmap_handler: 3197 20001000-20004000 already mapped failed -16 [ 915.840524] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 915.857222] binder: BINDER_SET_CONTEXT_MGR already set [ 915.871921] binder: 3197:3206 unknown command 1912627980 [ 915.881249] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 915.894411] binder_alloc: 3197: binder_alloc_buf, no vma [ 915.905529] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 915.909380] binder: 3197:3202 ioctl 40046207 0 returned -16 [ 915.929693] binder: undelivered TRANSACTION_COMPLETE [ 915.945635] binder: undelivered transaction 668, process died. [ 915.952183] binder: 3197:3204 transaction failed 29189/-3, size 0-0 line 2970 [ 915.973427] binder: 3197:3206 ioctl c0306201 20000140 returned -22 [ 915.985651] binder: undelivered TRANSACTION_ERROR: 29189 13:35:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000009000000005307a33d6c390836be381b", 0x1f) 13:35:41 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xffffffff00000000, 0x1000000020000) 13:35:41 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:41 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000500000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:41 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063414000000000000000100000000100000000000000476ed9c88829fd46092b00df70c31d466c4afee22c9a4b54f967234a71e723514dccda22f8e6c4368ebce52ee0473f72c306deb81ccc3d8bcebdf72cd5f0f4ca6127e6bc05"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:41 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020200000c000000005307a33d6c390836be381b", 0x1f) [ 916.240557] binder: 3215:3216 unknown command 1078027008 [ 916.259263] binder: 3215:3216 ioctl c0306201 20000440 returned -22 13:35:41 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:41 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300400c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020e00000c000000005307a33d6c390836be381b", 0x1f) 13:35:41 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000600000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020300000c000000005307a33d6c390836be381b", 0x1f) [ 916.400029] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 916.416087] FAT-fs (loop3): Filesystem has been set read-only [ 916.430125] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 916.445942] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 916.455502] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:41 executing program 1 (fault-call:10 fault-nth:0): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:42 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xfbffffff, 0x1000000020000) 13:35:42 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000d000c000000005307a33d6c390836be381b", 0x1f) 13:35:42 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020303030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 916.497561] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 916.516100] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 916.636476] device nr0 entered promiscuous mode [ 916.647743] FAULT_INJECTION: forcing a failure. [ 916.647743] name failslab, interval 1, probability 0, space 0, times 0 [ 916.659062] CPU: 1 PID: 3235 Comm: syz-executor1 Not tainted 4.19.0-rc7+ #275 [ 916.666343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 916.666351] Call Trace: [ 916.666391] dump_stack+0x1c4/0x2b4 [ 916.666417] ? dump_stack_print_info.cold.2+0x52/0x52 [ 916.666452] should_fail.cold.4+0xa/0x17 [ 916.691263] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 916.696393] ? mark_held_locks+0x130/0x130 [ 916.700646] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 916.706211] ? __mutex_lock+0x85e/0x1700 [ 916.710860] ? tun_get_user+0x1db5/0x4250 [ 916.715038] ? zap_class+0x640/0x640 [ 916.718771] ? mutex_trylock+0x2b0/0x2b0 [ 916.722840] ? perf_trace_lock_acquire+0x15b/0x800 [ 916.727791] ? perf_trace_lock+0x7a0/0x7a0 [ 916.732038] ? perf_trace_lock+0x7a0/0x7a0 [ 916.736298] ? mark_held_locks+0x130/0x130 [ 916.740548] ? zap_class+0x640/0x640 [ 916.744279] __should_failslab+0x124/0x180 [ 916.748522] should_failslab+0x9/0x14 [ 916.752339] kmem_cache_alloc+0x47/0x730 [ 916.756429] ? mark_held_locks+0x130/0x130 [ 916.760675] ? debug_smp_processor_id+0x1c/0x20 [ 916.765369] __build_skb+0xab/0x430 [ 916.769023] ? check_preemption_disabled+0x48/0x200 [ 916.774052] ? skb_try_coalesce+0x1b70/0x1b70 [ 916.778564] ? debug_smp_processor_id+0x1c/0x20 [ 916.783258] ? __alloc_pages_nodemask+0xde0/0xde0 [ 916.788115] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 916.793663] ? check_preemption_disabled+0x48/0x200 [ 916.798694] __napi_alloc_skb+0x1d6/0x310 [ 916.802895] napi_get_frags+0x67/0x140 [ 916.806799] tun_get_user+0x1e1f/0x4250 [ 916.810807] ? tun_build_skb.isra.51+0x2230/0x2230 [ 916.815750] ? lock_downgrade+0x900/0x900 [ 916.819943] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 916.825752] ? lock_downgrade+0x900/0x900 [ 916.829919] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 916.835737] ? zap_class+0x640/0x640 [ 916.839465] ? tun_get+0x206/0x370 [ 916.843017] ? lock_downgrade+0x900/0x900 [ 916.847183] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 916.852996] ? zap_class+0x640/0x640 [ 916.856729] ? tun_get+0x22d/0x370 [ 916.860274] ? tun_chr_close+0x180/0x180 [ 916.864375] tun_chr_write_iter+0xb9/0x154 [ 916.868632] __vfs_write+0x6b8/0x9f0 [ 916.872372] ? kernel_read+0x120/0x120 [ 916.876280] ? apparmor_path_rmdir+0x30/0x30 [ 916.880697] ? lock_release+0x970/0x970 [ 916.884691] ? check_preemption_disabled+0x48/0x200 [ 916.889727] ? apparmor_file_permission+0x24/0x30 [ 916.894590] ? rw_verify_area+0x118/0x360 [ 916.898754] vfs_write+0x1fc/0x560 [ 916.902311] ksys_write+0x101/0x260 [ 916.905953] ? __ia32_sys_read+0xb0/0xb0 [ 916.910035] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 916.915515] __x64_sys_write+0x73/0xb0 [ 916.919418] do_syscall_64+0x1b9/0x820 [ 916.923316] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 916.928697] ? syscall_return_slowpath+0x5e0/0x5e0 [ 916.933637] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 916.938506] ? trace_hardirqs_on_caller+0x310/0x310 [ 916.943536] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 916.948743] ? prepare_exit_to_usermode+0x291/0x3b0 [ 916.953776] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 916.958639] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 916.963853] RIP: 0033:0x457579 [ 916.967063] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 916.985977] RSP: 002b:00007f250970ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 916.993703] RAX: ffffffffffffffda RBX: 00007f250970ac90 RCX: 0000000000457579 [ 917.001006] RDX: 0000000000000012 RSI: 0000000020000000 RDI: 0000000000000005 [ 917.008290] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 917.015568] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f250970b6d4 [ 917.022845] R13: 00000000004c5574 R14: 00000000004d8e98 R15: 0000000000000007 13:35:42 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000000)=[@exit_looper], 0xe, 0x0, &(0x7f0000000040)="8d66f78b3e6aceaa771209a08ed2"}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0c6300000209eddec5ee4cf33021a1b077b4bb30e1af4ab8a928574cd1c7ab8d299c8d443b7c46c19e397ef07befd213fdaf3f2ad48a01ca79724f0802bb919d878c5868422e9cd99208470a0474debb2da2bdbd2b9632a66ebd8907f582bab338c78f632c3e7686f2848f35d62448442ca7501e2de31c191661826e2f29387528fe6586ee1073a0020467bccc321bbc5319d26eeb26e850c811aa1c1e8f7ba3af8de6fa5f67f0fc71a7a9f2522204007b50b332155d2ee9e34989f2d1105367c8c371fbec58dd4458397b4abfe356a80dadbc30f038a444f947c5c9f33322caa2b2b1c38534d4cc912fabe0617bca758666811d3125ee444efa730b321d9308c9326e5396d0f6cc4605c00277aec8fa22998674fc9512315c06b3e9f249223db7a2c141669c9bfbe03b18194a58ef8a0898dd2d83b0c594af88aaf2ecf8df18021880f4de131a4cdfb4407a47a43f9a6b949b4c784a52c23ce63fb0a9b77beaca17f5e6abe17ba1c9448fd985be603609a6527d"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:42 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000002000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:42 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020007000c000000005307a33d6c390836be381b", 0x1f) 13:35:42 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020304030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 917.038981] binder_alloc: binder_alloc_mmap_handler: 3215 20001000-20004000 already mapped failed -16 [ 917.048735] binder: BINDER_SET_CONTEXT_MGR already set [ 917.048754] binder: 3215:3244 ioctl 40046207 0 returned -16 [ 917.060247] binder: 3215:3245 unknown command 1078027008 [ 917.065978] binder: 3215:3245 ioctl c0306201 20000440 returned -22 13:35:42 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000400000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 917.218778] binder: undelivered transaction 672, put_user failed [ 917.227498] binder: 3253:3255 ioctl c0306201 20000140 returned -14 13:35:42 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020302030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:42 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000300000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:42 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020307030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 917.496533] binder_alloc: binder_alloc_mmap_handler: 3253 20001000-20004000 already mapped failed -16 [ 917.515381] binder: BINDER_SET_CONTEXT_MGR already set [ 917.525296] binder: 3253:3255 ioctl 40046207 0 returned -16 [ 917.535828] binder_alloc: 3253: binder_alloc_buf, no vma [ 917.537532] binder: undelivered TRANSACTION_COMPLETE [ 917.548017] binder: undelivered TRANSACTION_ERROR: 29189 13:35:43 executing program 1 (fault-call:10 fault-nth:1): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) [ 917.758380] device nr0 entered promiscuous mode [ 917.772440] FAULT_INJECTION: forcing a failure. [ 917.772440] name failslab, interval 1, probability 0, space 0, times 0 [ 917.783856] CPU: 0 PID: 3266 Comm: syz-executor1 Not tainted 4.19.0-rc7+ #275 [ 917.791151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 917.800520] Call Trace: [ 917.803138] dump_stack+0x1c4/0x2b4 [ 917.806815] ? dump_stack_print_info.cold.2+0x52/0x52 [ 917.812038] ? perf_trace_run_bpf_submit+0x267/0x330 [ 917.817168] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 917.822742] should_fail.cold.4+0xa/0x17 [ 917.826824] ? check_preemption_disabled+0x48/0x200 [ 917.831871] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 917.837019] ? debug_smp_processor_id+0x1c/0x20 [ 917.841717] ? perf_trace_lock_acquire+0x15b/0x800 [ 917.846662] ? debug_smp_processor_id+0x1c/0x20 [ 917.846682] ? perf_trace_lock_acquire+0x15b/0x800 [ 917.846711] ? perf_trace_lock+0x7a0/0x7a0 [ 917.846731] ? perf_trace_lock+0x7a0/0x7a0 [ 917.864841] ? perf_trace_lock+0x4a7/0x7a0 [ 917.869113] ? zap_class+0x640/0x640 [ 917.872866] ? zap_class+0x640/0x640 [ 917.876621] ? pvclock_read_flags+0x160/0x160 [ 917.881163] ? lock_acquire+0x1ed/0x520 [ 917.885165] ? tun_flow_update+0x787/0x1060 [ 917.889516] ? tun_flow_update+0x187/0x1060 [ 917.893888] __should_failslab+0x124/0x180 [ 917.898163] should_failslab+0x9/0x14 [ 917.901991] kmem_cache_alloc_trace+0x4b/0x750 [ 917.906597] ? kasan_check_write+0x14/0x20 [ 917.910857] ? do_raw_spin_lock+0xc1/0x200 [ 917.915127] tun_flow_update+0xbbe/0x1060 [ 917.919317] ? tun_chr_ioctl+0x40/0x40 [ 917.923241] ? kasan_check_write+0x14/0x20 [ 917.927498] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 917.932462] ? wait_for_completion+0x8a0/0x8a0 [ 917.937084] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 917.942725] ? napi_gro_frags+0x481/0xc90 [ 917.946908] ? trace_hardirqs_on+0xbd/0x310 [ 917.951277] ? tun_get_user+0x319f/0x4250 [ 917.955453] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 917.961019] ? eth_get_headlen+0x173/0x1f0 [ 917.965284] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 917.970847] ? check_preemption_disabled+0x48/0x200 [ 917.975898] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 917.981461] ? check_preemption_disabled+0x48/0x200 [ 917.986517] tun_get_user+0x31c6/0x4250 [ 917.990568] ? tun_build_skb.isra.51+0x2230/0x2230 [ 917.995529] ? lock_downgrade+0x900/0x900 [ 917.999711] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 918.005534] ? lock_downgrade+0x900/0x900 [ 918.009721] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 918.015556] ? zap_class+0x640/0x640 [ 918.019307] ? tun_get+0x206/0x370 [ 918.022893] ? lock_downgrade+0x900/0x900 [ 918.027078] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 918.032925] ? zap_class+0x640/0x640 [ 918.036675] ? tun_get+0x22d/0x370 [ 918.040239] ? tun_chr_close+0x180/0x180 [ 918.044347] tun_chr_write_iter+0xb9/0x154 [ 918.048634] __vfs_write+0x6b8/0x9f0 [ 918.052399] ? kernel_read+0x120/0x120 [ 918.056321] ? apparmor_path_rmdir+0x30/0x30 [ 918.060777] ? lock_release+0x970/0x970 [ 918.064795] ? check_preemption_disabled+0x48/0x200 [ 918.069862] ? apparmor_file_permission+0x24/0x30 [ 918.074744] ? rw_verify_area+0x118/0x360 [ 918.078928] vfs_write+0x1fc/0x560 [ 918.082509] ksys_write+0x101/0x260 [ 918.086169] ? __ia32_sys_read+0xb0/0xb0 [ 918.090275] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 918.095763] __x64_sys_write+0x73/0xb0 [ 918.099680] do_syscall_64+0x1b9/0x820 [ 918.103614] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 918.109004] ? syscall_return_slowpath+0x5e0/0x5e0 [ 918.113966] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 918.118834] ? trace_hardirqs_on_caller+0x310/0x310 [ 918.123879] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 918.128925] ? prepare_exit_to_usermode+0x291/0x3b0 [ 918.133972] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 918.138868] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 918.144077] RIP: 0033:0x457579 [ 918.147785] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 918.166705] RSP: 002b:00007f250970ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 918.174445] RAX: ffffffffffffffda RBX: 00007f250970ac90 RCX: 0000000000457579 [ 918.181727] RDX: 0000000000000012 RSI: 0000000020000000 RDI: 0000000000000005 [ 918.189013] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 918.196297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f250970b6d4 [ 918.203580] R13: 00000000004c5574 R14: 00000000004d8e98 R15: 0000000000000007 13:35:43 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xfffffff, 0x1000000020000) 13:35:43 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xfffffffffffffffe) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000000080)={r2, 0x0, 0x1, 0x8001, 0x2}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) r3 = mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2000004, 0x4010, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0xf4, 0x0, &(0x7f00000004c0)=[@reply={0x40406301, {0x2, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x60, 0x28, &(0x7f0000000180)=[@ptr={0x70742a85, 0x1, &(0x7f0000000000), 0x1, 0x8000, 0x40}, @fda={0x66646185, 0x0, 0x4, 0x38}, @fd={0x66642a85, 0x0, r1, 0x0, 0x1}], &(0x7f0000000040)=[0x48, 0x38, 0x30, 0x0, 0x18]}}, @enter_looper, @transaction_sg={0x40486311, {{0x3, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x38, 0x30, &(0x7f00000002c0)=[@fda={0x66646185, 0x2, 0x4, 0x22}, @fd={0x66642a85, 0x0, r0}], &(0x7f0000000340)=[0x18, 0x30, 0x0, 0x38, 0x38, 0x68]}, 0x7ff}}, @dead_binder_done, @increfs_done={0x40106308, r3, 0x2}], 0x0, 0xfffffdfd, &(0x7f0000000380)="f2"}) 13:35:43 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020006000c000000005307a33d6c390836be381b", 0x1f) 13:35:43 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:43 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000600000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:43 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300020c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:43 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000007fffffff00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:44 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000c4ce39f81e00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:44 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300100c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 918.547114] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 918.554492] FAT-fs (loop3): Filesystem has been set read-only [ 918.561009] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 918.569167] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 918.576710] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 918.599288] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 918.622701] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:44 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000f000000005307a33d6c390836be381b", 0x1f) 13:35:44 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x1000000000000, 0x1000000020000) [ 918.649322] binder_transaction: 2 callbacks suppressed [ 918.649339] binder: 3275:3276 transaction failed 29189/-22, size 0-0 line 2855 [ 918.686240] binder: undelivered TRANSACTION_ERROR: 29189 [ 918.691954] binder: undelivered TRANSACTION_ERROR: 29189 13:35:44 executing program 1 (fault-call:10 fault-nth:2): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:44 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030f000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:44 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:44 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000030000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:44 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000b000c000000005307a33d6c390836be381b", 0x1f) [ 918.838962] binder: undelivered transaction 677, put_user failed [ 918.861176] binder: 3302:3304 ioctl c0306201 20000140 returned -14 [ 918.883356] binder_alloc: binder_alloc_mmap_handler: 3302 20001000-20004000 already mapped failed -16 13:35:44 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0203000310000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:44 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000040030000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 918.937958] binder: BINDER_SET_CONTEXT_MGR already set [ 918.949196] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 918.956628] binder_alloc: 3302: binder_alloc_buf, no vma [ 918.964343] device nr0 entered promiscuous mode [ 918.969986] binder: 3302:3307 ioctl 40046207 0 returned -16 [ 918.973617] FAT-fs (loop3): Filesystem has been set read-only 13:35:44 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02f000000c000000005307a33d6c390836be381b", 0x1f) [ 918.987037] binder: undelivered TRANSACTION_COMPLETE [ 918.987527] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 918.992928] binder: 3302:3308 transaction failed 29189/-3, size 0-0 line 2970 [ 919.015968] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 919.036584] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 919.058142] binder: undelivered TRANSACTION_ERROR: 29189 13:35:44 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000001a000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:44 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c6300afbc00"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:44 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000100000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 919.096120] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) 13:35:44 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x35, 0x1000000020000) [ 919.138149] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 919.212499] binder: 3319:3324 unknown command -1358929140 [ 919.219546] binder: 3319:3324 ioctl c0306201 20000140 returned -22 [ 919.428846] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 919.445038] FAT-fs (loop3): Filesystem has been set read-only [ 919.457963] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 919.480185] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 919.495468] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 919.497436] binder_alloc: binder_alloc_mmap_handler: 3319 20001000-20004000 already mapped failed -16 [ 919.515985] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 919.524218] binder_alloc: 3319: binder_alloc_buf, no vma 13:35:45 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000400000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:45 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000400000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) 13:35:45 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000f000c000000005307a33d6c390836be381b", 0x1f) [ 919.531089] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 919.549977] binder: 3319:3324 transaction failed 29189/-3, size 0-0 line 2970 [ 919.565090] binder: BINDER_SET_CONTEXT_MGR already set [ 919.595436] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 919.603979] binder: undelivered TRANSACTION_COMPLETE [ 919.609745] binder: undelivered transaction 680, process died. [ 919.615555] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 919.616398] binder: 3319:3321 ioctl 40046207 0 returned -16 [ 919.640005] binder: undelivered TRANSACTION_ERROR: 29189 13:35:45 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000c000c000000005307a33d6c390836be381b", 0x1f) [ 919.648256] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 919.665650] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) 13:35:45 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000003f0000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:45 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ftruncate(r0, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0xfffffbffffffffdf) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:45 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000006000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:45 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xf30, 0x1000000020000) 13:35:45 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020b00000c000000005307a33d6c390836be381b", 0x1f) [ 919.790018] device nr0 entered promiscuous mode 13:35:45 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020400000c000000005307a33d6c390836be381b", 0x1f) 13:35:45 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c007fffffff00000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 920.024563] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 920.062320] FAT-fs (loop3): Filesystem has been set read-only [ 920.075447] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 920.089728] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 920.109554] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 920.142434] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 920.154821] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:45 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000007000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:45 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000030000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:45 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xffffff0f, 0x1000000020000) 13:35:45 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020800000c000000005307a33d6c390836be381b", 0x1f) 13:35:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x800e0000, 0x12) 13:35:45 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff021914000c000000005307a33d6c390836be381b", 0x1f) [ 920.449979] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 920.457985] device nr0 entered promiscuous mode [ 920.471847] FAT-fs (loop3): Filesystem has been set read-only [ 920.497129] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 920.505752] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 920.513133] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 920.530793] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 920.546859] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 920.554151] binder: BINDER_SET_CONTEXT_MGR already set [ 920.579162] binder: 3340:3374 ioctl 40046207 0 returned -16 13:35:46 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ftruncate(r1, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:46 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c001ef839cec4000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:46 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c050000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:46 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020005000c000000005307a33d6c390836be381b", 0x1f) 13:35:46 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xe000000, 0x1000000020000) 13:35:46 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x3f00000000000000, 0x12) [ 920.883179] binder: 3384:3385 got transaction to context manager from process owning it 13:35:46 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000a000c000000005307a33d6c390836be381b", 0x1f) 13:35:46 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000007000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 920.924598] binder: 3384:3385 transaction failed 29201/-22, size 0-0 line 2846 [ 920.963625] binder_alloc: binder_alloc_mmap_handler: 3384 20001000-20004000 already mapped failed -16 13:35:46 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c060000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 920.988477] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 920.999339] FAT-fs (loop3): Filesystem has been set read-only [ 921.005976] binder: BINDER_SET_CONTEXT_MGR already set [ 921.011681] binder: 3384:3388 ioctl 40046207 0 returned -16 [ 921.018237] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 921.032998] binder_alloc: 3384: binder_alloc_buf, no vma [ 921.039828] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 921.055471] binder: 3384:3385 transaction failed 29189/-3, size 0-0 line 2970 [ 921.063090] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 921.070981] binder: undelivered TRANSACTION_ERROR: 29201 [ 921.084528] device nr0 entered promiscuous mode 13:35:46 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020003000c000000005307a33d6c390836be381b", 0x1f) 13:35:46 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8916, &(0x7f0000000040)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c1f5b87"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 921.086026] binder: undelivered TRANSACTION_ERROR: 29189 [ 921.104738] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 921.117234] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:46 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xfff0, 0x1000000020000) 13:35:46 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000400e000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:46 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000007fffffff000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:46 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020500000c000000005307a33d6c390836be381b", 0x1f) [ 921.174226] binder: 3400:3401 unknown command -2024071412 [ 921.206490] binder: 3400:3401 ioctl c0306201 20000140 returned -22 [ 921.232258] binder_alloc: binder_alloc_mmap_handler: 3400 20001000-20004000 already mapped failed -16 [ 921.255419] binder: BINDER_SET_CONTEXT_MGR already set [ 921.261080] binder_alloc: 3400: binder_alloc_buf, no vma 13:35:46 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000005000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:46 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c003f00000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 921.306476] binder: undelivered TRANSACTION_COMPLETE [ 921.313167] binder: 3400:3406 ioctl 40046207 0 returned -16 [ 921.319119] binder: undelivered transaction 687, process died. [ 921.335289] binder: 3400:3407 transaction failed 29189/-3, size 0-0 line 2970 [ 921.346107] binder: undelivered TRANSACTION_ERROR: 29189 [ 921.417718] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 921.438318] FAT-fs (loop3): Filesystem has been set read-only [ 921.458016] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 921.482609] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 921.497874] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 921.526826] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 921.541292] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:47 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c002000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:47 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000003400000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:47 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3e00, 0x1000000020000) 13:35:47 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1b630000"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:47 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8100000000000000, 0x12) 13:35:47 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020600000c000000005307a33d6c390836be381b", 0x1f) 13:35:47 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000a000c000000005307a33d6c390836be381b", 0x1f) [ 921.723779] binder: 3423:3428 unknown command 25371 [ 921.729904] binder: 3423:3428 ioctl c0306201 20000140 returned -22 [ 921.740775] binder_alloc: binder_alloc_mmap_handler: 3423 20001000-20004000 already mapped failed -16 [ 921.751144] binder: BINDER_SET_CONTEXT_MGR already set [ 921.757292] binder: 3423:3432 ioctl 40046207 0 returned -16 [ 921.763211] binder_alloc: 3423: binder_alloc_buf, no vma 13:35:47 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c008001a0ffffffff00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:47 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000020000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 921.785305] binder: 3423:3433 transaction failed 29189/-3, size 0-0 line 2970 [ 921.817608] binder: 3423:3432 unknown command 25371 [ 921.846289] binder: undelivered TRANSACTION_COMPLETE [ 921.852047] binder: 3423:3432 ioctl c0306201 20000140 returned -22 [ 921.858794] binder: undelivered transaction 690, process died. 13:35:47 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000c000c000000005307a33d6c390836be381b", 0x1f) [ 921.894110] binder: undelivered TRANSACTION_ERROR: 29189 [ 921.905765] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:47 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c6309b1"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:47 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c004003000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 921.935460] FAT-fs (loop3): Filesystem has been set read-only [ 921.961113] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 921.975926] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:47 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000400000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 921.992315] device nr0 entered promiscuous mode [ 921.998617] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 922.009630] binder: 3444:3447 got transaction to invalid handle [ 922.022270] binder: 3444:3447 transaction failed 29201/-22, size 0-0 line 2855 [ 922.031279] binder: 3444:3447 unknown command -1324784884 13:35:47 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000e000c000000005307a33d6c390836be381b", 0x1f) [ 922.040707] binder: 3444:3447 ioctl c0306201 20000140 returned -22 [ 922.050416] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 922.068197] binder_alloc: binder_alloc_mmap_handler: 3444 20001000-20004000 already mapped failed -16 [ 922.079463] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 922.087214] binder: BINDER_SET_CONTEXT_MGR already set 13:35:47 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x7001, 0x1000000020000) 13:35:47 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000c0c000000005307a33d6c390836be381b", 0x1f) [ 922.092644] binder: 3444:3457 got transaction to invalid handle [ 922.102948] binder: 3444:3456 ioctl 40046207 0 returned -16 [ 922.125258] binder: 3444:3457 transaction failed 29201/-22, size 0-0 line 2855 [ 922.133745] binder: undelivered TRANSACTION_ERROR: 29201 [ 922.172041] binder: undelivered TRANSACTION_ERROR: 29201 [ 922.444461] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 922.458398] FAT-fs (loop3): Filesystem has been set read-only [ 922.470267] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 922.478288] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 922.478477] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xd00000000000000, 0x12) 13:35:48 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000003400000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:48 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000002000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:48 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000040)={{0x0, 0x1, 0x0, 0x3, 0xb52b}}) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000000080)={0x2, r1}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0c61000038fea2c8262bf535916b532d65610de77bf6306a2dde953887e8eaef035d8b8a5f6b48a9f0eeb368f94821f5d3927b23c3f158da2907f992cd22607059cdf8442b0c33051b3cbf3ca5f2e3afca0f3368ac74fe5bad11ee8b00d5eb7a9f03adb17c0d96a71bc8c1d20fd23927d64c703da5daefeb3ef7d85ce15d729de66106ca5870e6fc7976dcd3787325bab71e55029143846c96"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:48 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000e0c000000005307a33d6c390836be381b", 0x1f) 13:35:48 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xc0, 0x1000000020000) [ 922.509058] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 922.534971] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:48 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000050c000000005307a33d6c390836be381b", 0x1f) [ 922.611190] binder: 3470:3471 unknown command 24844 [ 922.626071] binder: 3470:3471 ioctl c0306201 20000140 returned -22 [ 922.640724] binder: BINDER_SET_CONTEXT_MGR already set [ 922.651483] binder: 3470:3478 ioctl 40046207 0 returned -16 13:35:48 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000060000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:48 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000500000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 922.663926] binder_alloc: 3470: binder_alloc_buf, no vma [ 922.665908] binder: 3470:3477 unknown command 24844 [ 922.674444] binder: 3470:3477 ioctl c0306201 20000140 returned -22 [ 922.700967] binder: 3470:3471 transaction failed 29189/-3, size 0-0 line 2970 13:35:48 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000070c000000005307a33d6c390836be381b", 0x1f) 13:35:48 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000090007000004000000004b44040000002c"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c850000"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x2, 0x0) write$input_event(r3, &(0x7f0000000040)={{0x77359400}, 0x12, 0x4, 0x200}, 0x18) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x18, 0x0, &(0x7f00000000c0)=[@increfs, @request_death={0x400c630e, 0x3, 0x1}], 0x40, 0x0, &(0x7f0000000180)="0edbd14ac53dc553586871bc287fb1b3c45cb803a45e8e7cd9e2410c390697a828327149f08f177a298053a6a0723c4f7761f3769358590c18bb17cdae9f3ec7"}) [ 922.734732] binder: undelivered TRANSACTION_COMPLETE [ 922.740540] binder: undelivered transaction 696, process died. [ 922.772239] device nr0 entered promiscuous mode 13:35:48 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020005000c000000005307a33d6c390836be381b", 0x1f) [ 922.851610] binder: 3493:3494 got transaction to invalid handle [ 922.888455] binder: 3493:3494 unknown command 34060 [ 922.901763] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 922.916407] binder: 3493:3494 ioctl c0306201 20000140 returned -22 [ 922.929534] FAT-fs (loop3): Filesystem has been set read-only [ 922.944252] binder_alloc: binder_alloc_mmap_handler: 3493 20001000-20004000 already mapped failed -16 [ 922.945746] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 922.964103] binder: BINDER_SET_CONTEXT_MGR already set [ 922.978568] binder: 3493:3497 ioctl 40046207 0 returned -16 [ 922.980475] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 922.992326] binder: 3493:3498 got transaction to invalid handle [ 923.005214] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 923.007749] binder: 3493:3497 unknown command 34060 [ 923.039568] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 923.042580] binder: 3493:3497 ioctl c0306201 20000140 returned -22 [ 923.053412] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x4000000, 0x12) 13:35:48 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000200000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:48 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030cfbffffff0000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:48 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xf5ffffff00000000, 0x1000000020000) 13:35:48 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020004000c000000005307a33d6c390836be381b", 0x1f) 13:35:48 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x89, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49adeb8267ea645c06ebc4867ab76758ccdff6e1dec5f2258279f618121660017ba12a064702fe32a8ea94b66185c7b9214ce88044be254d3155d3b9ce1e40ac1c8e05dd795185e3d7494c1290c80cb0500a20503880a694c4c82915e2cd3a718896a4b99d900acdc785e58a360ce0f734"], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:48 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200c00e0c000000005307a33d6c390836be381b", 0x1f) 13:35:48 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000030c000000005307a33d6c390836be381b", 0x1f) 13:35:48 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000700000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:48 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000300000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 923.427290] device nr0 entered promiscuous mode [ 923.451801] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 923.467171] FAT-fs (loop3): Filesystem has been set read-only [ 923.473504] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 923.482159] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 923.490011] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:48 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000b0c000000005307a33d6c390836be381b", 0x1f) [ 923.512835] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 923.535069] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:49 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000fffffffb000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:49 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xd, 0x12) 13:35:49 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000400e00000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:49 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x8000000000000000, 0x1000000020000) 13:35:49 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00ffffffffa0010000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:49 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020006000c000000005307a33d6c390836be381b", 0x1f) [ 924.045515] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.052884] FAT-fs (loop3): Filesystem has been set read-only [ 924.063908] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.075426] binder_alloc: binder_alloc_mmap_handler: 3502 20001000-20004000 already mapped failed -16 [ 924.082717] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.094203] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.111174] binder: BINDER_SET_CONTEXT_MGR already set [ 924.111958] device nr0 entered promiscuous mode [ 924.116727] binder_alloc: 3502: binder_alloc_buf, no vma [ 924.129552] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 924.138396] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:49 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000340000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:49 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020008000c000000005307a33d6c390836be381b", 0x1f) 13:35:49 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00fffffffb00000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:49 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000200005c49d8c1300e53c885eba3ae370b49f43b60876b8ac4f377d5196bbb1058ce7b2c631502a9b8ad5729da6415b85c751d0d4d3f3e22d46765d7642ca05926ae912dc8a4fc1f4e3d0362c8620ef85db9c938256356ba0688733dd09b7a84f95bbf0cbc534844e39de25b14d9f5b34014ac3635d922fbf0d2ec8b"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$void(r1, 0xc0045c79) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1e630000"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:49 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x40000000, 0x1000000020000) [ 924.145724] binder: 3502:3545 ioctl 40046207 0 returned -16 [ 924.152742] binder_transaction: 3 callbacks suppressed [ 924.152761] binder: 3502:3546 transaction failed 29189/-3, size -2164296502155430022-1798758701070468574 line 2970 [ 924.166743] binder_release_work: 3 callbacks suppressed [ 924.166751] binder: undelivered TRANSACTION_ERROR: 29201 [ 924.187563] binder: undelivered TRANSACTION_ERROR: 29189 13:35:49 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030ca00100000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:49 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00fbffffff00000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 924.303993] binder: 3555:3560 transaction failed 29201/-28, size -8472529426574980853-1205675083951502276 line 2970 [ 924.336097] binder: 3555:3560 ioctl c0045c79 0 returned -22 [ 924.344263] binder: 3555:3560 unknown command 25374 [ 924.356164] binder: 3555:3560 ioctl c0306201 20000140 returned -22 [ 924.451267] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.471148] FAT-fs (loop3): Filesystem has been set read-only [ 924.487608] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.506772] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.529394] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.559724] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.585423] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 924.647350] binder_alloc: binder_alloc_mmap_handler: 3555 20001000-20004000 already mapped failed -16 [ 924.660941] binder_alloc: 3555: binder_alloc_buf, no vma [ 924.672128] binder: BINDER_SET_CONTEXT_MGR already set 13:35:50 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x4888, 0x12) 13:35:50 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000600000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:50 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000300000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:50 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x700, 0x1000000020000) 13:35:50 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000f000c000000005307a33d6c390836be381b", 0x1f) [ 924.693255] binder: 3555:3560 transaction failed 29189/-3, size -8472529426574980853-1205675083951502276 line 2970 [ 924.720696] binder: 3555:3556 ioctl 40046207 0 returned -16 [ 924.741453] binder: 3555:3568 ioctl c0045c79 0 returned -22 13:35:50 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020009000c000000005307a33d6c390836be381b", 0x1f) 13:35:50 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00e000040000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 924.769344] binder: 3555:3577 unknown command 25374 [ 924.787724] binder: undelivered TRANSACTION_ERROR: 29189 [ 924.794461] binder: undelivered TRANSACTION_ERROR: 29201 [ 924.795478] binder: 3555:3577 ioctl c0306201 20000140 returned -22 13:35:50 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000300000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:50 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000040)=0x0) setpriority(0x2, r1, 0x2) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x28002, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@ipv4={[], [], @multicast2}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast2}}, &(0x7f00000002c0)=0xe8) connect$packet(r4, &(0x7f00000003c0)={0x11, 0x16, r5, 0x1, 0xb3, 0x6, @remote}, 0x14) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 924.882088] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.896300] device nr0 entered promiscuous mode [ 924.901435] FAT-fs (loop3): Filesystem has been set read-only 13:35:50 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000f0c000000005307a33d6c390836be381b", 0x1f) [ 924.924597] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 924.952314] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:50 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000003000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:50 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000001a0ffffffff00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 924.978067] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 925.010494] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 925.026085] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 925.038171] binder: undelivered transaction 708, put_user failed [ 925.051789] binder: 3592:3598 ioctl c0306201 20000140 returned -14 13:35:50 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x3, 0x12) 13:35:50 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x6000000000000, 0x1000000020000) 13:35:50 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000001a00000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:50 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000034000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:50 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020019140c000000005307a33d6c390836be381b", 0x1f) 13:35:50 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") timer_create(0x2, &(0x7f0000000000)={0x0, 0xb, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000040)=0x0) timer_delete(r1) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 925.326327] binder: BINDER_SET_CONTEXT_MGR already set [ 925.331925] binder_alloc: 3592: binder_alloc_buf, no vma [ 925.337945] binder: 3592:3593 ioctl 40046207 0 returned -16 [ 925.343782] binder: 3592:3598 transaction failed 29189/-3, size 0-0 line 2970 [ 925.353594] binder: undelivered TRANSACTION_COMPLETE [ 925.361957] binder: undelivered TRANSACTION_ERROR: 29189 13:35:50 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020003000c000000005307a33d6c390836be381b", 0x1f) [ 925.460185] binder: undelivered transaction 711, put_user failed [ 925.473193] binder: 3614:3615 ioctl c0306201 20000140 returned -14 13:35:51 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c070000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:51 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000400e000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 925.533165] binder_alloc: binder_alloc_mmap_handler: 3614 20001000-20004000 already mapped failed -16 [ 925.563468] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 925.572657] device nr0 entered promiscuous mode [ 925.579271] FAT-fs (loop3): Filesystem has been set read-only [ 925.587163] binder: BINDER_SET_CONTEXT_MGR already set [ 925.594108] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 925.605425] binder: 3614:3619 ioctl 40046207 0 returned -16 [ 925.623674] binder_alloc: 3614: binder_alloc_buf, no vma 13:35:51 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020002000c000000005307a33d6c390836be381b", 0x1f) [ 925.623712] binder: 3614:3627 transaction failed 29189/-3, size 0-0 line 2970 [ 925.641006] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 925.649998] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 925.680561] binder: undelivered TRANSACTION_COMPLETE 13:35:51 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000002000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:51 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00003f000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 925.706801] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 925.714758] binder: undelivered TRANSACTION_ERROR: 29189 [ 925.745443] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:51 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xff0f000000000000, 0x12) 13:35:51 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x1, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r3, 0x401870cc, &(0x7f0000000040)={0xcebd, 0x4, 0xfffffffffffffff9, 0x1ff}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:51 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x100e000000000000, 0x1000000020000) 13:35:51 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000001a0ffffffff000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:51 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000fffffffb00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:51 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000060c000000005307a33d6c390836be381b", 0x1f) 13:35:51 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000d0c000000005307a33d6c390836be381b", 0x1f) [ 926.172656] binder: undelivered transaction 714, put_user failed [ 926.193904] binder: 3641:3643 ioctl c0306201 20000140 returned -14 13:35:51 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000700000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 926.226307] binder: BINDER_SET_CONTEXT_MGR already set [ 926.239269] binder_alloc: 3641: binder_alloc_buf, no vma [ 926.261627] binder: 3641:3649 ioctl 40046207 0 returned -16 13:35:51 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000001000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:51 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200f0000c000000005307a33d6c390836be381b", 0x1f) [ 926.287907] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 926.295871] binder: undelivered TRANSACTION_COMPLETE [ 926.301799] binder: 3641:3650 transaction failed 29189/-3, size 0-0 line 2970 [ 926.311836] FAT-fs (loop3): Filesystem has been set read-only [ 926.322785] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 926.337014] binder: undelivered TRANSACTION_ERROR: 29189 [ 926.341602] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 926.363607] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:51 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/uinput\x00', 0x200000000000805, 0x0) write$uinput_user_dev(r3, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r3, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x1) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$UI_DEV_SETUP(r3, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:51 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c040000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 926.393553] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 926.409772] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 926.412461] device nr0 entered promiscuous mode [ 926.469013] input: syz1 as /devices/virtual/input/input20 [ 926.507955] binder: undelivered transaction 717, put_user failed [ 926.517956] binder: 3662:3663 ioctl c0306201 20000140 returned -14 [ 926.530767] input: syz1 as /devices/virtual/input/input21 [ 926.539785] binder: BINDER_SET_CONTEXT_MGR already set [ 926.545666] binder: 3662:3669 ioctl 40046207 0 returned -16 [ 926.551675] binder_alloc: 3662: binder_alloc_buf, no vma [ 926.562845] binder: 3662:3668 transaction failed 29189/-3, size 0-0 line 2970 [ 926.597151] binder: undelivered TRANSACTION_COMPLETE [ 926.785827] binder: undelivered TRANSACTION_ERROR: 29189 13:35:52 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8035000000000000, 0x12) 13:35:52 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x4000000000000, 0x1000000020000) 13:35:52 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000090c000000005307a33d6c390836be381b", 0x1f) 13:35:52 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000002000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:52 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c020000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:52 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c499d365c40d3af7ab8bfefb5f730f14f5a1d59551a9bd8a8d4dede1d1395d1c307b4808488d601857ae65a94974f4c2000d79d0d7afee712a868421d4070b44be8d02178b7523ea74b2bb14545719f07e0bb1d253b86609572de49e8e71e5aec9779bf104bc20ad953ca6a422f876b4d87564945f9386056434afa058cb0b6d307776b46bb308e4121b9d3e2562fc89455e48ed37b207789ac735580b4bff118ccfc8313a4ee8a471193ff8ad232f117c59e24c1c272a00b1fd82c07403cb6330000"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\ra'], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 926.926850] binder: 3675:3676 transaction failed 29201/-28, size 6149979039876591863-2152402676876876570 line 2970 [ 926.966015] binder: 3675:3676 unknown command 1628241920 13:35:52 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000a0c000000005307a33d6c390836be381b", 0x1f) [ 926.971533] binder: 3675:3676 ioctl c0306201 20000140 returned -22 [ 926.992034] binder_alloc: binder_alloc_mmap_handler: 3675 20001000-20004000 already mapped failed -16 13:35:52 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000003f00000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:52 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000200000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 927.045348] binder: BINDER_SET_CONTEXT_MGR already set [ 927.050689] binder: 3675:3676 ioctl 40046207 0 returned -16 [ 927.065925] binder_alloc: 3675: binder_alloc_buf, no vma [ 927.071460] binder: 3675:3683 transaction failed 29189/-3, size 6149979039876591863-2152402676876876570 line 2970 [ 927.095360] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 927.111342] binder: undelivered TRANSACTION_ERROR: 29201 [ 927.112880] FAT-fs (loop3): Filesystem has been set read-only [ 927.124242] binder: undelivered TRANSACTION_ERROR: 29189 [ 927.135861] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:52 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = fcntl$getown(r2, 0x9) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getegid() sendmsg$unix(r0, &(0x7f00000002c0)={&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000180)="6649fe8940b77428be1db99c598e309237e4bdaa5f69304a162cc4e8aa30a3f8ae5e46318afaa9611b72c4e4ee6d9c5476d80d2cb859f8535d527b121f52c13b90b1af5c521ceeaf0f56bd63748d40dc1e456817c9b6a97045ff611584d4435420e3027b54cea7c72be80b67d9fbbe3af17c3d87a56d4709bedc6664c6a97da5929e46928f8c0cfd3a8d05329e390be4", 0x90}, {&(0x7f0000000340)="30fb61c27190620ccfde22aa91eab0864a2b693d376e7fad7c318bdc78e70291e1378b601127036dbdfac602bbc09b05761ac6bd12528d5d8bc2614534f442218bb7d6a41499f7288af1c85c508cd523572a6b347e9f75010904c5b6341f0e7ae291c670c8243902baf5b49328b4dbeacf4c49424dfb5246358fc47fe364681c315aead4d723de530ae2529ed5d46e7bb679357e82eac6084d605ac22588e19c56bbc2631a7040cca59128f168282f885a6d757af5622ab5b5", 0xb9}, {&(0x7f00000004c0)="8075277a91b70f1ffb10dd332030f1c27ce11a4ea86dafb71cd8b78c846b3c447fc6eb0825bf8949c06461444b3b897577fae13134b796bca127173280009ee3744e677d24afa221ddc1424285", 0x4d}, {&(0x7f00000000c0)="0d6af25213c492b00f91913aaadd58", 0xf}, {&(0x7f0000000540)="9318c9686cd9f183574fcff5e9dd1a20322d43277dfd001808be8be3354d6251337a4f5f02e518ffe9061d9b0d244f0d480d8ccee75d1062214d72cfea00bda7cf201d5cb71cea51a6ec6c4fc0f6457541c74ec5e7f5385c7a1e908d71d50ab2604f3f4f01083465c74fc94833b2092b76fc1bbb2c1cc6eee87c77cba5c53ee0f346a7beba7135b53e196a3dd83ea10394fd2b32d22288fec3f70dbb323b36640a3c002c", 0xa4}], 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="20000000000000000100000002000000", @ANYRES32=r3, @ANYRES32=r4, @ANYRES32=r5, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000042000000000000000010100001f00e2ff", @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r0], 0x60, 0x4004080}, 0x20040814) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000800000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) open(&(0x7f0000000400)='./file0\x00', 0x6040, 0x14) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\fc\x00\x00'], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:52 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000100000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:52 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000f00c000000005307a33d6c390836be381b", 0x1f) [ 927.147871] device nr0 entered promiscuous mode [ 927.153592] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 927.185347] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 927.243912] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 927.256942] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 927.304614] binder: 3695:3701 got transaction to invalid handle [ 927.320240] binder: 3695:3701 transaction failed 29201/-22, size 0-0 line 2855 [ 927.346488] audit: type=1800 audit(1539092152.810:410): pid=3701 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor2" name="file0" dev="sda1" ino=16559 res=0 13:35:53 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x89060000, 0x12) 13:35:53 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000070000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:53 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xe000000000000, 0x1000000020000) 13:35:53 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000500000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:53 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000b000c000000005307a33d6c390836be381b", 0x1f) 13:35:53 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000d000c000000005307a33d6c390836be381b", 0x1f) 13:35:53 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000500000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:53 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000000003f000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 927.794861] device nr0 entered promiscuous mode 13:35:53 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020014190c000000005307a33d6c390836be381b", 0x1f) [ 927.829863] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 927.839671] FAT-fs (loop3): Filesystem has been set read-only [ 927.847724] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 927.859727] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 927.875412] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 927.907488] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 927.925275] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 928.062068] binder: 3695:3727 got transaction to invalid handle [ 928.062117] binder: BINDER_SET_CONTEXT_MGR already set [ 928.081478] binder: 3695:3726 ioctl 40046207 0 returned -16 [ 928.088026] audit: type=1800 audit(1539092153.550:411): pid=3725 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor2" name="file0" dev="sda1" ino=16559 res=0 13:35:53 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:53 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000c4ce39f81e000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:53 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000003f00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:53 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xff0f0000, 0x12) 13:35:53 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xffffffffffffff7f, 0x1000000020000) 13:35:53 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020007000c000000005307a33d6c390836be381b", 0x1f) [ 928.259442] binder: undelivered transaction 726, put_user failed [ 928.286668] binder: 3732:3733 ioctl c0306201 20000140 returned -14 [ 928.310651] binder_alloc: binder_alloc_mmap_handler: 3732 20001000-20004000 already mapped failed -16 [ 928.331072] binder: BINDER_SET_CONTEXT_MGR already set [ 928.345188] binder: 3732:3733 ioctl 40046207 0 returned -16 13:35:53 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000004000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:53 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000c77b6d859100000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:53 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff02000ec00c000000005307a33d6c390836be381b", 0x1f) [ 928.362482] binder_alloc: 3732: binder_alloc_buf, no vma 13:35:53 executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 928.394487] device nr0 entered promiscuous mode [ 928.399801] binder: undelivered TRANSACTION_COMPLETE 13:35:53 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000810c000000005307a33d6c390836be381b", 0x1f) 13:35:53 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000020000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:53 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000007fffffff00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 928.544746] binder: undelivered transaction 729, put_user failed [ 928.560270] binder: 3752:3758 ioctl c0306201 20000140 returned -14 [ 928.620498] binder_alloc: binder_alloc_mmap_handler: 3752 20001000-20004000 already mapped failed -16 [ 928.632975] binder: BINDER_SET_CONTEXT_MGR already set [ 928.639936] binder_alloc: 3752: binder_alloc_buf, no vma [ 928.655268] binder: 3752:3753 ioctl 40046207 0 returned -16 13:35:54 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000005000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 928.673787] binder: undelivered TRANSACTION_COMPLETE 13:35:54 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030cffffffffa001800000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:54 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x4, 0x12) 13:35:54 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3d000000, 0x1000000020000) 13:35:54 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010e700d501002000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:54 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000200000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:54 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000080c000000005307a33d6c390836be381b", 0x1f) 13:35:54 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000200000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:54 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000030c000000005307a33d6c390836be381b", 0x1f) [ 929.190405] device nr0 entered promiscuous mode [ 929.208209] binder: undelivered transaction 732, put_user failed [ 929.214792] binder: 3774:3776 ioctl c0306201 20000140 returned -14 [ 929.229007] binder_alloc: binder_alloc_mmap_handler: 3774 20001000-20004000 already mapped failed -16 13:35:54 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030cffffffffa001000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 929.243869] binder: BINDER_SET_CONTEXT_MGR already set [ 929.252815] binder: 3774:3776 ioctl 40046207 0 returned -16 [ 929.265702] binder_alloc: 3774: binder_alloc_buf, no vma 13:35:54 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000600000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 929.294228] binder_transaction: 3 callbacks suppressed [ 929.294245] binder: 3774:3783 transaction failed 29189/-3, size 0-0 line 2970 [ 929.294626] binder: undelivered TRANSACTION_COMPLETE [ 929.325932] binder_release_work: 4 callbacks suppressed [ 929.325939] binder: undelivered TRANSACTION_ERROR: 29189 13:35:54 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x1, 0x10, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:54 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c008001a00000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:54 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000600000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 929.489357] binder: 3795:3799 unknown command 0 [ 929.494128] binder: 3795:3799 ioctl c0306201 20000140 returned -22 [ 929.697860] binder: BINDER_SET_CONTEXT_MGR already set [ 929.703205] binder: 3795:3796 ioctl 40046207 0 returned -16 [ 929.720739] binder: 3795:3799 unknown command 0 [ 929.727458] binder_alloc: 3795: binder_alloc_buf, no vma [ 929.733991] binder: 3795:3799 ioctl c0306201 20000140 returned -22 13:35:55 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x608, 0x12) [ 929.747724] binder: 3795:3796 transaction failed 29189/-3, size 0-0 line 2970 [ 929.755948] binder: undelivered TRANSACTION_COMPLETE [ 929.762306] binder: undelivered TRANSACTION_ERROR: 29189 [ 929.773678] binder: undelivered transaction 735, process died. [ 929.894287] device nr0 entered promiscuous mode 13:35:55 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x39000000, 0x1000000020000) 13:35:55 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x1f) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:55 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000050000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:55 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000003000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:55 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000f000000005307a33d6c390836be381b", 0x1f) [ 930.233122] binder: undelivered transaction 738, put_user failed [ 930.249814] binder: 3812:3814 ioctl c0306201 20000140 returned -14 13:35:55 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000700000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:55 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000e0c000000005307a33d6c390836be381b", 0x1f) 13:35:55 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c91856d7bc700000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:55 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x100000000000000, 0x12) [ 930.316263] binder_alloc: binder_alloc_mmap_handler: 3812 20001000-20004000 already mapped failed -16 13:35:55 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000020c000000005307a33d6c390836be381b", 0x1f) [ 930.373330] binder: BINDER_SET_CONTEXT_MGR already set [ 930.384160] binder: 3812:3817 ioctl 40046207 0 returned -16 [ 930.390914] binder_alloc: 3812: binder_alloc_buf, no vma [ 930.396620] binder: 3812:3831 transaction failed 29189/-3, size 0-0 line 2970 [ 930.408840] binder: undelivered TRANSACTION_COMPLETE [ 930.416236] binder: undelivered TRANSACTION_ERROR: 29189 13:35:55 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:55 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000000400e0000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 930.547730] device nr0 entered promiscuous mode [ 930.557969] binder: 3838:3839 got transaction to context manager from process owning it [ 930.592191] binder: 3838:3839 transaction failed 29201/-22, size 0-0 line 2846 [ 930.609594] binder_alloc: binder_alloc_mmap_handler: 3838 20001000-20004000 already mapped failed -16 [ 930.636521] binder: BINDER_SET_CONTEXT_MGR already set [ 930.648068] binder: 3838:3839 ioctl 40046207 0 returned -16 [ 930.660675] binder_alloc: 3838: binder_alloc_buf, no vma [ 930.671246] binder: 3838:3843 transaction failed 29189/-3, size 0-0 line 2970 [ 930.688699] binder: undelivered TRANSACTION_ERROR: 29201 [ 930.696184] binder: undelivered TRANSACTION_ERROR: 29189 13:35:56 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x4000, 0x1000000020000) 13:35:56 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030ce00004000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:56 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000006000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:56 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000a0c000000005307a33d6c390836be381b", 0x1f) 13:35:56 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x3, &(0x7f0000000040)="153f0cda3cb24a00007fac19ce84b56234488dd25d760d70") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x2a, 0xfffffdfd, &(0x7f0000000000)="f69fd5a9d572e449a27c78cb818adaae9b7711fac29f732d7dcbcef7e1d1970000000000000000000000"}) 13:35:56 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x1a0, 0x12) 13:35:56 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000b0c000000005307a33d6c390836be381b", 0x1f) [ 931.202311] binder: undelivered transaction 744, put_user failed [ 931.215648] binder: 3850:3852 ioctl c0306201 20000140 returned -14 [ 931.230183] binder_alloc: binder_alloc_mmap_handler: 3850 20001000-20004000 already mapped failed -16 [ 931.246902] binder: BINDER_SET_CONTEXT_MGR already set 13:35:56 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000010000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:56 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00a001000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 931.263237] binder: 3850:3852 ioctl 40046207 0 returned -16 [ 931.263463] binder_alloc: 3850: binder_alloc_buf, no vma [ 931.288710] binder: 3850:3856 transaction failed 29189/-3, size 0-0 line 2970 [ 931.306740] binder: undelivered TRANSACTION_COMPLETE 13:35:56 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x200, 0x0) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 931.335206] binder: undelivered TRANSACTION_ERROR: 29189 [ 931.393926] device nr0 entered promiscuous mode 13:35:56 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000700000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:56 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000050c000000005307a33d6c390836be381b", 0x1f) [ 931.446243] binder: undelivered transaction 747, put_user failed [ 931.464971] binder: 3868:3869 ioctl c0306201 20000140 returned -14 [ 931.488414] binder: BINDER_SET_CONTEXT_MGR already set [ 931.514020] binder: 3868:3872 ioctl 40046207 0 returned -16 [ 931.527332] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 931.534589] binder_alloc: 3868: binder_alloc_buf, no vma [ 931.534694] binder: undelivered TRANSACTION_COMPLETE [ 931.543646] binder: 3868:3869 transaction failed 29189/-3, size 0-0 line 2970 [ 931.565273] binder: undelivered TRANSACTION_ERROR: 29189 [ 931.575651] FAT-fs (loop3): Filesystem has been set read-only [ 931.590220] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 931.607243] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 931.635688] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 931.662879] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 931.687329] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:57 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x600, 0x1000000020000) 13:35:57 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000300000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:57 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000070c000000005307a33d6c390836be381b", 0x1f) 13:35:57 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x800) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x6083e036, 0x107000) ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af21, &(0x7f00000000c0)={0x2}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x47, 0x0, &(0x7f0000000600)=ANY=[@ANYRESOCT=r1, @ANYRESDEC, @ANYRESDEC=r0, @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYRESDEC=r1, @ANYRES16, @ANYBLOB="13f8d40df27b887f2b101614478c8f0bf720cd5f38825cb1f22df2d81cb565e1195a06676642321d4eab92f8fc64ad9317d33d3d48c6e5ba1d08b103a8115769cc3e8106d481123d80ad14a9ea673173d75584126a73a1499bdb7a77570adf52e40af6c98fc1d59bb53005a1e4792882"]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40020}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0xa0, r4, 0x101, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@ipv4={[], [], @rand_addr=0x8001}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x31}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5b}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x40041}, 0x40040) 13:35:57 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030ca00180000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 931.887853] binder: 3880:3881 unknown command 808464432 [ 931.900724] binder: 3880:3881 ioctl c0306201 20000240 returned -22 13:35:57 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x2000000, 0x12) 13:35:57 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000003f000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:57 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c7fffffff0000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:57 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000060c000000005307a33d6c390836be381b", 0x1f) [ 931.992467] binder: BINDER_SET_CONTEXT_MGR already set [ 931.992488] binder: 3880:3897 unknown command 808464432 [ 932.005912] binder: 3880:3885 ioctl 40046207 0 returned -16 [ 932.015472] binder: 3880:3897 ioctl c0306201 20000240 returned -22 [ 932.017250] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 932.029459] FAT-fs (loop3): Filesystem has been set read-only 13:35:57 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000c0c000000005307a33d6c390836be381b", 0x1f) 13:35:57 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) r3 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x7fff, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) 13:35:57 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000600000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 932.047633] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 932.076995] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 932.105681] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 932.132473] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 932.146762] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:57 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3b, 0x1000000020000) 13:35:57 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000034000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 932.158326] device nr0 entered promiscuous mode 13:35:57 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000009000000005307a33d6c390836be381b", 0x1f) [ 932.197586] binder: undelivered transaction 751, put_user failed [ 932.203844] binder: 3902:3904 ioctl c0306201 20000140 returned -14 [ 932.229588] binder_alloc: binder_alloc_mmap_handler: 3902 20001000-20004000 already mapped failed -16 13:35:57 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000040000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 932.257526] binder: BINDER_SET_CONTEXT_MGR already set [ 932.262862] binder: 3902:3904 ioctl 40046207 0 returned -16 [ 932.274836] binder_alloc: 3902: binder_alloc_buf, no vma [ 932.282501] binder: 3902:3910 transaction failed 29189/-3, size 0-0 line 2970 13:35:57 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000002000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 932.306559] binder: undelivered TRANSACTION_COMPLETE [ 932.315525] binder: undelivered TRANSACTION_ERROR: 29189 [ 932.486113] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 932.510552] FAT-fs (loop3): Filesystem has been set read-only [ 932.525762] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 932.569981] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 932.584027] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:58 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xe80, 0x12) 13:35:58 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000090c000000005307a33d6c390836be381b", 0x1f) 13:35:58 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = memfd_create(&(0x7f0000000000)='/dev/binder#\x00', 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {r4, 0xe9}}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000e6ffffff0f00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$IOC_PR_CLEAR(r3, 0x401070cd, &(0x7f00000001c0)={0x7}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:58 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030cfffffffb0000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:58 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000003f0000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:58 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000d0c000000005307a33d6c390836be381b", 0x1f) [ 932.743517] binder: 3922:3923 got transaction to invalid handle [ 932.768012] binder: 3922:3923 transaction failed 29201/-22, size 0-0 line 2855 13:35:58 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000020000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 932.911011] device nr0 entered promiscuous mode [ 932.921247] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000001) 13:35:58 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3f00000000000000, 0x1000000020000) 13:35:58 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000050002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:58 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000040c000000005307a33d6c390836be381b", 0x1f) 13:35:58 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c030000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 932.956108] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000001) [ 932.963538] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000001) 13:35:58 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000001a0ffffffff0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 933.270694] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 933.303052] FAT-fs (loop3): Filesystem has been set read-only [ 933.318225] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 933.336315] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 933.352736] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 933.374392] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 933.392990] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:58 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x88480000, 0x12) 13:35:58 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000500000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 933.520994] binder_alloc: binder_alloc_mmap_handler: 3922 20001000-20004000 already mapped failed -16 [ 933.537325] binder: BINDER_SET_CONTEXT_MGR already set [ 933.542870] binder: 3922:3957 ioctl 40046207 0 returned -16 [ 933.557239] binder: 3922:3932 got transaction to invalid handle 13:35:59 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0a010015ad907e400000003867eb00"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:59 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000c4ce39f81e0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:59 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xa000000000000, 0x1000000020000) 13:35:59 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000f0c000000005307a33d6c390836be381b", 0x1f) 13:35:59 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000300000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 933.571454] binder: undelivered TRANSACTION_ERROR: 29201 [ 933.577794] binder: 3922:3932 transaction failed 29201/-22, size 0-0 line 2855 [ 933.586814] binder: undelivered TRANSACTION_ERROR: 29201 [ 933.601160] device nr0 entered promiscuous mode 13:35:59 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000009000000005307a33d6c390836be381b", 0x1f) 13:35:59 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000007000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 933.739934] binder: 3969:3974 unknown command 352321802 [ 933.764126] binder: 3969:3974 ioctl c0306201 20000440 returned -22 13:35:59 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000003400000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 933.784255] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 933.812237] FAT-fs (loop3): Filesystem has been set read-only [ 933.821060] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 933.839116] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 933.852365] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:59 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000006000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:59 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000400000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 933.888948] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 933.918205] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:35:59 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000070000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:59 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xa00e0000, 0x1000000020000) [ 934.131741] binder_alloc: binder_alloc_mmap_handler: 3969 20001000-20004000 already mapped failed -16 [ 934.156049] binder: BINDER_SET_CONTEXT_MGR already set [ 934.156083] binder: 3969:3974 unknown command 352321802 [ 934.164706] binder: 3969:3970 ioctl 40046207 0 returned -16 [ 934.174005] binder: 3969:3974 ioctl c0306201 20000440 returned -22 13:35:59 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) accept(r0, 0x0, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0c630000592b4fe18022aa849b03069073ed4f0ca56dd2fe83af82be4ec6f84d6c9129a7bd7cab4d535aa4ef57ea2f5ff02ec6324d504c519eb238bb15fe4a26c1e482123dfc0e1b61201190f0454d94b7c3b8a23eb664dc7dceb832ec8b711af3388ea673a1a1be3340e2c5dff7f48b1f93eed0fade"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:35:59 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000500000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:59 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8848, 0x12) 13:35:59 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000f000000005307a33d6c390836be381b", 0x1f) 13:35:59 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000075307a33d6c390836be381b", 0x1f) 13:35:59 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000fbffffff000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 934.313787] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 934.321104] FAT-fs (loop3): Filesystem has been set read-only [ 934.327681] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 934.335788] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) [ 934.346617] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c7) 13:35:59 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00ffffffffa0010000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 934.363169] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 934.389941] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 934.402260] device nr0 entered promiscuous mode 13:35:59 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xff0f, 0x1000000020000) 13:35:59 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000cfffffff05307a33d6c390836be381b", 0x1f) 13:35:59 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00007fffffff000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:35:59 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000000400e0000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:00 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000001000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 934.700303] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 934.715254] FAT-fs (loop3): Filesystem has been set read-only [ 934.737156] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 934.755828] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 934.772260] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 934.801184] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 934.831350] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:00 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000f20f00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0xffffffffffffff93, 0x0, &(0x7f0000000040)=[@acquire={0x40046305, 0x4}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:00 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000001000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:00 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00ffffffffa0018000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:00 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000085307a33d6c390836be381b", 0x1f) 13:36:00 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3400000000000000, 0x1000000020000) 13:36:00 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xd000000, 0x12) [ 935.065928] binder_alloc: binder_alloc_mmap_handler: 3996 20001000-20004000 already mapped failed -16 [ 935.076244] binder_transaction: 1 callbacks suppressed [ 935.076259] binder: 3996:4023 transaction failed 29189/-22, size 0-0 line 2855 [ 935.076292] binder: BINDER_SET_CONTEXT_MGR already set [ 935.082429] binder: undelivered TRANSACTION_ERROR: 29189 [ 935.100685] binder: undelivered TRANSACTION_ERROR: 29189 [ 935.106298] binder: 3996:4022 ioctl 40046207 0 returned -16 13:36:00 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0c0000005307a33d6c390836be381b", 0x1f) 13:36:00 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000700000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:00 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000004000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 935.303332] device nr0 entered promiscuous mode 13:36:00 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c090000005307a33d6c390836be381b", 0x1f) [ 935.337932] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 935.357667] FAT-fs (loop3): Filesystem has been set read-only [ 935.379562] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 935.405414] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 935.420795] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:00 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000040030000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:00 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000fffffffb000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 935.490788] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 935.522305] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 935.989871] binder_alloc: binder_alloc_mmap_handler: 4036 20003000-20005000 already mapped failed -16 [ 936.000243] binder: BINDER_SET_CONTEXT_MGR already set [ 936.005709] binder: 4036:4054 ioctl 40046207 0 returned -16 [ 936.011528] binder_alloc: 4036: binder_alloc_buf, no vma [ 936.017122] binder: 4036:4055 transaction failed 29189/-3, size 0-0 line 2970 [ 936.024861] binder: undelivered TRANSACTION_COMPLETE [ 936.032533] binder: undelivered TRANSACTION_ERROR: 29189 13:36:01 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x372, 0x0, &(0x7f0000000080), 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:01 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x1000000000000000, 0x1000000020000) 13:36:01 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000002000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:01 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000ffffffffa00100000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:01 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000900005307a33d6c390836be381b", 0x1f) 13:36:01 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8847, 0x12) [ 936.038077] binder: undelivered transaction 761, process died. 13:36:01 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000340005307a33d6c390836be381b", 0x1f) [ 936.125000] binder: 4067:4068 unknown command 0 [ 936.144345] binder: 4067:4068 ioctl c0306201 20000140 returned -22 13:36:01 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000c77b6d8591000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 936.169397] binder_alloc: binder_alloc_mmap_handler: 4067 20001000-20004000 already mapped failed -16 13:36:01 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000006000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 936.209995] binder: BINDER_SET_CONTEXT_MGR already set [ 936.212775] device nr0 entered promiscuous mode [ 936.227902] binder: 4067:4069 ioctl 40046207 0 returned -16 [ 936.237333] binder_alloc: 4067: binder_alloc_buf, no vma [ 936.242850] binder: 4067:4070 transaction failed 29189/-3, size 0-0 line 2970 13:36:01 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000e5307a33d6c390836be381b", 0x1f) [ 936.262546] binder: 4067:4068 unknown command 0 [ 936.278218] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 936.289386] binder: undelivered TRANSACTION_COMPLETE [ 936.295527] binder: undelivered TRANSACTION_ERROR: 29189 [ 936.301304] FAT-fs (loop3): Filesystem has been set read-only [ 936.307514] binder: 4067:4068 ioctl c0306201 20000140 returned -22 [ 936.314226] binder: undelivered transaction 764, process died. [ 936.320672] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 936.328807] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 936.336326] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:01 executing program 2: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x6, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f00000001c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e24, 0xb4, @empty, 0x1}, r2}}, 0x30) r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:01 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000004000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:01 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000ca00100005307a33d6c390836be381b", 0x1f) [ 936.364805] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 936.379781] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:01 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x600000000000000, 0x1000000020000) 13:36:01 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000040002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:01 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000007fffffff000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 936.462781] binder_alloc: 4084: binder_alloc_buf, no vma [ 936.476523] binder: 4084:4092 transaction failed 29189/-3, size 0-0 line 2970 13:36:02 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000070002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 936.666701] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 936.697619] FAT-fs (loop3): Filesystem has been set read-only [ 936.719931] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 936.735993] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 936.755358] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 936.792089] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 936.799633] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:02 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8001a0ffffffff, 0x12) 13:36:02 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000400e000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:02 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000010002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:02 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000025307a33d6c390836be381b", 0x1f) 13:36:02 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3700000000000000, 0x1000000020000) [ 936.992511] device nr0 entered promiscuous mode [ 937.039973] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 937.047234] FAT-fs (loop3): Filesystem has been set read-only [ 937.053309] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 937.069344] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 937.076838] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 937.091633] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 937.099219] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 937.263194] binder: BINDER_SET_CONTEXT_MGR already set [ 937.276157] binder_alloc: 4084: binder_alloc_buf, no vma [ 937.281738] binder: 4084:4118 ioctl 40046207 0 returned -16 [ 937.294317] binder: 4084:4119 transaction failed 29189/-3, size 0-0 line 2970 13:36:02 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000580)='/dev/snd/pcmC#D#p\x00', 0x612, 0x20000) setsockopt$netlink_NETLINK_CAP_ACK(r3, 0x10e, 0xa, &(0x7f0000000240)=0x5, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x82, 0x102) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000180)={0x0, 0xa8, "d61706efd56f303fb8bac5a4f2a3593d6f34ac83dd010e3a316ef373552e7fef22a122308850c17f75a57568a8627c715f1791ab6256b557061298619cb17ed270c8b31f5f9b59a3129cb962fd2bcf8366cf78ce233761c2cef754ac97add4589c03e717a31f17cddcecc122af110573081d1a03c1f3d66cba75e97ad240e84d959dd2eb77dc539fa38c4dedf1dfbced6e1d325ebf2c17ebbe9f55cd67f1cb16d899b1986799bb9e"}, &(0x7f0000000040)=0xb0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000340)={r5, @in6={{0xa, 0x4e22, 0x8, @remote, 0x6}}, 0x10000, 0x4, 0x9, 0x2, 0xd}, 0x98) syz_open_dev$sndpcmc(&(0x7f00000002c0)='/dev/snd/pcmC#D#c\x00', 0x100000001, 0x2400) write$P9_RREAD(r2, &(0x7f00000004c0)={0xb9, 0x75, 0x1, {0xae, "e1b3b451b099b11e7bcd20bcefc7b876922190b8b61083cd6223f29b4d506ba3a1e7d954236b6094c5c61a6f18abf46a24f0aa89c0d35fbb99160d84582fd8f5676c7cfe3d024342194006cc0a5d38214ba032d53b946064954340c92105d1f042241f732ffcf401257a50989dbc4c51cd26aef0eda44388bf5403f9f3b18879cdeb7ab5499f6c91675cf0eff074b36c97313611f498dad2f11ba735561c8c6b95f32161248b5bc0f968a5a702e5"}}, 0xb9) 13:36:02 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00f000005307a33d6c390836be381b", 0x1f) 13:36:02 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000001a0000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:02 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000500000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:02 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xc000000000000000, 0x1000000020000) [ 937.309806] binder: undelivered TRANSACTION_ERROR: 29189 [ 937.316530] binder: undelivered TRANSACTION_ERROR: 29189 13:36:02 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000c00005307a33d6c390836be381b", 0x1f) [ 937.390874] binder: undelivered transaction 770, put_user failed [ 937.402288] binder: 4121:4124 ioctl c0306201 20000140 returned -14 [ 937.417317] binder_alloc: binder_alloc_mmap_handler: 4121 20001000-20004000 already mapped failed -16 [ 937.430614] binder: BINDER_SET_CONTEXT_MGR already set 13:36:02 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xffffdd86, 0x12) [ 937.436827] binder: 4121:4124 ioctl 40046207 0 returned -16 13:36:02 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000002000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:02 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000003000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 937.467266] binder_alloc: 4121: binder_alloc_buf, no vma [ 937.473079] binder: 4121:4133 transaction failed 29189/-3, size 0-0 line 2970 13:36:02 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c008100005307a33d6c390836be381b", 0x1f) 13:36:03 executing program 2: pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x9) r1 = socket$inet6(0xa, 0x6, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x4000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000900000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c63159c"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 937.532639] binder: undelivered TRANSACTION_COMPLETE [ 937.540999] binder: undelivered TRANSACTION_ERROR: 29189 13:36:03 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000600000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:03 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c008001a05307a33d6c390836be381b", 0x1f) 13:36:03 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000200000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:03 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c004003005307a33d6c390836be381b", 0x1f) [ 937.658020] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 937.666051] device nr0 entered promiscuous mode [ 937.669426] FAT-fs (loop3): Filesystem has been set read-only [ 937.693170] binder: 4146:4147 unknown command -1676319988 [ 937.696933] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 937.724272] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 937.726693] binder: 4146:4147 ioctl c0306201 20000140 returned -22 [ 937.740917] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:03 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000005000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 937.766455] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 937.791888] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 937.804226] binder_alloc: binder_alloc_mmap_handler: 4146 20001000-20004000 already mapped failed -16 13:36:03 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x6000000, 0x1000000020000) 13:36:03 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000003000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 937.865958] binder: BINDER_SET_CONTEXT_MGR already set [ 937.886451] binder: 4146:4162 ioctl 40046207 0 returned -16 [ 937.901313] binder: 4146:4159 unknown command -1676319988 [ 937.901358] binder_alloc: 4146: binder_alloc_buf, no vma [ 937.914776] binder: 4146:4159 ioctl c0306201 20000140 returned -22 [ 937.929583] binder: undelivered TRANSACTION_COMPLETE [ 937.935966] binder: undelivered transaction 773, process died. [ 937.970655] binder: 4146:4158 transaction failed 29189/-3, size 0-0 line 2970 [ 938.005554] binder: undelivered TRANSACTION_ERROR: 29189 [ 938.077976] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 938.100925] FAT-fs (loop3): Filesystem has been set read-only [ 938.117199] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 938.142976] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 938.175364] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:03 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x88caffff00000000, 0x12) 13:36:03 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00003f000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:03 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000400300000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:03 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat6\x00') unlinkat(r1, &(0x7f0000000040)='./file0\x00', 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) getsockname(r0, &(0x7f0000001780)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000400)=0x80) ioctl$PPPIOCSMRU(r4, 0x40047452, &(0x7f0000001800)=0x9) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:03 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000035307a33d6c390836be381b", 0x1f) [ 938.207808] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 938.217504] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:03 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xa00e, 0x1000000020000) 13:36:03 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000b00005307a33d6c390836be381b", 0x1f) [ 938.257285] binder: 4172:4174 transaction failed 29189/-22, size 0-0 line 2855 13:36:03 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000020002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:03 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000001a000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:03 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00f0ffff5307a33d6c390836be381b", 0x1f) [ 938.404109] device nr0 entered promiscuous mode 13:36:03 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000f5307a33d6c390836be381b", 0x1f) 13:36:04 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000003f00000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 938.578553] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 938.591323] FAT-fs (loop3): Filesystem has been set read-only [ 938.598650] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 938.606970] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 938.614474] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 938.631701] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 938.639719] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:04 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x80350000, 0x12) 13:36:04 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000200002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:04 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000020000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 939.042948] binder_alloc: binder_alloc_mmap_handler: 4172 20001000-20004000 already mapped failed -16 [ 939.055552] binder: BINDER_SET_CONTEXT_MGR already set [ 939.061088] binder: 4172:4207 transaction failed 29189/-22, size 0-0 line 2855 13:36:04 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:04 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3d00, 0x1000000020000) 13:36:04 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000ec05307a33d6c390836be381b", 0x1f) 13:36:04 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000007000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:04 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000a0010000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 939.093620] binder: 4172:4206 ioctl 40046207 0 returned -16 [ 939.118037] binder: undelivered TRANSACTION_ERROR: 29189 [ 939.124898] binder: undelivered TRANSACTION_ERROR: 29189 [ 939.124970] device nr0 entered promiscuous mode 13:36:04 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000700005307a33d6c390836be381b", 0x1f) [ 939.215013] binder: 4223:4224 got transaction to context manager from process owning it [ 939.224267] binder: 4223:4224 transaction failed 29201/-22, size 0-0 line 2846 [ 939.236736] binder_alloc: binder_alloc_mmap_handler: 4223 20001000-20004000 already mapped failed -16 [ 939.246549] binder: BINDER_SET_CONTEXT_MGR already set [ 939.255100] binder: 4223:4226 ioctl 40046207 0 returned -16 13:36:04 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000005000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 939.255627] binder_alloc: 4223: binder_alloc_buf, no vma 13:36:04 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000020000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 939.322882] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.345217] FAT-fs (loop3): Filesystem has been set read-only [ 939.351594] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.361717] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.369731] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.386762] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 939.394648] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:04 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x6, 0x1000000020000) 13:36:05 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x300, 0x12) 13:36:05 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00001ef839cec40000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:05 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00fffffffb00000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:05 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0e0000005307a33d6c390836be381b", 0x1f) 13:36:05 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=@srh={0x3a, 0x2, 0x4, 0x1, 0x8, 0x30, 0x5, [@mcast1]}, 0x18) [ 939.688993] binder: undelivered transaction 782, put_user failed [ 939.705415] binder: 4239:4240 ioctl c0306201 20000140 returned -14 13:36:05 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000014195307a33d6c390836be381b", 0x1f) [ 939.730421] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.735792] binder_alloc: binder_alloc_mmap_handler: 4239 20001000-20004000 already mapped failed -16 [ 939.755427] binder: BINDER_SET_CONTEXT_MGR already set [ 939.760745] binder: 4239:4240 ioctl 40046207 0 returned -16 [ 939.767793] FAT-fs (loop3): Filesystem has been set read-only [ 939.782029] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.785231] binder_alloc: 4239: binder_alloc_buf, no vma [ 939.792045] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.795694] binder: undelivered TRANSACTION_COMPLETE [ 939.804194] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:05 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00a001800000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:05 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000002000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:05 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c020000005307a33d6c390836be381b", 0x1f) 13:36:05 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00404000000000007c8e1000000001000300020000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) poll(&(0x7f0000000000)=[{r1, 0x2488}, {r0, 0x8}, {r0, 0x20}, {r2, 0x30}, {r1, 0x80}, {r1, 0x100}, {r0, 0x2003}, {r0}, {r1, 0x1003}, {r2}], 0xa, 0x401) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 939.836247] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.853524] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.892879] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.921317] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.936874] device nr0 entered promiscuous mode [ 939.951649] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 939.967810] binder: 4258:4260 unknown command 4210688 13:36:05 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000045307a33d6c390836be381b", 0x1f) [ 939.991931] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 940.000504] binder: 4258:4260 ioctl c0306201 20000440 returned -22 13:36:05 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x400000000000000, 0x1000000020000) [ 940.303757] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 940.317937] FAT-fs (loop3): Filesystem has been set read-only [ 940.325865] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 940.356421] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 940.368803] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:05 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8, 0x12) 13:36:05 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c007fffffff00000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:05 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000cf00000005307a33d6c390836be381b", 0x1f) 13:36:05 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000fffffffb0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:05 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x70010000, 0x1000000020000) [ 940.400061] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 940.407316] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:05 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0b0000005307a33d6c390836be381b", 0x1f) 13:36:06 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000055307a33d6c390836be381b", 0x1f) 13:36:06 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000030002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:06 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000200000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 940.587455] device nr0 entered promiscuous mode [ 940.683531] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 940.699765] FAT-fs (loop3): Filesystem has been set read-only [ 940.713979] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 940.738697] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 940.750205] binder_alloc: binder_alloc_mmap_handler: 4258 20001000-20004000 already mapped failed -16 [ 940.767964] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 940.795345] binder: BINDER_SET_CONTEXT_MGR already set [ 940.803927] binder: 4258:4296 unknown command 4210688 [ 940.808630] binder: 4258:4295 ioctl 40046207 0 returned -16 [ 940.810060] binder: 4258:4296 ioctl c0306201 20000440 returned -22 [ 940.823086] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 940.823167] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:06 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x7f, 0x100) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r3, 0x4008ae48, &(0x7f0000000040)=0x107006) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:06 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000500005307a33d6c390836be381b", 0x1f) 13:36:06 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000300000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:06 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x806000000000000, 0x12) 13:36:06 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000005000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:06 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c9effffff5307a33d6c390836be381b", 0x1f) 13:36:06 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x50000000, 0x1000000020000) [ 941.047244] binder: undelivered transaction 786, put_user failed [ 941.060668] binder: 4303:4304 ioctl c0306201 20000140 returned -14 [ 941.070896] binder_alloc: binder_alloc_mmap_handler: 4303 20001000-20004000 already mapped failed -16 [ 941.081326] binder: BINDER_SET_CONTEXT_MGR already set [ 941.087705] binder: 4303:4304 ioctl 40046207 0 returned -16 [ 941.100494] binder_alloc: 4303: binder_alloc_buf, no vma [ 941.110092] binder_transaction: 2 callbacks suppressed [ 941.110110] binder: 4303:4305 transaction failed 29189/-3, size 0-0 line 2970 [ 941.124634] binder: undelivered TRANSACTION_COMPLETE [ 941.135787] binder_release_work: 3 callbacks suppressed [ 941.135794] binder: undelivered TRANSACTION_ERROR: 29189 13:36:06 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000006000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:06 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000015307a33d6c390836be381b", 0x1f) 13:36:06 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000e0000400000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:06 executing program 2: bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={0xffffffffffffff9c, 0x50, &(0x7f0000000180)}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000240)={0xffffffffffffff9c, 0x50, &(0x7f0000000340)}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000003c0)={0x0, 0xffffffffffffffff, 0x0, 0x28, &(0x7f00000002c0)="6e6f646576776c616e3076626f786e6574316d696d655f7479706546766d6e65743065746830e700", 0xffffffffffffffff}, 0x30) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)=r0, 0x4) getitimer(0x0, &(0x7f00000004c0)) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000000c0)) r2 = socket$inet6(0xa, 0x6, 0x0) ioctl(r1, 0x2, &(0x7f0000000280)="153f6234488dd25d766070") r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000100100000100000000000000be4a"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0bffe100"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f0000000000)=@generic={0x2, 0x200, 0x1}) r5 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0x11) inotify_rm_watch(r2, r5) 13:36:06 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000003000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:06 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c191400005307a33d6c390836be381b", 0x1f) [ 941.267458] binder: 4320:4321 unknown command 14810891 [ 941.278527] binder: 4320:4321 ioctl c0306201 20000140 returned -22 [ 941.287662] device nr0 entered promiscuous mode [ 941.295637] binder_alloc: binder_alloc_mmap_handler: 4320 20001000-20004000 already mapped failed -16 [ 941.334931] binder: BINDER_SET_CONTEXT_MGR already set 13:36:06 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000340000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 941.366259] binder: 4320:4321 ioctl 40046207 0 returned -16 [ 941.389424] binder_alloc: 4320: binder_alloc_buf, no vma [ 941.402295] binder: 4320:4331 unknown command 14810891 [ 941.415964] binder: release 4320:4321 transaction 789 out, still active [ 941.427045] binder: 4320:4325 transaction failed 29189/-3, size 0-0 line 2970 [ 941.435702] binder: undelivered TRANSACTION_COMPLETE [ 941.446688] binder: send failed reply for transaction 789, target dead [ 941.459337] binder: 4320:4331 ioctl c0306201 20000140 returned -22 13:36:06 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000fffffffb000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 941.473831] binder: undelivered TRANSACTION_ERROR: 29189 13:36:07 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xa0010000, 0x12) 13:36:07 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x2000001, 0x4010, r1, 0xfffffffffffffffc) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:07 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000400e00002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 941.837779] binder_alloc: 4338: binder_alloc_buf, no vma [ 941.849180] binder: 4338:4339 transaction failed 29189/-3, size 0-0 line 2970 13:36:07 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xf60f000000000000, 0x1000000020000) 13:36:07 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00008001a000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:07 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000815307a33d6c390836be381b", 0x1f) 13:36:07 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000400e0000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 941.975808] device nr0 entered promiscuous mode 13:36:07 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c070000005307a33d6c390836be381b", 0x1f) 13:36:07 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000400000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:07 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000020000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:07 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00a001000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:07 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000060000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 942.276289] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 942.296003] FAT-fs (loop3): Filesystem has been set read-only [ 942.311654] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 942.337809] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 942.365463] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 942.409088] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 942.416798] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:08 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x3000000, 0x12) [ 942.629711] binder: BINDER_SET_CONTEXT_MGR already set [ 942.635099] binder: 4338:4372 ioctl 40046207 0 returned -16 [ 942.645045] device nr0 entered promiscuous mode [ 942.645891] binder_alloc: 4338: binder_alloc_buf, no vma 13:36:08 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c638fb8"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x24000, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r3, 0x4018aee1, &(0x7f00000000c0)={0x0, 0xffffffc000000000, 0x6, &(0x7f0000000040)=0x80000000}) 13:36:08 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0xffffffffffff0700, 0x1000000020000) 13:36:08 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000003000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:08 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000004000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:08 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c040000005307a33d6c390836be381b", 0x1f) [ 942.673816] binder: 4338:4373 transaction failed 29189/-3, size 0-0 line 2970 [ 942.683451] binder: undelivered TRANSACTION_ERROR: 29189 [ 942.690153] binder: undelivered TRANSACTION_ERROR: 29189 13:36:08 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000700000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:08 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000060002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 942.836618] binder: 4385:4388 unknown command -1198562548 [ 942.842224] binder: 4385:4388 ioctl c0306201 20000140 returned -22 [ 942.856552] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 942.884102] FAT-fs (loop3): Filesystem has been set read-only [ 942.906710] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 942.926599] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:08 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000000000003f0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 942.944216] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:08 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000001a0ffffffff000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 942.984694] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) 13:36:08 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x37000000, 0x1000000020000) [ 943.035803] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:08 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000007fffffff0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 943.148966] binder_alloc: binder_alloc_mmap_handler: 4385 20001000-20004000 already mapped failed -16 [ 943.178625] binder_alloc: 4385: binder_alloc_buf, no vma [ 943.184188] binder: 4385:4388 transaction failed 29189/-3, size 0-0 line 2970 [ 943.195356] binder: BINDER_SET_CONTEXT_MGR already set [ 943.215731] binder: 4385:4386 ioctl 40046207 0 returned -16 [ 943.231628] binder: undelivered TRANSACTION_COMPLETE 13:36:08 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x800000000000000, 0x12) [ 943.245602] binder: undelivered TRANSACTION_ERROR: 29189 [ 943.251184] binder: undelivered transaction 795, process died. 13:36:08 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="153f6234488dd281de2b97404314144e4980720000070000") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xfffffcc5, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f0000000040)="133c72d2f885a0355d9134e24c66755e1dcde6e02afc7a6191a1222d7c6d70de15f545ad467a10c3ca493d085f58ba85"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) syz_open_dev$sndmidi(&(0x7f0000000180)='/dev/snd/midiC#D#\x00', 0x5, 0x10000) 13:36:08 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0091856d7bc7000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:08 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000a5307a33d6c390836be381b", 0x1f) 13:36:08 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000050000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:08 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000d5307a33d6c390836be381b", 0x1f) [ 943.344008] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 943.365241] FAT-fs (loop3): Filesystem has been set read-only [ 943.372795] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 943.380965] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 943.388463] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 943.404551] device nr0 entered promiscuous mode [ 943.422700] binder: 4411:4413 unknown command 1852400175 [ 943.423625] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:08 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00fbffffff00000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:08 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000e00005307a33d6c390836be381b", 0x1f) 13:36:08 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000030000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 943.438695] binder: 4411:4413 ioctl c0306201 20000440 returned -22 [ 943.453052] binder: undelivered transaction 798, put_user failed [ 943.474274] binder: 4411:4413 ioctl c0306201 20000140 returned -14 [ 943.481366] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:09 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3500000000000000, 0x1000000020000) [ 943.500199] binder_alloc: binder_alloc_mmap_handler: 4411 20001000-20004000 already mapped failed -16 [ 943.534541] binder: BINDER_SET_CONTEXT_MGR already set 13:36:09 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00008001a0ffffffff000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 943.556923] binder: 4411:4421 ioctl 40046207 0 returned -16 [ 943.572217] binder_alloc: 4411: binder_alloc_buf, no vma [ 943.586611] binder: 4411:4422 transaction failed 29189/-3, size 0-0 line 2970 13:36:09 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000007000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 943.606553] binder: undelivered TRANSACTION_COMPLETE [ 943.613890] binder: undelivered TRANSACTION_ERROR: 29189 [ 943.804543] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 943.825210] FAT-fs (loop3): Filesystem has been set read-only [ 943.831474] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 943.839428] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 943.848847] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:09 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x2, 0x12) 13:36:09 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000007000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:09 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000dd00000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c0d0000a8b491179b4b62c520617c1a257ce12f664e98c44aef2ce606827cb55126a9b8e30296616cb73bd1ff6f283503b1179196f95b90126c4395c03dbb6ce4ee2f4b603cf0d2542c74e69faf634ebaeebec78d4ace"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:09 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000ffffffffa001000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:09 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c050000005307a33d6c390836be381b", 0x1f) 13:36:09 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380)=0x3800000000000000, 0x1000000020000) [ 943.888140] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 943.898215] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:09 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000cf0ffffff5307a33d6c390836be381b", 0x1f) [ 943.969172] binder: 4441:4443 got transaction to invalid handle [ 943.990534] binder: 4441:4443 transaction failed 29201/-22, size 0-0 line 2855 [ 944.007372] binder: 4441:4443 unknown command 3340 13:36:09 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000007fffffff02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:09 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000034000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 944.019491] binder: 4441:4443 ioctl c0306201 20000140 returned -22 [ 944.037515] binder_alloc: binder_alloc_mmap_handler: 4441 20001000-20004000 already mapped failed -16 13:36:09 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c080000005307a33d6c390836be381b", 0x1f) [ 944.095790] binder: BINDER_SET_CONTEXT_MGR already set [ 944.108182] binder: 4441:4443 ioctl 40046207 0 returned -16 [ 944.133557] binder: 4441:4458 got transaction to invalid handle [ 944.139100] device nr0 entered promiscuous mode 13:36:09 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000cffffff9e5307a33d6c390836be381b", 0x1f) 13:36:09 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000400e00000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 944.170875] binder: 4441:4458 transaction failed 29201/-22, size 0-0 line 2855 [ 944.179890] binder: undelivered TRANSACTION_ERROR: 29201 [ 944.265976] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 944.285270] binder: undelivered TRANSACTION_ERROR: 29201 [ 944.295301] FAT-fs (loop3): Filesystem has been set read-only [ 944.315429] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 944.334593] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 944.347633] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 944.389744] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 944.403845] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:10 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x86ddffff00000000, 0x12) 13:36:10 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000100000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:10 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f00000000c0)=@v1={0x1000000, [{0x7, 0x3}]}, 0xc, 0x1) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000180)={0xffffffffffff68a7, 0x8, 0x0, 0x9, 0x5}) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000000010000000000ffff5c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c62b9ad"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:10 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000020000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:10 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020007) 13:36:10 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000600005307a33d6c390836be381b", 0x1f) 13:36:10 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0f0000005307a33d6c390836be381b", 0x1f) [ 944.658260] binder: 4477:4479 unknown command -1380359668 [ 944.684192] binder: 4477:4479 ioctl c0306201 20000140 returned -22 13:36:10 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000fbffffff0000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 944.737410] binder_alloc: binder_alloc_mmap_handler: 4477 20001000-20004000 already mapped failed -16 13:36:10 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000200000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 944.795468] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 944.808491] binder_alloc: 4477: binder_alloc_buf, no vma [ 944.830035] binder: BINDER_SET_CONTEXT_MGR already set [ 944.835618] FAT-fs (loop3): Filesystem has been set read-only [ 944.853618] binder: undelivered TRANSACTION_COMPLETE [ 944.859205] binder: undelivered transaction 804, process died. [ 944.865884] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 944.869327] binder: 4477:4484 transaction failed 29189/-3, size 0-0 line 2970 [ 944.873291] binder: 4477:4479 ioctl 40046207 0 returned -16 [ 944.881939] device nr0 entered promiscuous mode 13:36:10 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x40, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r3, 0x0, 0x42, &(0x7f0000000040)={'TPROXY\x00'}, &(0x7f00000000c0)=0x1e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 944.901276] binder: undelivered TRANSACTION_ERROR: 29189 [ 944.908487] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 944.928642] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:10 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000202000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:10 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000006000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 944.976239] binder: undelivered transaction 807, put_user failed [ 944.995616] binder: 4495:4496 ioctl c0306201 20000140 returned -14 [ 945.013702] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 945.029965] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 945.042167] binder_alloc: binder_alloc_mmap_handler: 4495 20001000-20004000 already mapped failed -16 [ 945.060568] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 945.074491] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 945.075482] binder: BINDER_SET_CONTEXT_MGR already set [ 945.094423] binder: 4495:4502 ioctl 40046207 0 returned -16 [ 945.118058] binder_alloc: 4495: binder_alloc_buf, no vma [ 945.135296] binder: 4495:4504 transaction failed 29189/-3, size 0-0 line 2970 [ 945.168148] binder: undelivered TRANSACTION_COMPLETE [ 945.174227] binder: undelivered TRANSACTION_ERROR: 29189 13:36:10 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x800e000000000000, 0x12) 13:36:10 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000001a05307a33d6c390836be381b", 0x1f) 13:36:10 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000001a00000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:10 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000000003f000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 945.635271] device nr0 entered promiscuous mode 13:36:13 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020c00) 13:36:13 executing program 2: r0 = socket$inet6(0xa, 0x800, 0x800) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000000)={0xffffffffffffffff}) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) open_by_handle_at(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="66000000030000007b1ae87ed6cc476c414984f504a9c2445fb220dae6d558157584f9259783a2031662299713f237d95148e64b7c6ddc0dd091b1f31f279a4f1ac34c352aaa6d65aa2a95ebbabbcc90f50277724d0d04b4ef00000000000000000000000000"], 0x503202) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:13 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0d0000005307a33d6c390836be381b", 0x1f) 13:36:13 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000005000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:13 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000004003000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:13 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8000000, 0x12) [ 947.957601] FAT-fs (loop3): error, fat_get_cluster: detected the cluster chain loop (i_pos 16) 13:36:13 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000ca00180005307a33d6c390836be381b", 0x1f) [ 948.018323] binder: undelivered transaction 810, put_user failed [ 948.025644] binder: 4516:4518 ioctl c0306201 20000140 returned -14 [ 948.034295] binder: BINDER_SET_CONTEXT_MGR already set [ 948.040180] binder: 4516:4526 ioctl 40046207 0 returned -16 [ 948.047741] binder_alloc: 4516: binder_alloc_buf, no vma [ 948.053305] binder: 4516:4526 transaction failed 29189/-3, size 0-0 line 2970 [ 948.061925] binder: undelivered TRANSACTION_COMPLETE 13:36:13 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000502000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 948.077543] binder: undelivered TRANSACTION_ERROR: 29189 13:36:13 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) fcntl$dupfd(r2, 0x406, r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="a8c0a77797f97ceca348034aea34b9c755ca94403db491a7d3a90dc10bfa2fdc1c9a82a6afe36a464c58f3eed25157032286b148dea4c48f036c950bda0f5fbe8ca05350679114c6178866f45136e001670f5dbf6dbfd96a5414545499474431aedb2928c32001be1ef492384ddad1f067180200e6d7d37f873bbff850a6261bfa33671110669b59ecf121e9fe160da0f521d1"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:13 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000600000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 948.152962] device nr0 entered promiscuous mode 13:36:13 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000cfffff0005307a33d6c390836be381b", 0x1f) [ 948.176814] binder: 4533:4534 unknown command 2007482536 [ 948.193123] binder: 4533:4534 ioctl c0306201 20000140 returned -22 [ 948.210427] binder_alloc: binder_alloc_mmap_handler: 4533 20001000-20004000 already mapped failed -16 13:36:13 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000402000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 948.237179] binder: BINDER_SET_CONTEXT_MGR already set [ 948.250242] binder: 4533:4534 ioctl 40046207 0 returned -16 [ 948.267195] binder_alloc: 4533: binder_alloc_buf, no vma [ 948.278740] binder: 4533:4539 transaction failed 29189/-3, size 0-0 line 2970 [ 948.288972] binder: 4533:4546 unknown command 2007482536 [ 948.294714] binder: 4533:4546 ioctl c0306201 20000140 returned -22 [ 948.302134] binder: undelivered TRANSACTION_COMPLETE [ 948.327241] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 948.328905] binder: undelivered TRANSACTION_ERROR: 29189 [ 948.345919] FAT-fs (loop3): Filesystem has been set read-only [ 948.360076] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 948.371808] binder: undelivered transaction 813, process died. [ 948.381852] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 948.398541] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 948.427671] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 948.447043] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 948.467062] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 948.483560] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 948.522022] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 948.538590] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:14 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020037) 13:36:14 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00e000040000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:14 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x801000000, 0x10, r2, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x200, 0x0) ioctl$VHOST_GET_FEATURES(r3, 0x8008af00, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000000c0)=0x15001) 13:36:14 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000050000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:14 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000065307a33d6c390836be381b", 0x1f) [ 948.647846] binder_alloc: 4552: binder_alloc_buf, no vma [ 948.656102] binder: 4552:4554 transaction failed 29189/-3, size 0-0 line 2970 13:36:14 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x86ddffff, 0x12) 13:36:14 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000a00005307a33d6c390836be381b", 0x1f) 13:36:14 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000001a0ffffffff0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:14 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000007fffffff0000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:14 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000d00005307a33d6c390836be381b", 0x1f) 13:36:14 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000007fffffff0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:14 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c141900005307a33d6c390836be381b", 0x1f) [ 948.854885] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 948.880577] FAT-fs (loop3): Filesystem has been set read-only [ 948.888278] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 948.910125] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 948.918557] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 948.937666] device nr0 entered promiscuous mode [ 948.950017] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 948.961207] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 948.984405] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 949.005728] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 949.040230] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 949.056602] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:14 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x10000000200c0) 13:36:14 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000600000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 949.349582] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 949.356954] FAT-fs (loop3): Filesystem has been set read-only [ 949.363236] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 949.379773] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 949.387959] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 949.410579] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 949.419993] binder: BINDER_SET_CONTEXT_MGR already set [ 949.427311] binder: 4552:4559 ioctl 40046207 0 returned -16 [ 949.427357] binder_alloc: 4552: binder_alloc_buf, no vma [ 949.433292] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 949.447232] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 949.455328] binder: 4552:4585 transaction failed 29189/-3, size 0-0 line 2970 [ 949.455636] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 949.474306] binder: undelivered TRANSACTION_ERROR: 29189 [ 949.483960] binder: undelivered TRANSACTION_ERROR: 29189 [ 949.497659] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:14 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) rmdir(&(0x7f0000000000)='./file0\x00') mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:14 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c030000005307a33d6c390836be381b", 0x1f) 13:36:14 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000020002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:14 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000700000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:14 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8100, 0x12) [ 949.513740] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:15 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020050) 13:36:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000b5307a33d6c390836be381b", 0x1f) [ 949.583428] binder: undelivered transaction 819, put_user failed [ 949.593052] binder: 4595:4596 ioctl c0306201 20000140 returned -14 [ 949.602508] binder: BINDER_SET_CONTEXT_MGR already set 13:36:15 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000001ef839cec400000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:15 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000ffffffffa00100000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 949.635308] binder: 4595:4597 ioctl 40046207 0 returned -16 [ 949.654409] binder_alloc: 4595: binder_alloc_buf, no vma [ 949.695988] binder: 4595:4596 transaction failed 29189/-3, size 0-0 line 2970 [ 949.724984] binder: undelivered TRANSACTION_COMPLETE [ 949.731588] binder: undelivered TRANSACTION_ERROR: 29189 [ 949.738020] device nr0 entered promiscuous mode 13:36:15 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000c77b6d85910002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000cc00e00005307a33d6c390836be381b", 0x1f) 13:36:15 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) socketpair(0x5, 0x8000a, 0x55c, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:15 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000020000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 949.876845] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 949.896793] FAT-fs (loop3): Filesystem has been set read-only [ 949.910916] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 949.928975] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 949.944579] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 949.960139] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:15 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000a00100000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:15 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000003000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 949.974475] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 949.991543] binder: undelivered transaction 822, put_user failed [ 950.000769] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 950.009251] binder: 4616:4620 ioctl c0306201 20000140 returned -14 [ 950.051239] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 950.092711] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:15 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000070000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 950.147051] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 950.261793] binder_alloc: binder_alloc_mmap_handler: 4616 20001000-20004000 already mapped failed -16 [ 950.280354] binder: BINDER_SET_CONTEXT_MGR already set [ 950.301182] binder: 4616:4617 ioctl 40046207 0 returned -16 13:36:15 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x3580, 0x12) 13:36:15 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000005000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:15 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000060050000) 13:36:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000c5307a33d6c390836be381b", 0x1f) 13:36:15 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000002000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:15 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000095307a33d6c390836be381b", 0x1f) [ 950.315524] binder_alloc: 4616: binder_alloc_buf, no vma [ 950.325296] binder: undelivered TRANSACTION_COMPLETE [ 950.330911] binder: 4616:4618 transaction failed 29189/-3, size 0-0 line 2970 [ 950.341817] binder: undelivered TRANSACTION_ERROR: 29189 13:36:15 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f00000005c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000340)="06bab497b2b0a756438849b08f90a3eee663e009e74cc639d92906d730072e2e0899266384685f4358ee15118ab9bbfe1df34e0cb9fedc2e01ab78ec94d92fa3ff26a3b2ed523b75b81b412313640b27c46fc9a3af9335909b9580c2b17eb8ef2f3234af4ea14a3c1d8b6b45ffc5e4d36d3e66b581c12448007f6028d9624a14f6eb48448d5c7f616bb49b370ce1fb4a5d28cc22a9a0c30df70b1513dcc67dc9e0948b40c62d35f5ca093a49ce69dd729bf71cd1cc02da5abea75a7bff2c28c6b5c9f542292a4c7886f3e335f16938c51ec75679053532e7c2d4eaed1bcccdedf9c6e1e114d835fb4be8891b37d8deabdcb4499b8ad0750231e42f51fa70035f") ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="fd004a315a9b0792b32a9f2f4284ce765032cfe4041636ef94ce815801b8784b7fe7a94d404cf28b21ca5cdc600de52453f1835644bf30c6880bcc28e9c3b3ac255b53cf681bf403cc238a6c56a1772f1b704f94e627e8cc78ec5640428d9c40c3343a33990b3a2196116924fcd5dd5d33fb159506f078b8682b7d48f9aee0bc0e87fa84b80b05abdc91ce78965ee70917a583c0783550b10d3126c39bbf49b8c67ecb5c"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000000)) r3 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0xffffffff80000000, 0x28000) ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af21, &(0x7f0000000180)={0x1, r0}) 13:36:15 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000001a0ffffffff02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:15 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000007000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 950.495449] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 950.505315] FAT-fs (loop3): Filesystem has been set read-only [ 950.511589] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 950.523960] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 950.533309] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 950.542694] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 950.549766] device nr0 entered promiscuous mode [ 950.551861] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 950.562744] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 950.570842] binder: 4642:4650 ioctl 41009432 20000340 returned -22 [ 950.586309] binder: 4642:4643 unknown command 826933501 13:36:16 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000f00005307a33d6c390836be381b", 0x1f) 13:36:16 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000200000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 950.591784] binder: 4642:4643 ioctl c0306201 20000140 returned -22 [ 950.615897] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:16 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000400300000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 950.639037] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 950.647563] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 950.660331] binder: BINDER_SET_CONTEXT_MGR already set [ 950.673611] binder: 4642:4654 ioctl 40046207 0 returned -16 [ 950.696458] binder: 4642:4650 ioctl 41009432 20000340 returned -22 [ 950.711153] binder_alloc: 4642: binder_alloc_buf, no vma [ 950.722627] binder: 4642:4650 unknown command 826933501 [ 950.728842] binder: undelivered TRANSACTION_COMPLETE [ 950.738519] binder: 4642:4643 transaction failed 29189/-3, size 0-0 line 2970 [ 950.746006] binder: undelivered transaction 825, process died. [ 950.753283] binder: 4642:4650 ioctl c0306201 20000140 returned -22 [ 950.759857] binder: undelivered TRANSACTION_ERROR: 29189 13:36:16 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xffffffffa0010000, 0x12) 13:36:16 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000090020000) 13:36:16 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000300005307a33d6c390836be381b", 0x1f) 13:36:16 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000030000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:16 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000ffffffffa00180000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:16 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x7c, 0x0, &(0x7f0000000000)="5d0defb80938b87ed402968131a7bced74dee5fb542f8bb268a05c4db6a900670eab080db200b7e724428fbac98e5bee90b9035eee2f5af72a8018e6097bddb4cce4d3bb3279182cc68ee9fa872c846a28b264dd9d522b097481ff9e89878ec581bf9c745b0268e39d8ff8ac98f2b2876a763ded3d68f49a566b162e"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:16 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0ec000005307a33d6c390836be381b", 0x1f) 13:36:16 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000003f0000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 951.196590] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 951.203993] FAT-fs (loop3): Filesystem has been set read-only [ 951.228504] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:16 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0a0000005307a33d6c390836be381b", 0x1f) 13:36:16 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000340000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 951.251371] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 951.272487] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 951.284037] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 951.291028] device nr0 entered promiscuous mode [ 951.298576] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:16 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c060000005307a33d6c390836be381b", 0x1f) [ 951.322512] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 951.347707] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:16 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000302000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 951.377766] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 951.400236] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:17 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8864000000000000, 0x12) 13:36:17 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000002000000) 13:36:17 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000060002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:17 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000050000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:17 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000200005307a33d6c390836be381b", 0x1f) [ 951.915357] binder_alloc: binder_alloc_mmap_handler: 4664 20001000-20004000 already mapped failed -16 [ 951.926299] binder: BINDER_SET_CONTEXT_MGR already set [ 951.932258] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 951.932914] binder: 4664:4703 ioctl 40046207 0 returned -16 [ 951.948013] FAT-fs (loop3): Filesystem has been set read-only [ 951.955914] device nr0 entered promiscuous mode [ 951.960976] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 951.969623] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 951.978568] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 951.986723] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 951.994348] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.005344] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:17 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x7, &(0x7f0000000100)="611e70d7108b9433761331") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x6, 0x101000) connect$vsock_dgram(r2, &(0x7f0000000180)={0x28, 0x0, 0xffffffff}, 0x10) ioctl$BLKPG(r2, 0x1269, &(0x7f0000000080)={0xae, 0xe, 0xa9, &(0x7f00000004c0)="2fb3cc385d8fa4f49d1ec729606760bf8ba0f1a91cc2a24f02ccb8e455592642aae8e3f9dbc85b2677e33b67add425b52bf673ab48b6e1322823ff54c86363f1f97fee0ee0de7467c7a89f231bedc2a535ef7c69cea54ae67b4828ce824c0c871ba267228319d56781be79becee34e1a787ed31cebfb87e31b7e6206db5cccb750d29fc2873531dc68ead0f66e545215ebd9b049775e37a68d2d3b0ae5a54c7d8221545c504f3aeba8"}) r3 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000580)) readv(r3, &(0x7f00000000c0)=[{&(0x7f0000000240)=""/9, 0x9}, {&(0x7f0000000340)=""/100, 0x64}], 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063d04000ca43000000000000100000f20000000089002000"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c630063d41ec066c616da00"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:17 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000b00005307a33d6c390836be381b", 0x1f) 13:36:17 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000040000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:17 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000050000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 952.014494] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:17 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000d005307a33d6c390836be381b", 0x1f) [ 952.061702] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 952.071323] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 952.083488] binder: 4715:4716 unknown command 1087398656 [ 952.095641] binder: 4715:4716 ioctl c0306201 20000440 returned -22 13:36:17 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000023700) [ 952.111372] binder: 4715:4716 unknown command 1660969740 13:36:17 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000060000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 952.149307] binder: 4715:4716 ioctl c0306201 20000140 returned -22 [ 952.179113] binder: BINDER_SET_CONTEXT_MGR already set [ 952.192672] binder: 4715:4720 ioctl 40046207 0 returned -16 [ 952.199962] binder: 4715:4719 unknown command 1087398656 [ 952.205886] binder: 4715:4720 unknown command 1660969740 [ 952.211522] binder: 4715:4719 ioctl c0306201 20000440 returned -22 [ 952.225330] binder: 4715:4720 ioctl c0306201 20000140 returned -22 [ 952.350325] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.358893] FAT-fs (loop3): Filesystem has been set read-only [ 952.365249] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.373068] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.381533] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.393851] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.409557] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.426201] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.441404] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:18 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x400000000000000, 0x12) 13:36:18 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000070000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:18 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0cf3f74d96be02000000000000002c5263003c"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:18 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000003400002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:18 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000ec0005307a33d6c390836be381b", 0x1f) [ 952.487733] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 952.500441] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:18 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020d00) 13:36:18 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000009005307a33d6c390836be381b", 0x1f) [ 952.570208] binder: 4732:4734 unknown command 1308095244 [ 952.585510] binder: 4732:4734 ioctl c0306201 20000140 returned -22 [ 952.600148] binder_alloc: binder_alloc_mmap_handler: 4732 20001000-20004000 already mapped failed -16 [ 952.610226] binder: BINDER_SET_CONTEXT_MGR already set 13:36:18 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000002002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 952.616120] binder: 4732:4734 ioctl 40046207 0 returned -16 [ 952.622270] binder_alloc: 4732: binder_alloc_buf, no vma [ 952.628661] binder: 4732:4737 transaction failed 29189/-3, size 0-0 line 2970 [ 952.650433] binder: 4732:4734 unknown command 1308095244 13:36:18 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000008001a0000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:18 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000800005307a33d6c390836be381b", 0x1f) [ 952.696657] binder: undelivered TRANSACTION_COMPLETE [ 952.702501] binder: 4732:4734 ioctl c0306201 20000140 returned -22 [ 952.709594] binder: undelivered TRANSACTION_ERROR: 29189 [ 952.722248] binder: undelivered transaction 830, process died. 13:36:18 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)=ANY=[], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) [ 952.769788] device nr0 entered promiscuous mode 13:36:18 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000c00005307a33d6c390836be381b", 0x1f) [ 952.821039] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.837554] FAT-fs (loop3): Filesystem has been set read-only [ 952.846283] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.886627] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.915528] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.927491] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.942861] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.951453] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 952.973122] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 953.002418] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 953.049502] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:18 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xa0018000, 0x12) 13:36:18 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000102000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:18 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000fffffffb000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:18 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000023d00) 13:36:18 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000f005307a33d6c390836be381b", 0x1f) 13:36:18 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000600005307a33d6c390836be381b", 0x1f) 13:36:18 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00007fffffff000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:18 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000000000400e002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 953.384103] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 953.395267] FAT-fs (loop3): Filesystem has been set read-only [ 953.414777] device nr0 entered promiscuous mode [ 953.425384] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:18 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000a005307a33d6c390836be381b", 0x1f) [ 953.438053] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 953.446791] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 953.456166] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 953.463826] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 953.473571] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:19 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000003f000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 953.489987] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 953.519017] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 953.540413] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 953.614892] binder_alloc: binder_alloc_mmap_handler: 4749 20001000-20004000 already mapped failed -16 [ 953.631189] binder: BINDER_SET_CONTEXT_MGR already set [ 953.641188] binder: 4749:4786 ioctl 40046207 0 returned -16 [ 953.652701] binder_alloc: 4749: binder_alloc_buf, no vma [ 953.677374] binder: undelivered TRANSACTION_COMPLETE [ 953.678265] binder: 4749:4787 transaction failed 29189/-3, size 0-0 line 2970 [ 953.682730] binder: undelivered transaction 833, process died. [ 953.843998] binder: undelivered TRANSACTION_ERROR: 29189 13:36:19 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2002, 0x0) ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f00000004c0)=""/4096) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:19 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000030000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:19 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8060000, 0x12) 13:36:19 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x10000200c0000) 13:36:19 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000020000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:19 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000e005307a33d6c390836be381b", 0x1f) 13:36:19 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c001914005307a33d6c390836be381b", 0x1f) [ 953.944672] binder: undelivered transaction 836, put_user failed [ 953.951963] binder: 4792:4793 ioctl c0306201 20000140 returned -14 [ 953.978178] binder_alloc: binder_alloc_mmap_handler: 4792 20001000-20004000 already mapped failed -16 13:36:19 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000300000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 954.023062] binder: BINDER_SET_CONTEXT_MGR already set [ 954.035364] binder: 4792:4793 ioctl 40046207 0 returned -16 [ 954.047835] binder_alloc: 4792: binder_alloc_buf, no vma [ 954.069678] binder: undelivered TRANSACTION_COMPLETE 13:36:19 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000003000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:19 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000300005307a33d6c390836be381b", 0x1f) [ 954.096367] binder: 4792:4800 transaction failed 29189/-3, size 0-0 line 2970 [ 954.122995] binder: undelivered TRANSACTION_ERROR: 29189 [ 954.127615] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:19 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = semget(0x0, 0x2, 0x308) semctl$IPC_STAT(r1, 0x0, 0x2, &(0x7f00000004c0)=""/4096) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 954.141405] FAT-fs (loop3): Filesystem has been set read-only [ 954.148138] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.159708] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.160338] device nr0 entered promiscuous mode [ 954.167875] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.180344] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.196880] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:19 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000003f00000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:19 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000b005307a33d6c390836be381b", 0x1f) 13:36:19 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000004000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 954.238534] binder: undelivered transaction 839, put_user failed [ 954.254438] binder: 4818:4819 ioctl c0306201 20000140 returned -14 [ 954.265989] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.278682] binder_alloc: binder_alloc_mmap_handler: 4818 20001000-20004000 already mapped failed -16 [ 954.298926] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.312018] binder: BINDER_SET_CONTEXT_MGR already set [ 954.318062] binder: 4818:4820 ioctl 40046207 0 returned -16 [ 954.324113] binder_alloc: 4818: binder_alloc_buf, no vma [ 954.330023] binder: 4818:4821 transaction failed 29189/-3, size 0-0 line 2970 [ 954.339448] binder: undelivered TRANSACTION_COMPLETE [ 954.345800] binder: undelivered TRANSACTION_ERROR: 29189 [ 954.346007] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 954.406640] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:20 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000002000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:20 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000340000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:20 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020036) 13:36:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000003005307a33d6c390836be381b", 0x1f) 13:36:20 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x4305, 0x12) 13:36:20 executing program 2: r0 = socket$inet6(0xa, 0x10000000002, 0x9) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = socket(0x18, 0x5, 0x46f) getsockopt$nfc_llcp(r2, 0x118, 0x1, &(0x7f00000004c0)=""/128, 0x80) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) r4 = mmap$binder(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000000, 0x8011, r1, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0x50, 0x0, &(0x7f0000000200)=[@free_buffer={0x40086303, r4}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000180)=[@ptr={0x70742a85, 0x1, &(0x7f0000000000), 0x1, 0x2, 0x1}, @fda={0x66646185, 0x9, 0x3, 0x5}], &(0x7f0000000040)=[0x78, 0x28, 0x38]}}], 0x99, 0x0, &(0x7f0000000340)="5a9d8e65f753d185b4c749653f16dac5ab543e1c686c8702aa3e8253efdba94f1c94c47f9b059783287744c79efa5036d0d11ae584e561ecc4341b183ed22051e34767652984067f1359a3e3a35ec2b85566021b66458f30f8ae0bf7066db129ceb8d50c71b29eceb48bded95cb383aa06a1b005ba1dbc0ad8a96cf3277226294b3f48fe89382946ef2750e0334d4825a8006915d81276a042"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0xc, 0x0, &(0x7f00000002c0)=[@free_buffer={0x40086303, r4}], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000006005307a33d6c390836be381b", 0x1f) [ 954.762746] binder: 4833:4844 BC_FREE_BUFFER u0000000020002000 no match [ 954.779736] binder: 4833:4844 got transaction to invalid handle [ 954.789351] binder: 4833:4844 transaction failed 29201/-22, size 72-24 line 2855 13:36:20 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000000000003f0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:20 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000000fffffffb02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 954.828598] binder: 4833:4835 BC_FREE_BUFFER u0000000020002000 no match [ 954.840951] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.855254] FAT-fs (loop3): Filesystem has been set read-only [ 954.875690] binder_alloc: binder_alloc_mmap_handler: 4833 20001000-20004000 already mapped failed -16 [ 954.885431] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.897655] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.905789] binder: BINDER_SET_CONTEXT_MGR already set [ 954.910091] device nr0 entered promiscuous mode [ 954.912087] binder: 4833:4835 ioctl 40046207 0 returned -16 [ 954.922701] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.931181] binder_alloc: 4833: binder_alloc_buf, no vma [ 954.936847] binder: 4833:4844 transaction failed 29189/-3, size 0-0 line 2970 [ 954.944824] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.958854] binder: 4833:4857 BC_FREE_BUFFER u0000000020002000 no match [ 954.960433] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000500005307a33d6c390836be381b", 0x1f) 13:36:20 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000001000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 954.974649] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.982603] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 954.993900] binder: 4833:4857 got transaction to invalid handle [ 955.001370] binder: 4833:4857 transaction failed 29201/-22, size 72-24 line 2855 13:36:20 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000003f02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 955.031488] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 955.043622] binder: 4833:4835 BC_FREE_BUFFER u0000000020002000 no match [ 955.060299] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 955.070138] binder: undelivered TRANSACTION_COMPLETE 13:36:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000f0005307a33d6c390836be381b", 0x1f) [ 955.076298] binder: undelivered transaction 842, process died. 13:36:20 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x100000002000d) 13:36:20 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000a0010000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:20 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x20000000000800, 0x0) ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f0000000040)) r1 = socket$inet6(0xa, 0x6, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f00000002c0)=0x116a, 0x4) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000180)={0x0, 0x7, 0x1, 0xfff}, &(0x7f00000001c0)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000200)={r5, 0x7}, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000240)=0x8) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00633cfd1f62ba044040000000000000001000000001005c5847451dee0000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0c6300005bc97743329771b7276122148216c493144ceeb9f1a9fca9fb7117fccd449fbd3ba11eb5031c1d518f2aa73ae89de5531e62be5a71afe6a7a60cdec7081d02f5fe7f59481bdd"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) ioctl$FICLONERANGE(r4, 0x4020940d, &(0x7f0000000300)={r4, 0x0, 0x40, 0x7fff, 0x3}) [ 955.129487] binder: undelivered TRANSACTION_ERROR: 29189 [ 955.235421] binder: 4870:4872 unknown command -46374144 [ 955.243200] binder: 4870:4872 ioctl c0306201 20000440 returned -22 [ 955.399334] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.419339] FAT-fs (loop3): Filesystem has been set read-only [ 955.435210] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:20 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xd00, 0x12) 13:36:20 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000060000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:20 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000400e0000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:20 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000e00005307a33d6c390836be381b", 0x1f) [ 955.443067] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.450732] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.459317] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.477723] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.557640] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.571936] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.595170] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) 13:36:21 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000a00005307a33d6c390836be381b", 0x1f) [ 955.602974] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.639864] device nr0 entered promiscuous mode 13:36:21 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000d00005307a33d6c390836be381b", 0x1f) 13:36:21 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000030000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:21 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000023b00) 13:36:21 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000010000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:21 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000060000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:21 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000500000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 955.917303] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.933426] FAT-fs (loop3): Filesystem has been set read-only [ 955.946532] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.963274] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.979851] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 955.988079] binder: BINDER_SET_CONTEXT_MGR already set [ 955.996810] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 956.002854] binder: 4870:4876 ioctl 40046207 0 returned -16 [ 956.004024] binder: 4870:4905 unknown command -46374144 [ 956.037161] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 956.061596] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 956.072196] binder: 4870:4905 ioctl c0306201 20000440 returned -22 [ 956.084434] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 956.113066] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 956.129134] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:21 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x19, 0x0, &(0x7f0000000180)=ANY=[@ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYRESHEX=r2, @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYRES32=r1], @ANYRESHEX=r1, @ANYRES64=r2, @ANYRES32=0x0, @ANYRES32=r0]], 0xffffffffffffff91, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:21 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x543, 0x12) 13:36:21 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000602000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:21 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000091856d7bc70000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:21 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000400005307a33d6c390836be381b", 0x1f) 13:36:21 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000100000) 13:36:21 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c001419005307a33d6c390836be381b", 0x1f) [ 956.235191] binder: 4909:4913 unknown command 536871104 [ 956.249666] binder: 4909:4913 ioctl c0306201 20000000 returned -22 13:36:21 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000081005307a33d6c390836be381b", 0x1f) 13:36:21 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000e00004000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:21 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000010002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:21 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000f00005307a33d6c390836be381b", 0x1f) [ 956.359893] device nr0 entered promiscuous mode 13:36:21 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000030002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 956.484385] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 956.498378] FAT-fs (loop3): Filesystem has been set read-only [ 956.512374] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 956.544936] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 956.562003] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 956.595837] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 956.613999] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 956.637169] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 956.657605] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 956.672840] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 956.700232] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:22 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x100, 0x0) write$FUSE_INTERRUPT(r2, &(0x7f0000000040)={0x10, 0x0, 0x6}, 0x10) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:22 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000c4ce39f81e02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:22 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000040002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:22 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x100000e000000) 13:36:22 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00c00e005307a33d6c390836be381b", 0x1f) 13:36:22 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8847000000000000, 0x12) [ 957.010659] binder_alloc: binder_alloc_mmap_handler: 4909 20001000-20004000 already mapped failed -16 [ 957.020274] binder: BINDER_SET_CONTEXT_MGR already set [ 957.026119] binder: 4909:4937 unknown command 536871104 [ 957.031572] binder: 4909:4936 ioctl 40046207 0 returned -16 [ 957.037746] binder: 4909:4937 ioctl c0306201 20000000 returned -22 13:36:22 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000007005307a33d6c390836be381b", 0x1f) [ 957.128627] binder: undelivered transaction 849, put_user failed [ 957.135705] binder: 4949:4950 ioctl c0306201 20000140 returned -14 [ 957.162837] binder_alloc: binder_alloc_mmap_handler: 4949 20001000-20004000 already mapped failed -16 13:36:22 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000702000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:22 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000004000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 957.180058] binder_alloc: 4949: binder_alloc_buf, no vma [ 957.194700] binder: BINDER_SET_CONTEXT_MGR already set [ 957.213781] binder: 4949:4952 transaction failed 29189/-3, size 0-0 line 2970 [ 957.217412] binder: 4949:4951 ioctl 40046207 0 returned -16 [ 957.229498] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.236750] FAT-fs (loop3): Filesystem has been set read-only [ 957.242879] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.262711] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.271578] binder: undelivered TRANSACTION_COMPLETE 13:36:22 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000040000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:22 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000034000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 957.277309] binder: undelivered TRANSACTION_ERROR: 29189 [ 957.278238] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.294156] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.302471] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.310537] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.312180] device nr0 entered promiscuous mode [ 957.318599] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:22 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000900005307a33d6c390836be381b", 0x1f) 13:36:22 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000c90000"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 957.365703] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 957.373693] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:22 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000fffffffb0000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:22 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000080060000) 13:36:22 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000200000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 957.485348] binder: 4969:4974 got transaction to invalid handle [ 957.496734] binder: 4969:4974 transaction failed 29201/-22, size 0-0 line 2855 13:36:23 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000006000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 957.701842] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.728795] FAT-fs (loop3): Filesystem has been set read-only [ 957.741812] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.770703] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.780003] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.789835] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.797619] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:23 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x43050000, 0x12) 13:36:23 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000070000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:23 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000fbffffff000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:23 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000700005307a33d6c390836be381b", 0x1f) [ 957.828366] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.839431] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:23 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000c005307a33d6c390836be381b", 0x1f) 13:36:23 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x10000ff0f0000) [ 957.874249] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 957.884423] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.893316] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 957.907850] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:23 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000070002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 958.044829] device nr0 entered promiscuous mode [ 958.131538] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.146234] FAT-fs (loop3): Filesystem has been set read-only [ 958.161025] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.188965] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.206582] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.215890] binder_alloc: binder_alloc_mmap_handler: 4969 20001000-20004000 already mapped failed -16 [ 958.239957] binder: BINDER_SET_CONTEXT_MGR already set [ 958.240972] binder: 4969:5003 got transaction to invalid handle [ 958.261128] binder: 4969:5002 ioctl 40046207 0 returned -16 [ 958.265775] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.274311] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.284073] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.316376] binder: 4969:5003 transaction failed 29201/-22, size 0-0 line 2855 [ 958.335368] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.353104] binder: undelivered TRANSACTION_ERROR: 29201 [ 958.362147] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 958.363379] binder: undelivered TRANSACTION_ERROR: 29201 [ 958.381855] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:23 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$sock_int(r1, 0x1, 0x1e, &(0x7f0000000380), &(0x7f0000000440)=0x4) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c630002"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:23 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000001a000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:23 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000005005307a33d6c390836be381b", 0x1f) 13:36:23 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000400e00002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:23 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x100000002e000) 13:36:23 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8864, 0x12) 13:36:23 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00f000005307a33d6c390836be381b", 0x1f) [ 958.509309] binder: 5011:5012 unknown command 33579788 [ 958.519707] binder: 5011:5012 ioctl c0306201 20000140 returned -22 [ 958.543161] binder_alloc: binder_alloc_mmap_handler: 5011 20001000-20004000 already mapped failed -16 13:36:24 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000007000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:24 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000500000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 958.593308] binder: BINDER_SET_CONTEXT_MGR already set 13:36:24 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000ec05307a33d6c390836be381b", 0x1f) [ 958.618696] binder: 5011:5018 ioctl 40046207 0 returned -16 [ 958.647272] binder_alloc: 5011: binder_alloc_buf, no vma [ 958.656510] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.672348] FAT-fs (loop3): Filesystem has been set read-only [ 958.681927] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.683328] binder: 5011:5025 transaction failed 29189/-3, size 0-0 line 2970 [ 958.690549] device nr0 entered promiscuous mode [ 958.701357] binder: 5011:5012 unknown command 33579788 [ 958.707521] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:24 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000005000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 958.716995] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.727931] binder: undelivered TRANSACTION_COMPLETE [ 958.733793] binder: 5011:5012 ioctl c0306201 20000140 returned -22 [ 958.740766] binder: undelivered transaction 855, process died. 13:36:24 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000003400000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 958.766665] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.775518] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.794438] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 958.803792] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:24 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) close(0xffffffffffffffff) bind$nfc_llcp(0xffffffffffffffff, &(0x7f00000001c0)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "df5a4ee9efcbc0f6ea2d95a622971554175b370849b488649394688e97a1fa14893c44bb591f5c60b3fe73c2ac6a0f5e28df3ee68efd30df5e01784c0aea39"}, 0x60) write(r1, &(0x7f0000000400)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r1, r2, 0x0, 0x10000) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer2\x00', 0x200, 0x0) ioctl$KVM_INTERRUPT(r5, 0x4004ae86, &(0x7f00000002c0)=0x2000000000) accept$alg(r0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0x100f}}, 0x20) r8 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x400) write$RDMA_USER_CM_CMD_MIGRATE_ID(r6, &(0x7f0000000200)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r7, r8}}, 0x18) 13:36:24 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000006005307a33d6c390836be381b", 0x1f) [ 958.817875] binder: undelivered TRANSACTION_ERROR: 29189 [ 958.854023] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:24 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000fffffffb0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:24 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000003f000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 958.890746] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:24 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000023400) [ 958.973134] audit: type=1800 audit(1539092184.430:412): pid=5042 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor2" name="file0" dev="sda1" ino=16555 res=0 [ 959.011501] audit: type=1804 audit(1539092184.450:413): pid=5042 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor2" name="/root/syzkaller-testdir370293036/syzkaller.ySzNnV/389/file0" dev="sda1" ino=16555 res=1 13:36:25 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8906, 0x12) 13:36:25 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000200002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:25 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000020000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:25 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000a005307a33d6c390836be381b", 0x1f) [ 959.565691] binder: undelivered transaction 858, put_user failed [ 959.574413] binder: 5038:5039 ioctl c0306201 20000140 returned -14 13:36:25 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000b005307a33d6c390836be381b", 0x1f) 13:36:25 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000001000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 959.749661] audit: type=1804 audit(1539092185.210:414): pid=5045 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor2" name="/root/syzkaller-testdir370293036/syzkaller.ySzNnV/389/file0" dev="sda1" ino=16555 res=1 13:36:25 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000006000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 959.825491] device nr0 entered promiscuous mode [ 960.221453] binder: BINDER_SET_CONTEXT_MGR already set [ 960.227099] binder: 5038:5042 ioctl 40046207 0 returned -16 [ 960.238812] binder_alloc: 5038: binder_alloc_buf, no vma [ 960.255510] binder: 5038:5039 transaction failed 29189/-3, size 0-0 line 2970 [ 960.299512] binder: undelivered TRANSACTION_ERROR: 29189 [ 960.309595] binder: undelivered TRANSACTION_COMPLETE 13:36:25 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r1, 0x12, 0x2, &(0x7f0000000000)=""/18, &(0x7f0000000040)=0x12) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:25 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000095307a33d6c390836be381b", 0x1f) 13:36:25 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000400000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:25 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000003f0000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:25 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x100000002003e) 13:36:25 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x806, 0x12) 13:36:25 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000c00e5307a33d6c390836be381b", 0x1f) [ 960.488543] binder: undelivered transaction 861, put_user failed [ 960.495877] binder: 5083:5084 ioctl c0306201 20000140 returned -14 [ 960.511763] binder_alloc: binder_alloc_mmap_handler: 5083 20001000-20004000 already mapped failed -16 [ 960.539654] binder: BINDER_SET_CONTEXT_MGR already set [ 960.545416] binder: 5083:5084 ioctl 40046207 0 returned -16 [ 960.545579] binder_alloc: 5083: binder_alloc_buf, no vma 13:36:26 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000e0000400000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:26 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000200000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 960.585248] binder: 5083:5085 transaction failed 29189/-3, size 0-0 line 2970 [ 960.597297] binder: undelivered TRANSACTION_COMPLETE [ 960.603737] binder: undelivered TRANSACTION_ERROR: 29189 13:36:26 executing program 2: r0 = syz_open_dev$admmidi(&(0x7f00000004c0)='/dev/admmidi#\x00', 0x8, 0x0) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000500)=0xffffffff) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000540)={0x0, 0x9}, &(0x7f0000000580)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f00000005c0)={r1, 0x37, "ad80aed72e3bc1742e9d3006742eff64f3f8f61cf461ddc9f8616fe22fa66217ad2c49cd75902e71112e0da822cdaa7aee4c31c14c8f45"}, &(0x7f0000000600)=0x3f) r2 = socket$inet6(0xa, 0x6, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) r6 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x2440, 0x0) io_submit(r5, 0x1, &(0x7f0000000200)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7, r4, &(0x7f0000000180)="975ad475942ea5a28d3e7239c0a96165f6e7989f6e4e35aaf06d00bdcf8db3e2196ee9e2acde10402fb204e65e8d0f634d357278525116cc16fced1ea37326e9ecf722849b9bfc5b015dbbd2e32374434e95c427c145932d491f6b1752cd7b300aaa6581ddbcf4a3d2f60d855f08a1ee366f", 0x72, 0x2000000000000000, 0x0, 0x1, r6}]) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffe3"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r6, 0x84, 0x1a, &(0x7f0000000340)={0x0, 0xb0, "bdca21f7446d8ec74b52d6563b1503ca877ed5f930499816fd81f38faa7c243fdd57745b9cf2e594bfdf7928d6744f85dad7dc02ced8c0c9f80a60d67631bcb2d824929deb6f776490ab485b2b1d2286eb92d34f320603df9a6e950a7ff7bac9b39164fcffa507c85a1ef415042acf30e955c7c59e268263164ee6ac14ac2c2f5cdf194286a6e505c55931cf8bc27c44222f99c6af06d7694e645070caaea0c92f61a214b8482163556c08f335b0fe08"}, &(0x7f0000000240)=0xb8) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r6, 0x84, 0x1b, &(0x7f0000000640)={r1, 0x69, "79608e33306bebeb1109f8d33e460dce4f9beb8d3da085e8cb34cd114e21ae6ea77aac985baa62f0b288899ad9ed06b124f8b2c36833706aa0e1803b4feaa715a687e9f5ab1919f30758aeb14c9747c0fbaa453f43ce6fd2eee187f109cbc5ba62f08cd41e4c3daa46"}, &(0x7f00000006c0)=0x71) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x8010, r0, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r6, 0x84, 0x13, &(0x7f00000002c0)={r7}, &(0x7f0000000400)=0x8) 13:36:26 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000002005307a33d6c390836be381b", 0x1f) [ 960.647875] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 960.664129] device nr0 entered promiscuous mode [ 960.687273] FAT-fs (loop3): Filesystem has been set read-only [ 960.706043] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 960.715520] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 960.724367] binder: 5096:5098 unknown command -469762049 [ 960.732084] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:26 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000008001a0ffffffff0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:26 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000000000ffffffff000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 960.755926] binder: 5096:5098 ioctl c0306201 20000140 returned -22 [ 960.770967] binder: BINDER_SET_CONTEXT_MGR already set [ 960.781159] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 960.800754] binder: 5096:5102 ioctl 40046207 0 returned -16 [ 960.812271] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 960.824467] binder_alloc: 5096: binder_alloc_buf, no vma [ 960.824690] binder: 5096:5105 unknown command -469762049 [ 960.843616] binder: 5096:5101 transaction failed 29189/-3, size 0-0 line 2970 [ 960.856605] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 960.872598] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 960.877036] binder: 5096:5105 ioctl c0306201 20000140 returned -22 [ 960.891550] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:26 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000700000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:26 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000050002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:26 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000023500) [ 960.906888] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 960.922765] binder: undelivered TRANSACTION_COMPLETE [ 960.928620] binder: undelivered TRANSACTION_ERROR: 29189 [ 960.947033] binder: undelivered transaction 864, process died. 13:36:26 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000001a0000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 961.229217] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.238763] FAT-fs (loop3): Filesystem has been set read-only [ 961.244948] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.253236] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.261703] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.269712] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:26 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x4788, 0x12) 13:36:26 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000400e000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:26 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000d5307a33d6c390836be381b", 0x1f) 13:36:26 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000a0018000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:26 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$security_smack_transmute(r1, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000040)='TRUE', 0x4, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\f@\x00\b'], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 961.277689] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.285870] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:26 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000065307a33d6c390836be381b", 0x1f) [ 961.323657] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.345584] binder: 5126:5127 unknown command 134234124 [ 961.360077] binder: 5126:5127 ioctl c0306201 20000140 returned -22 [ 961.382222] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 961.391391] binder: BINDER_SET_CONTEXT_MGR already set [ 961.403572] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 961.404648] binder: 5126:5129 ioctl 40046207 0 returned -16 13:36:26 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000002000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:26 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000500000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 961.437124] binder_alloc: 5126: binder_alloc_buf, no vma [ 961.454965] binder: 5126:5132 unknown command 134234124 13:36:26 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000027001) [ 961.488559] binder: undelivered TRANSACTION_COMPLETE [ 961.495974] binder: 5126:5127 transaction failed 29189/-3, size 0-0 line 2970 [ 961.503423] binder: undelivered transaction 867, process died. [ 961.516724] device nr0 entered promiscuous mode [ 961.523174] binder: 5126:5132 ioctl c0306201 20000140 returned -22 [ 961.532298] binder: undelivered TRANSACTION_ERROR: 29189 13:36:27 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000003005307a33d6c390836be381b", 0x1f) 13:36:27 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) memfd_create(&(0x7f0000000180)="5eeb00", 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x2, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000000)="f2"}) write$binfmt_misc(r0, &(0x7f00000004c0)={'syz0', "6da35117668c2991604ee85073f874fd50eece9002f3e1efe8d18424d144a5dbb2685be02c96f76cb5b1e3749179fa7f735ab07fb55617b90fbdd3bb46e6c60bbfb24791210781a7d057ca340ed83f9fc45f9d0be7287860fd256b116767c10156c7715741a93685c64fe9d5a978f87314de89f1416f78e73aae57c0b47692feb7e9c0e5415291e93cc7015efa180fcd1af7fa436827b2a60e0028967deefb1e36813ff280614a64d2f766889b2a6f76405803078c51f7a0df95f071d1a50c7b97abec433a5fb190e705dccb7ba1ff08f75fd3cfed868eba63e9b9d0671b5c0508a1056fe5e608a006b4ab6d24a68f8822ffcca4b9446b3a56eb00bcd276072619264535ce4cfdad8c0d22a47c03b6ac45ce4665d0afad8ce7cd57dc8624f67dfda642530f22cbf3cfdf5dfc9beb8548fcb755dc2e5e9ab7f6ae30fcdd351e8f227ba4e9a44f8cc303d61ac819c1b86d01d6bc17e8cf445b4cd235fe824be29a400b4124d58544ceb3174c4936655e35b964fdf9ca4e56467b047121822a27d0a14f9ffd20de9f7e5c69aebbb4ad6daff219c789dda3c27318e229180b2761dc42aa266c5497355bc9dbaba284ca20bd6ac5c6778f8e0693dae9fd371e5e8083dd3a5505f0ac415321490f500005d5776783bdf63b0e9ef89eb55577b609dea08edf2b089cffd5b069d191347c00760667f8548ef880c0f5a6b7d8a320e70fc2f98c9fae24f59455e16c9188a6c722213f0d2d9ee37f9894f44c09cde9bc46841b18bd27edc2b87952a23047685a4343bba7ed02d94c1130b890ef575ff4b1a5fb5eebf36163ee2c86e3f4e487bf2c153b919ae90fe88d359537896fdefcd7261052ee23a31161a5aa3422a8f7f74832890f9b4318b7752c9f373b1e8edb40119e14442a90c1ba0cf85e78039a7daa9a2a52cf54543797af3c3024f5a17bb92d613aaae8905f4a92cae31738f04bc6263bdfb60e94cdf7328034ed120a46cb7685dc1d0720c614cde2c3bea7af17d19461662c967468947c01780ac3c792038c612768fe49ccf7dabf9f144f90c5d7f9988822932f4fa5e4b191680f22781eac87a7ead4ef42e592ed0c4073ce8f5e501bfc942cff1c9674ead1dd622db243b9cc2b5068fe950f7f9ad118856fe9c53de3efe7aaad7c7c1c620b739762c55f4be5c017d3e8e1ec17e463fd13fdef7dd4a4c703a538cd9d451786a0c75b8fe5463b80c668350c951942b7db067394a81df556b8bed2519e49730110a9cded7446d9cb63ab65e3aa440cfd34d70913243dc8f3f172882a79b1ba295a5639b90ccc15ce3c74a4e0fb9b8657f83eb65ae8ba031d5192b8d5bb966400e19983d3e607317d048b94d89baa4acd7e2477687b84da83d5e855770c8fd154e441d2d7e773e401644c7513e7f0e6af33bf713541f6a628b145a10b4010bde9b81f76f2a219a4bef4772a64ab6fc05d34edd9423689724e1e7a63f5d5bf7cea445fd24e133b8a700185d84070b8bef922de670229aa3c89228c769c8dae35ef49ce8e4e89541c0ff784a9832ce6eef33ff098d9ccc743394e0f54a9d793cfbd071dfb0db276614475289acc227eb1a90e468e7db02453691faae7cea18a664c85c5c3b919c435b27ea5808acaf0eca349790410302feec7ce3cf7771463d4fb5494cbbbb91f9cb3e753d67757ff94af0de11565ce475dafb84b5c311690d20fc6d63a8e81f90df140f5a4197b65cb87a9d991cc066f16cdc11d4309053be286eb0cffb87a1a991fad65a9108305ed4a587fbe7c7112c5b355b9840dc224210aa4d53a2a62a230511042a5ec9d0bf3d421a96b3d18def95acc894421972ca3ad6f3e33a4b9bb6590553f4077c3b8833b92f376a3e375a2b70776ed6dbd7130c9bdea706b8f8ad1a5886b596e774d4d493fd994654721dd3fa227d44f67de7756036269b786546f2e0e3d513a3cc49f1031d5ad595dcd73f570754531410d508f0b3bf9d1377d50a3d11d40f74e3c5b7ed1f4af89f7fdb41d5d2c21fda62dfc5f3bab3e635b15f0059ab71ee48ff8c6d20f528349905ee79f581f2073bc6f8535766870fbab0ac82418ee58f24b5948ae163a6be3ab7650c5b012474262ef67db3176c60512df3b79782601ee4d1238165df52024f5420e8a92359022c13d2e47a19138ca4987e00127fa9a7fa8487b19495b3023e566c082e3c8186082020bd56ea57c51444a5bfee66062dfcce1f922d1e7a7af28943e3b78abb64d06940d687c64cb5e16c87607047c89d55ea32164882f1fb26135b383ea2a76997e34370569b6cb377fece0d2b6cd8b7fbe273bab44dca59f40f8a28da8713327f9b8afe36f0324c195e83e757b49b6b5e9ff07736d733d237b7407723048b9cea5832ca44d5f4339dd140caba207af4ee394213c50d3850b2b9f4f3e15ef60f5775fb5cdf00b5f35bff1a35dc8f3ec43f26e18937c05e6211ffe73e7cf00bcfa7cb2a5cd74d9f384a8e129ce6a309d11334e93b0553586f73501a709b6709e1551220e8cab29b1da4491f6f6dd68ace82256ed3c29b6f60712a637984d842bb0107b5842f083e9b11cf257007788e293c64e8ab5aeff7183c15b171c1b2a6a681aae68e52fd1a021cac1b4eca122bb3952f4df65e83ae13c70dc7bccc088894cf97faec63ac25982559186c4c5901614a5720959afd4f3e4157946ad5cfaef23ab62d5abea78805f5ba689f7cde8e8f6df7df341d7e5a70736389f45eb69b673271ac8c55ededecdae4d198fdd89b7311cf3cd6b7de1c58a5bba53afd27657172d5beb249eb98b0b5f9acd5d7c66299cba176fe6a29e65bd0333e713d30d242d5043fd24cf75d71d9e70a245050ff80b36d83076c22362eb815cff86fa8c2e443f2faecf5c9499e20d250741c0d4542e0e18f51ddf2e7241382b314e16fedb6957a78c64a59ab1a211dbcb4f87a676770958296e7c5c6795286db70713beca45832d2abc2b75058463fcd490431d18b87b52c5c5db50f69563d94c462132457d77813b80f621052ac350dea3c65a0831947599f7216ae63ee815136a8cddf09917b14777fe2b25382e70772d0dbed9bc05a585a7939128a9f49ae202a38435ee8bece56fa6a243bdd0ad40a3c1753e1417487e50f47d90400261d004ba5423356553f93621491945773b8c097c5ef5163f690730004459cb04012875ceaf8d22546afadeeac75ffba541a9625d89c30e2d58b66b980d995292a5e3d28ebfde9e8f637c7dd6055c40ff8e07a18eaada11d8606bffa2e19fc4815c631c3021cacb8dc4e5e5293e643233db89f9420241ced7703b09698bbbd1a185c39a5044a1f329ae269e4870e00f77513c2238b0d0fe9416de7ff1b26c3a850a068a00e2326ada89df70ef8c2a3a2759cf29aece1a67d465be6537ed2817d1fae92c27f20b19adedb7897b0b1c03313f158bf36f71b6e7a266f5776faee693468d93577727f46b6d8bb47933b2f36ba88683245fbe88e26b52ceaa87dfb49a4b79002c4ac13894c50eb9134effe5d189259594d069c8a76faca80b152d2ebebde8e8046b81a1791414f1a881a3b5728ef9f65db7a66da048acd2c491cf9633458694cb13fdea28f61d144977da47a0ab35c15c45f0fa915ccefa5f9c90b7fa533dda17e5c2076cc4840ab92eecfe5f4ebae08359bd85e2fcab88838efb67651bef5c0767309211d5940b7e40a95a4244cac8aa484fd8cb5a25e9c1ab5b626c76d836ae66f40f2d42e53a138a957a608d4bc75f54104082cfa7be9f61cd636658a8e5278a37720f61c963ffe9903af39c4a71d29e691471d75c34e6e2a04470e847294abeb4f4e3115e926b7cf411e368d6d0b06f2fa246303366046fc916ccb7eea8b66adc36091eeb49efafb2a20478ef405b357c56ad2dbd3023fa8de8fae5f4b2738469807aefe7abd4314e5c9e35eaf6a7de288747febca882d12a975054909c7a92a5315a85b85275084f9f4374e9470a0a281432a7461292d9b7dda871afef157f7a564d8b93f04478e107f3875cb9380dfc017073f4854e13f9f1ff88c48890107c12efdddb954fe389a1a80e7e4de6ca755eeac8412d1817933bff2516588788e6de3b48d8fbee1eeb5bf0741867e18978cd709942881cb24e16d7c3a97ce829209d0468b5d0fd0393013fef52eae869580fe24a6a33efbbba31bfb6379ab5739193c39875a4a4c7f21795ac0b80d91bbc480ac1914f44d8b77a1be9f3d6b2e3da0a2b26a122f22fa9f0709be19d76d1d1b19bc884233617c6839deea41732664e294365b7383b40fdbe271071e721e43a5123e0e55e1b8217e2a22cc9416ecfd293f4d2b336dc35c4953fd7d8b5fb391a889dac5362da54bce9ebbd741592cb42bcda41615a6092bf8966ce0643c07f4822c5fa339e0671a79fc5db6f6125b9af751685659d06f2c86c7ff87e213f367e1c5a9bb09f261e79bde62fa34a60e3b49e5408dd8aa4f35f34e735e6739d7783783b0a4238977fd6e6ae2d4e2f4ca391e592f5a3fbb609b1ae6591a42cd6a5ae039aaff0385ff96bf91c2f4c595118fb6ae47755e9749915fc75897fe2e3044b5dede8813650ff295f8e6ee3bae6ce2be98bf0fca5d9d952170767b0522bc2235ddad2e44184c0920f4818810928ae43e112652b840cc651ba20e85f77b59c7bc0009f999d1bdc846ea76f39bba5d5d81e63817250db0f94fb4a79fc79b19d7119c42838b7a5a54b904d2e808e1fd86f24a789f543118df7c162dafdd04b0e21f0ea97718554ee7aba6e5b807ac72a00c212aca507cf55cd46d5b0d2173f4d41f773d22ee76e318919c00f95f9b4e568d8a213ee25a775bdbc32cf76ad5489f8e6469a1b70645bd007a59625fcf318ced003cefb87b17986c96d0ae7863d48a40259877af10eb0fab0362a19343d52b79de075453f1ce99a14089b7c3223c776e63226a46e0108d515228ce2076bcae387a5c5e470553b5a1ad3a6d5c4435f9c9b82cd78185728f029dbb1e4987c4b6028c58fa3e24418c2d1ff9a03697281bd262b7c991b40c7f71170578215eb46303e5975443d640df31a1ab2ef13d6611ee3e0f4d1b7289289b0e53e4faf5c8ca89d3f654b2be64f96bb2c2ecbf65ff1890aec2cac2c5ad81094b007f12f369a386555a1cfadc552ada2cae042a15e027b23a3f70bc08ae73770729ef140e611e035ca26080a1d33c7c9f198c49032cf6e0585f675c979635fa879a6e509799746d228a7f57c0224e437d5acd9e57b3b3b93ca376d01f858184ba5dd6c0d40edbdbb88be2481e3d71c79a9b54c596bbb6f123991146c5e95a78143abe5dd16d866caef10b14861603cbc4a08ff807eee421f91e8fd7cef2b21094821d62268d5442e9026c82e2109d756ba7fddba3e2a4efad8b6c802dbb012de004cf455826eeba29e81650db455c36d9bf03a661a36a31d27daac943d8e6d8288fe6dd6e2014ba9d3dc9aab907baa901895917b7280e9837024a6cfec795fdfd4ad37f3a4a3d29c7018b0b9f2ac92307c0f7ea6ccb15a3905ee3fea8949c05412049be8773620dfa51648e6cf1fe382e96f18a3de582ba45e03deaeb068c314f77127e469a1f3168f7a3986567125c183777630189b873069992c4a6a7dde53925626a1107bfe4d40703f3d56c69eedfc77f4ab5a81e4318db6a693b26df0dc893fae003fd393122528b6bce21b51d950ba593a660fbfac650a8016a43167e2537005f2994dbe46ee8c6faff575f48f1330a8146b0dd79db50b17d6df1cb90e80d4b41b0df6c82f6f1df6e4eb76c41a797c"}, 0x1004) r3 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x8, 0x10000) ioctl$VHOST_GET_VRING_BASE(r3, 0xc008af12, &(0x7f00000000c0)) 13:36:27 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000000fffffffb02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 961.680665] binder: undelivered transaction 870, put_user failed [ 961.695015] binder: 5141:5148 ioctl c0306201 20000140 returned -14 [ 961.757553] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.773681] FAT-fs (loop3): Filesystem has been set read-only [ 961.788723] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.805458] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.822899] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.840615] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.856905] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.873534] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.891001] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 961.919551] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 961.933196] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:27 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xffffca88, 0x12) 13:36:27 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000055307a33d6c390836be381b", 0x1f) 13:36:27 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000017000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:27 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000000000400e002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:27 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000023900) [ 961.961293] binder_alloc: binder_alloc_mmap_handler: 5141 20001000-20004000 already mapped failed -16 [ 961.974422] binder: BINDER_SET_CONTEXT_MGR already set [ 961.980147] binder: 5141:5148 ioctl 40046207 0 returned -16 [ 961.989366] binder_alloc: 5141: binder_alloc_buf, no vma [ 961.995038] binder: 5141:5142 transaction failed 29189/-3, size 0-0 line 2970 13:36:27 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000f9ce0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) [ 962.038060] binder: undelivered TRANSACTION_ERROR: 29189 [ 962.043663] binder: undelivered TRANSACTION_COMPLETE 13:36:27 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000b5307a33d6c390836be381b", 0x1f) 13:36:27 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000003f02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:27 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000010000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 962.106935] binder: 5162:5163 got transaction to invalid handle [ 962.113731] binder: 5162:5163 transaction failed 29201/-22, size 0-0 line 2855 [ 962.208837] device nr0 entered promiscuous mode 13:36:27 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000005005307a33d6c390836be381b", 0x1f) [ 962.248098] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.265701] FAT-fs (loop3): Filesystem has been set read-only [ 962.272384] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:27 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000000000000000b000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:27 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000200000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 962.327751] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.359352] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.399297] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.415910] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.452813] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.508784] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.557435] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 962.573739] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:28 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x1a0ffffffff, 0x12) 13:36:28 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000030000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:28 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000400000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:28 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000025000) 13:36:28 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000a5307a33d6c390836be381b", 0x1f) [ 962.886778] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.889984] device nr0 entered promiscuous mode [ 962.894048] FAT-fs (loop3): Filesystem has been set read-only [ 962.907222] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.914814] binder_alloc: binder_alloc_mmap_handler: 5162 20001000-20004000 already mapped failed -16 [ 962.925577] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.932902] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.940783] binder: BINDER_SET_CONTEXT_MGR already set [ 962.946526] binder: 5162:5192 got transaction to invalid handle [ 962.952706] binder: 5162:5191 ioctl 40046207 0 returned -16 [ 962.958675] binder: 5162:5192 transaction failed 29201/-22, size 0-0 line 2855 [ 962.959748] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.974423] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:28 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x1) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000380)='/dev/sequencer2\x00', 0x101490, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r3 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x8, 0x400) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00042cbd7000c91e82de010000000c000300070000000000000084a48c9fa2454b31ca258e36118c"], 0x20}, 0x1, 0x0, 0x0, 0x20004804}, 0x20044000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f00000004c0)=[@reply_sg={0x40486312, {{0x2, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x38, &(0x7f00000000c0), &(0x7f0000000100)=[0x78, 0x38, 0x0, 0x20, 0x38, 0x0, 0x0]}, 0x878f}}], 0x1, 0xfffffdfd, &(0x7f0000000240)="f2"}) 13:36:28 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000815307a33d6c390836be381b", 0x1f) 13:36:28 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000600000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:28 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000700000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 962.983153] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 962.992176] binder: undelivered TRANSACTION_ERROR: 29201 [ 962.998900] binder: undelivered TRANSACTION_ERROR: 29201 [ 963.005981] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 963.042682] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 963.083886] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:28 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000007000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:28 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000023f00) 13:36:28 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000007fffffff02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 963.136385] binder: 5204:5206 transaction failed 29189/-22, size 0-0 line 2855 [ 963.422330] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 963.444257] FAT-fs (loop3): Filesystem has been set read-only [ 963.467180] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 963.477530] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 963.478263] binder: 5204:5206 transaction failed 29189/-22, size 0-0 line 2855 [ 963.494270] binder: undelivered TRANSACTION_ERROR: 29189 [ 963.502152] binder: undelivered TRANSACTION_ERROR: 29189 [ 963.515518] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:29 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x200000000000000, 0x12) 13:36:29 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000008000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:29 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000c77b6d859102000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000f0005307a33d6c390836be381b", 0x1f) 13:36:29 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x2000, 0x0) sendmsg$nl_generic(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x18, 0x2d, 0x620, 0x70bd29, 0x25dfdbfc, {0x18}, [@typed={0x4, 0xa}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) getsockopt$inet6_int(r0, 0x29, 0x17, &(0x7f0000000200), &(0x7f0000000240)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1602"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000002c0)={0x0, 0xd93}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r3, 0x84, 0x78, &(0x7f0000000380)=r4, 0x4) [ 963.537613] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 963.569897] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000c005307a33d6c390836be381b", 0x1f) 13:36:29 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000000000000000a000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 963.622763] binder: 5224:5225 unknown command 534 [ 963.628475] binder: 5224:5225 ioctl c0306201 20000140 returned -22 [ 963.662589] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) 13:36:29 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000ffffffffa001000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 963.688348] binder_alloc: binder_alloc_mmap_handler: 5224 20001000-20004000 already mapped failed -16 [ 963.700369] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 963.727845] binder: BINDER_SET_CONTEXT_MGR already set [ 963.734151] binder: 5224:5235 unknown command 534 [ 963.739766] binder_alloc: 5224: binder_alloc_buf, no vma [ 963.740988] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 963.745862] binder: 5224:5231 ioctl 40046207 0 returned -16 [ 963.758445] device nr0 entered promiscuous mode [ 963.758641] binder: 5224:5229 transaction failed 29189/-3, size 0-0 line 2970 [ 963.768735] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 963.771358] binder: 5224:5235 ioctl c0306201 20000140 returned -22 13:36:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000f005307a33d6c390836be381b", 0x1f) [ 963.787727] binder: undelivered TRANSACTION_COMPLETE [ 963.794231] binder: undelivered TRANSACTION_ERROR: 29189 [ 963.811570] binder: undelivered transaction 878, process died. 13:36:29 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000fffffffb0000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:29 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x100000002f60f) 13:36:29 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000e000040000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 964.129668] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 964.144687] FAT-fs (loop3): Filesystem has been set read-only [ 964.159895] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 964.194434] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 964.204259] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 964.231736] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 964.252846] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 964.270840] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 964.280104] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) 13:36:29 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xffffffffa0018000, 0x12) 13:36:29 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc004240a, &(0x7f00000000c0)) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000500)={0x10000009, 0xffffffffffffffff}) 13:36:29 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000300000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000e005307a33d6c390836be381b", 0x1f) 13:36:29 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000040030000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:29 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000023800) [ 964.296481] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 964.304553] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:29 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000e5307a33d6c390836be381b", 0x1f) 13:36:29 executing program 2: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/vsock\x00', 0x4, 0x0) syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0xf4, 0x80400) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = getpgrp(0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, &(0x7f0000000180)={[], 0x9, 0x7ff, 0x2b5, 0x2, 0x4, r2}) fcntl$setstatus(r1, 0x4, 0x4000) fcntl$setown(0xffffffffffffffff, 0x8, r2) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001300)=ANY=[@ANYBLOB="5d054dbbdeadf16828985ccf5b7c60549c5e9bd2d547d8c1b4ebd2e1ab54ff3d7d945162452df244694c8ad010439c3d622b9c101e2d3053802319c0fe3468c39a1587c47420111e9d81aafd6ad5b5417bce2479dc2b22c1b6cca5e1890ef311b01ad609a0e74399c8390e5a5fde09cbe4f9b81ecefb2fa2f47a14662763f18a9f1089a84e1b4b5ce241a5ca0fd32f91ac251517311961fce8d0690ebe4ed56049a1b09b09880ce65376316448732cdf79c7affc97cead7f3423d71f952f6b1ff6e7bc9905845bad64d5ee319f61a19667"]) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_int(r3, 0x1, 0x0, &(0x7f0000000040), 0x4) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r4 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000002080)={{0x0, @local, 0x4e21, 0x1, 'lblc\x00', 0x8, 0x2, 0xd}, {@multicast2, 0x4e24, 0x3, 0x0, 0x0, 0xffff}}, 0x44) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "94d4341307ee5d4501d9f99b60ff2618833263db3afce629f579d0956535eb893d885a358beb7c3251f0f29874bc643a28779214cd4d8b975beeff8780d29f6c", "9a65c9632090ff2319a1f977c69149162db3db7768da42b7cb2b14a4b98944a9"}) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) r5 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x105082) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001240)='./cgroup.net/syz0\x00', 0x1ff) r6 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r6, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r5, 0x4c00, r6) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x20000, 0x0) sendfile(r5, r5, &(0x7f00000ddff8), 0x102003b00) syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x9, 0x240040) ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f0000000240)=""/4096) write$P9_RAUTH(r0, &(0x7f0000000080)={0x14, 0x67, 0x1, {0x20, 0x80000002, 0x14000005}}, 0x203) ioctl$UI_SET_LEDBIT(0xffffffffffffffff, 0x40045569, 0x1) 13:36:29 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000070000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:29 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000003f00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:30 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000f5307a33d6c390836be381b", 0x1f) [ 964.596851] Unknown ioctl -2143271643 13:36:30 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000006000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 964.618365] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 964.629819] device nr0 entered promiscuous mode [ 964.634821] FAT-fs (loop3): Filesystem has been set read-only [ 964.643602] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c8) [ 964.715634] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 964.717016] Unknown ioctl -2143271643 [ 964.730548] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 964.751774] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 964.761312] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 964.775837] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 964.783984] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) 13:36:30 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xffffa888, 0x12) 13:36:30 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000091856d7bc700000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:30 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000014195307a33d6c390836be381b", 0x1f) 13:36:30 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) 13:36:30 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000fbffffff00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 965.310643] device nr0 entered promiscuous mode 13:36:33 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020ff6) 13:36:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000009005307a33d6c390836be381b", 0x1f) 13:36:33 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000240)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f00000003c0)={0x9, 0x108, 0xfa00, {r1, 0x0, "cc2281", "ba72996b012e97b5de02fd04df0853856c143fa9c71bf9b678e18dc3be2ebc53137e44bc3641691d098ed4c1e79092761a945fa2d0ea7c86a7df24662a6f7eda91d90d193d69c3c9e4deea5c1ea5f3bec08af5e63ae97c6e7f28c7e3875cef99652378858ee8609a5e2f95a6a4351583585bf720b59871b28d4bf82aac50233d5805aa5202c237be19af6f66bdd86ad17370bf85806d5b7929b70247d1c42af63783522df13e0fe384c6261983c8eeeb6a9022b65fde0298afef19cb11358c9026f28799a969cee20b6bbe8731edc44748cbf795b70de157a500d1f859e214d38d7737a5f0590a9313f563f04f5ce40568e9668c4398582575978e2b0c10be74"}}, 0x110) 13:36:33 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000002000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:33 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000020000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:33 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8906000000000000, 0x12) [ 967.721287] FAT-fs (loop3): error, fat_get_cluster: detected the cluster chain loop (i_pos 16) 13:36:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000d005307a33d6c390836be381b", 0x1f) 13:36:33 executing program 2: setgroups(0x0, &(0x7f0000000000)) ioctl$KVM_S390_UCAS_MAP(0xffffffffffffffff, 0x4018ae50, &(0x7f0000000080)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x80000000007, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0x2, 0x80000001}) 13:36:33 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000602000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:33 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000a001000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 967.883075] device nr0 entered promiscuous mode [ 967.893888] usb usb5: check_ctrlrecip: process 5316 (syz-executor2) requesting ep 01 but needs 81 [ 967.938240] usb usb5: usbfs: process 5316 (syz-executor2) did not claim interface 0 before use 13:36:33 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000004005307a33d6c390836be381b", 0x1f) 13:36:33 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)={0xf, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f0000000600), &(0x7f0000000200)}, 0x20) socketpair(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f0, &(0x7f0000000300)='0\x00') [ 967.978870] usb usb5: check_ctrlrecip: process 5321 (syz-executor2) requesting ep 01 but needs 81 [ 967.996200] usb usb5: usbfs: process 5321 (syz-executor2) did not claim interface 0 before use [ 968.039285] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.052144] FAT-fs (loop3): Filesystem has been set read-only [ 968.061226] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.078177] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.103865] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.116734] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.147773] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.163175] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.185458] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.235502] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.242818] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:33 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020035) 13:36:33 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000002002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:33 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000000000fffffffd000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:33 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000ffffffffa001800002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:33 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000300000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 968.549981] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.570860] FAT-fs (loop3): Filesystem has been set read-only [ 968.578473] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) 13:36:34 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x88470000, 0x12) 13:36:34 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000f05307a33d6c390836be381b", 0x1f) 13:36:34 executing program 2: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000023f00) 13:36:34 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000702000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 968.596246] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 968.603597] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) 13:36:34 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000007fffffff00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:34 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000c5307a33d6c390836be381b", 0x1f) [ 968.707883] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 968.738597] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) 13:36:34 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000019145307a33d6c390836be381b", 0x1f) [ 968.788748] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 968.822979] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 968.842479] FAT-fs (loop2): error, invalid access to FAT (entry 0x000006c9) [ 968.860134] FAT-fs (loop2): Filesystem has been set read-only [ 968.871683] device nr0 entered promiscuous mode [ 968.882828] FAT-fs (loop2): error, invalid access to FAT (entry 0x000006c9) [ 968.891642] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 968.902976] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 968.911467] FAT-fs (loop2): error, invalid access to FAT (entry 0x000006c9) [ 968.921008] FAT-fs (loop2): error, invalid access to FAT (entry 0x000006c9) [ 968.933590] FAT-fs (loop2): error, invalid access to FAT (entry 0x000006c9) [ 968.943427] FAT-fs (loop3): error, clusters badly computed (8 != 9) [ 968.951257] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 968.960079] FAT-fs (loop2): error, invalid access to FAT (entry 0x000006c9) [ 968.967771] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 968.982269] FAT-fs (loop2): error, invalid access to FAT (entry 0x000006c9) [ 968.990761] FAT-fs (loop3): error, clusters badly computed (8 != 10) [ 968.997587] FAT-fs (loop2): error, invalid access to FAT (entry 0x000006c9) 13:36:37 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020004) 13:36:37 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000100000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000008005307a33d6c390836be381b", 0x1f) 13:36:37 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000070000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:37 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$security_smack_transmute(r1, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000040)='TRUE', 0x4, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\f@\x00\b'], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:37 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8035, 0x12) [ 971.695048] FAT-fs (loop3): error, fat_get_cluster: detected the cluster chain loop (i_pos 16) 13:36:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000007005307a33d6c390836be381b", 0x1f) [ 971.750864] binder: 5374:5375 unknown command 134234124 [ 971.766889] binder: 5374:5375 ioctl c0306201 20000140 returned -22 [ 971.793043] binder: undelivered TRANSACTION_COMPLETE 13:36:37 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000fffffffb0002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 971.830246] binder: undelivered transaction 881, process died. 13:36:37 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000fffffffb00000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:37 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000060000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 971.904568] device nr0 entered promiscuous mode 13:36:37 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000c4ce39f81e02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000035307a33d6c390836be381b", 0x1f) [ 972.000849] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.058753] FAT-fs (loop3): Filesystem has been set read-only [ 972.075595] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.094597] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.140361] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.193630] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 972.225834] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 972.268903] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 972.298789] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:37 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x10000600e0000) 13:36:37 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000500000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:37 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000040000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000075307a33d6c390836be381b", 0x1f) 13:36:37 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x19, 0x0, &(0x7f0000000180)=ANY=[@ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYRESHEX=r2, @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYRES32=r1], @ANYRESHEX=r1, @ANYRES64=r2, @ANYRES32=0x0, @ANYRES32=r0]], 0xffffffffffffff91, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:37 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x3f00, 0x12) 13:36:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000f5307a33d6c390836be381b", 0x1f) [ 972.398169] binder: 5403:5405 unknown command 536871104 [ 972.412129] binder: 5403:5405 ioctl c0306201 20000000 returned -22 13:36:37 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000d5307a33d6c390836be381b", 0x1f) 13:36:37 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000600000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:37 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000003000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 972.607883] device nr0 entered promiscuous mode [ 972.630768] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.644723] FAT-fs (loop3): Filesystem has been set read-only [ 972.658746] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) 13:36:38 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000700000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:38 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000085307a33d6c390836be381b", 0x1f) [ 972.676240] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.694882] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.727033] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.741117] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.775796] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.788794] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 972.824966] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 972.841568] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:38 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000041000000) 13:36:38 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000003f00000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:38 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000095307a33d6c390836be381b", 0x1f) 13:36:38 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000200000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 973.130773] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 973.145251] FAT-fs (loop3): Filesystem has been set read-only [ 973.151499] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) 13:36:38 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f00000005c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000340)="06bab497b2b0a756438849b08f90a3eee663e009e74cc639d92906d730072e2e0899266384685f4358ee15118ab9bbfe1df34e0cb9fedc2e01ab78ec94d92fa3ff26a3b2ed523b75b81b412313640b27c46fc9a3af9335909b9580c2b17eb8ef2f3234af4ea14a3c1d8b6b45ffc5e4d36d3e66b581c12448007f6028d9624a14f6eb48448d5c7f616bb49b370ce1fb4a5d28cc22a9a0c30df70b1513dcc67dc9e0948b40c62d35f5ca093a49ce69dd729bf71cd1cc02da5abea75a7bff2c28c6b5c9f542292a4c7886f3e335f16938c51ec75679053532e7c2d4eaed1bcccdedf9c6e1e114d835fb4be8891b37d8deabdcb4499b8ad0750231e42f51fa70035f") ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="fd004a315a9b0792b32a9f2f4284ce765032cfe4041636ef94ce815801b8784b7fe7a94d404cf28b21ca5cdc600de52453f1835644bf30c6880bcc28e9c3b3ac255b53cf681bf403cc238a6c56a1772f1b704f94e627e8cc78ec5640428d9c40c3343a33990b3a2196116924fcd5dd5d33fb159506f078b8682b7d48f9aee0bc0e87fa84b80b05abdc91ce78965ee70917a583c0783550b10d3126c39bbf49b8c67ecb5c"], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000000)) r3 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0xffffffff80000000, 0x28000) ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af21, &(0x7f0000000180)={0x1, r0}) 13:36:38 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000003000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:38 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000050000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:38 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000b5307a33d6c390836be381b", 0x1f) 13:36:38 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x6488, 0x12) [ 973.188086] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 973.201665] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:38 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000045307a33d6c390836be381b", 0x1f) [ 973.248696] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 973.274812] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 973.288888] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:38 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000005000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 973.312246] binder: 5446:5447 ioctl 41009432 20000340 returned -22 [ 973.325508] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) 13:36:38 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000102000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 973.357121] binder: 5446:5451 unknown command 826933501 [ 973.369876] device nr0 entered promiscuous mode [ 973.379134] binder: 5446:5451 ioctl c0306201 20000140 returned -22 [ 973.400389] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 973.411744] binder: undelivered TRANSACTION_COMPLETE [ 973.426298] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:38 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x10000b0030000) 13:36:38 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000065307a33d6c390836be381b", 0x1f) 13:36:38 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x2, 0x12) 13:36:38 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000400e00000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:39 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000000000000002c000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 973.496089] binder: undelivered transaction 884, process died. 13:36:39 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000600000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:39 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000007fffffff0000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:39 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000300000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 973.872935] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 973.891991] FAT-fs (loop3): Filesystem has been set read-only [ 973.907240] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 973.941808] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 973.954007] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 973.990274] device nr0 entered promiscuous mode [ 974.007701] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x1000000, 0x12) 13:36:39 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000e00004000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:39 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000025307a33d6c390836be381b", 0x1f) 13:36:39 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000fffffffb000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 974.031454] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 974.054014] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 974.075846] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 974.111861] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 974.121994] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:39 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020ea0) 13:36:39 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000055307a33d6c390836be381b", 0x1f) 13:36:39 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x2, 0x12) 13:36:39 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000001000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:39 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000fbffffff0000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 974.240323] device nr0 entered promiscuous mode 13:36:39 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000a5307a33d6c390836be381b", 0x1f) 13:36:39 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000050000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:39 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000035307a33d6c390836be381b", 0x1f) [ 974.444089] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 974.461357] FAT-fs (loop3): Filesystem has been set read-only [ 974.474362] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 974.490803] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 974.519842] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 974.538948] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 974.555446] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 974.572174] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 974.587595] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 974.619632] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 974.637079] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 974.708496] device nr0 entered promiscuous mode 13:36:40 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000400300000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:40 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000008001a0ffffffff02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:40 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020002) 13:36:40 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x88a8ffff, 0x12) 13:36:40 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000c5307a33d6c390836be381b", 0x1f) 13:36:40 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c0000000e5307a33d6c390836be381b", 0x1f) 13:36:40 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x2, 0x12) 13:36:40 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000075307a33d6c390836be381b", 0x1f) 13:36:40 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000006000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:40 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000004003000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 974.931843] device nr0 entered promiscuous mode [ 974.941905] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 974.952477] FAT-fs (loop3): Filesystem has been set read-only 13:36:40 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c00000000530fa33d6c390836be381b", 0x1f) [ 975.001666] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.029476] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) 13:36:40 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000005000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:40 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000001a0ffffffff02000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 975.075793] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.090209] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.124536] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.148308] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.165011] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.201738] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 975.218395] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:40 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000340000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:40 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000010000000) [ 975.430427] device nr0 entered promiscuous mode 13:36:40 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x3f000000, 0x12) 13:36:40 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000020000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:40 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000a00100000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 975.556639] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.570304] FAT-fs (loop3): Filesystem has been set read-only [ 975.576955] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.584867] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) 13:36:41 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000fffffffb000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390f36be381b", 0x1f) 13:36:41 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000060000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:41 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000040000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 975.602267] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.623884] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.645699] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.676694] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.692087] device nr0 entered promiscuous mode [ 975.697077] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 975.707536] netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'. [ 975.716898] netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'. 13:36:41 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000e0000400000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 975.718160] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 975.735099] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c391036be381b", 0x1f) 13:36:41 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xd000000, 0x12) 13:36:41 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x10000e0090000) 13:36:41 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000040000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 976.051273] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 976.070834] FAT-fs (loop3): Filesystem has been set read-only [ 976.098725] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 976.128681] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 976.138177] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 976.155235] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 976.163648] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 976.184564] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 976.193824] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 976.201286] netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'. [ 976.215326] netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'. [ 976.233079] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 976.259350] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 976.273369] device nr0 entered promiscuous mode 13:36:41 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x800e, 0x12) 13:36:41 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000a00180000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:41 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000005000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0xfdef) 13:36:41 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x10000d0040000) 13:36:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0xec0) 13:36:41 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0xd000000, 0x12) 13:36:41 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x2000009f) 13:36:41 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000003000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:41 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000302000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 976.521160] device nr0 entered promiscuous mode 13:36:42 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x33fe0) 13:36:42 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000007fffffff000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 976.654759] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 976.668792] device nr0 entered promiscuous mode [ 976.675597] FAT-fs (loop3): Filesystem has been set read-only [ 976.695551] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 976.708299] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 976.727680] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 976.745611] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 976.763106] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 976.786107] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 976.806184] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 976.857278] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 976.870268] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:42 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x8848000000000000, 0x12) 13:36:42 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000202000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:42 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0xf) 13:36:42 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000002000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:42 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020034) 13:36:42 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0xfffffdef) 13:36:42 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000302000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:42 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000fbffffff000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:42 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000003f0000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:42 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000040)=0x0) setpriority(0x2, r1, 0x2) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x28002, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@ipv4={[], [], @multicast2}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast2}}, &(0x7f00000002c0)=0xe8) connect$packet(r4, &(0x7f00000003c0)={0x11, 0x16, r5, 0x1, 0xb3, 0x6, @remote}, 0x14) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 13:36:42 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0xfffffffffffffdef) [ 977.212729] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 977.251598] FAT-fs (loop3): Filesystem has been set read-only 13:36:42 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0xc0) [ 977.269496] device nr0 entered promiscuous mode [ 977.275222] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 977.304212] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 977.333394] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 977.361511] binder: undelivered transaction 886, put_user failed [ 977.375381] binder: 5639:5643 ioctl c0306201 20000140 returned -14 [ 977.391916] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 977.415370] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 977.422895] binder: undelivered TRANSACTION_COMPLETE [ 977.455099] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 977.475369] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 977.506865] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 977.514872] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:43 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000502000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:43 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000034000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:43 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x10) 13:36:43 executing program 2: r0 = socket(0x0, 0x0, 0x1) setsockopt$inet6_buf(r0, 0x29, 0xcd, &(0x7f0000000180)="0158611407c729864a936d7ecdaa70e52d73b12951d7ea67963d5edafe23d95dad02daa629499c250e781263b539d460f6e090aa2be58c5e7a639fc91c79969d60c988bca0cfb5252c6ff3a7a8262ce47484fff51f820ab109704fd9394ff6b41d4d9e377334c5410706d6c63fbb86feac5ab9d0d0589e1ac21c2852ebbee0fa43b94f7ad1f2bc24092c2ea407a43bd681aea71accbde9a4312c6e35ae85c872420920c10ed18c3a73f29ccf676c2c88be7364b787acc83be8d32195b2edd7c6", 0xc0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000807, 0x3ff) setsockopt$inet6_buf(r1, 0x29, 0x22, &(0x7f0000000040)="ff02040000eeff00000000000035da", 0xfffffe9a) sendto$inet6(r1, &(0x7f00000000c0)='E', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [0x8dffffff]}, 0x9}, 0x1c) 13:36:43 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x81000000, 0x12) 13:36:43 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x100000002300f) 13:36:43 executing program 0: syz_genetlink_get_family_id$nbd(&(0x7f0000000000)='nbd\x00') r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:36:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='id_legacy\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)='cpuset\x00', 0xffffffffffffffff) r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0xfffffffffffffffa, 0x289c0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x4}, 0x1c) 13:36:43 executing program 0: socket(0x1000100000010, 0x2, 0x0) 13:36:43 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000002000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:43 executing program 2: syz_genetlink_get_family_id$nbd(&(0x7f0000000000)='nbd\x00') r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:36:43 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000402000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:43 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x18801, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(r1, 0x80046402, &(0x7f0000000040)=0x9) 13:36:43 executing program 2: ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000080)={'ip6gre0\x00'}) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000040)={0x0, 0x8}) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='fuse.', 0x0, &(0x7f0000000180)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) [ 977.973563] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 977.979986] device nr0 entered promiscuous mode [ 977.987154] FAT-fs (loop3): Filesystem has been set read-only [ 978.000108] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) 13:36:43 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000070000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 978.042658] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 978.064279] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) 13:36:43 executing program 0: r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000540)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x10, 0x80000000) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f00000004c0)) r1 = socket(0x1000100000010, 0x2, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000280)={{0xa, 0x4e21, 0x455d, @empty, 0x3}, {0xa, 0x4e22, 0x8001, @local, 0x3c}, 0x80000001, [0x6b9f66e0, 0x3ff, 0xfff, 0x4, 0x800, 0x4, 0x5, 0x1]}, 0x5c) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000000)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000000100)=0xe8) pipe2(&(0x7f0000000340)={0xffffffffffffffff}, 0x80000) ioctl$EVIOCGRAB(r3, 0x40044590, &(0x7f0000000480)=0x8) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000380)='/dev/mixer\x00', 0x800, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0x40a85323, &(0x7f00000003c0)={{0xffffffffffffffff, 0xe1e9}, 'port1\x00', 0x0, 0x1000, 0x1, 0x69, 0xfff, 0x1000, 0x9, 0x0, 0x4, 0x400}) setsockopt$inet6_opts(r4, 0x29, 0x37, &(0x7f0000000300)=@hopopts={0x1d, 0x0, [], [@pad1]}, 0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000140)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8) setreuid(r2, r5) [ 978.123072] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 978.148514] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 978.172075] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 978.191644] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 978.238837] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 978.257285] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:43 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x300000000000000, 0x12) 13:36:43 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000008001a00000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:43 executing program 2: r0 = socket$kcm(0x10, 0x3, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$KDENABIO(r1, 0x4b36) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[0x8]}) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f00000001c0)) sendmsg$kcm(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000080)="fb00000066000152bfa9d345e7eb8dfe204ee2d7080000000600000000000000801d5291d76b8c67452107132daffa33021eb82169b94b598296263578b72935c922974adced71c22b987fa68c5bb731c5f64e93ea793c262f67b56acbb4bac0c4c4f9d0c4437e99c25a7d9d3ffd47893808c33b047f720f4e89978112322628c7a1fbab650cdc797d32d3524ea85b198cb44a83c011d2572f9291431da2f42c88d613be8f1376090e88a06412d5160d7f1b0f47d951f5f7a371a86105ea0ddbad539ef278168ac8d157a6366ccec93f9fb8f100437172ff070000000000008e9234feee7baa2acd2683d489e1cadfd1a06f990000000000000000", 0xfb}], 0x1, &(0x7f0000000240)}, 0x0) 13:36:43 executing program 0: socket(0x1000100000010, 0x2, 0x0) 13:36:43 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000003f0000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:43 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020006) 13:36:43 executing program 0: write(0xffffffffffffffff, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 978.498324] netlink: 215 bytes leftover after parsing attributes in process `syz-executor2'. 13:36:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff5c, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) r1 = dup2(r0, r0) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB], 0x1}}, 0x44801) sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000880)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000000004}, 0xc, &(0x7f0000000840)={&(0x7f0000000700)=ANY=[@ANYPTR=&(0x7f0000000680)=ANY=[@ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB="a613f9714864fc33948eba9a50340442897ec1c9a73466b49b708d27f8a986ad5970cc06408fa7452be3905c9800770f93640cf50d49e95b97f95618d583b222e5cc65fa9c2fbbfa57da921cfea5df4967492719f9124c8ffc19c08e14cb90c495ca82a74b371afdf79f360b5c11ea3a0a6ec553f2302586cacf39902b488df8e147916b57c09c38b6308d7d6de83be847e95f6dc2f4a28331202ca62b5e8945e4e8e0f1ecb30a5a489a112a6aba9851b0cc616eba6ae03202950187f4f3d66961784938317877fa20fc6141cf58eff6a398f41fba606cf3ae960000000000000000000000000000000000000000000000000000000000008a6667942c60e6834d8a11e70dbfb69c45c3a4aedde5ead044a22e220b2f10dc258ee29c37fb38a0e047174caaca4eb2bb4b9dfa99d4"]]], 0x1}}, 0x40002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000380), 0xfdf5) sendto$inet(r0, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f0000000000)={0x2, 0x500000000000000, @empty, [0x0, 0x3e8]}, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000180)={'\x00', {0x2, 0x4e20, @remote}}) getsockopt$inet_buf(r1, 0x0, 0x0, &(0x7f0000000340)=""/39, &(0x7f00000003c0)=0x27) clock_gettime(0x0, &(0x7f0000000240)) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000300), 0x8) 13:36:44 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) r1 = syz_open_dev$midi(&(0x7f00000013c0)='/dev/midi#\x00', 0x9, 0x40) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) r2 = msgget(0x0, 0x401) msgctl$IPC_INFO(r2, 0x3, &(0x7f0000001180)=""/149) r3 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x1000, 0xa000) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000010c0)={r3, &(0x7f00000000c0)="b82f056dc96f827c3ff999bd4b36d7385553d80d38fa6de8d20313bdb90445734ff1ddfd00424cdb1610909b5d8188e2c87ef1a02b7ac36d618510c2a1f80213b91acef7d0cdb0ee8dd31a55a57a49956f32d313aa9fc04129ff14f35b27bab58d50a7f4fb373dcaf293fe2ba0ea8a80f9e1d02a65a6f226b9f6c4743458886c941b0f7b412e4f64bfedc33b66828834b511154a9d95bc500169a023667f756ff67332282873dea34ac3b7f4d066b9250b8958f423df3d2a8b91b758f0fbd16a3a59569b0461775a8f0ac75b1ce264c06500e1c510837ec2df045fbf12215912bff1467495ef5daa21d1a9f4446c914d7f0b40f5114e62d5e7bcabd7af4f23499845c05c26f328a5333fd0907b0034fa9a56400a4fd380e529a273689c5657b1bd0b5382e4e0c794e1482826b6044cbd86295ba5095417d9c9f1199d684cc31b620c68b1bc8abaf913c4397758b0738d716acf67788aaccd59a2e6f925a1de50f51dead29ff60e06dbbfabf0347d5eb64a3f1081f66bca1b6404ab5206719cef5d9b0e9d4decf7d448e18ece201abf4fca51b4611b7dfbc632968d8efce59978e50158712fe054670e6ebf117f63b35b52c77f24c929707d01d9775b974d71e13e33c92c28317cc58ef5acfe9bcf63df5922726dde98c868c1336eb9bf2d9198bba1b62669a8a99cde611656fd2e8f155da80c3bbafacf307c4ee0c60934d5ecaddd6a9d9f128e4846bc26a3adb2b81515a54a31517cf5f5ffa48d6c3ae9c36114a4f649c85291edc4b3d7b03ace29ec12dbec519d96d23476039974571111866a1490d9d7735f5c83dd4e9be5a811b6d0e5f2d641f5adbffa29f427521d522cbc76d899d7fb06ecc6f2603230fcd933a4cd2b23cd0cdee009ee7c64f579f1ada8283d11c44347e12cf4a008d48f53656d4e3c39181159585958a430c6222d796a9849852fcb6b89994cec3309457a08aab8140311f0217e6623611b393a1941acfabb7b5c07f46211ff05184622ce6ac30e5d2ed31b5736bc5369e056233bf7fb699eb49b2efd8856846fd43c476147aad1ec54bc26f9aa057e857dd5739d868890d134af999d19f33343b02dc35ae07606d28e7ddc3d1adafe14169e7e1cf36e6b404f92c8d785ffc700a94e9eaa2961f56a06cd461471f22372e9d193e1e9dd594f8240fa41f3051ff7dde1e95f9191aa0aa1273a4947192fb4feeb08f2a9fb914119ca699ae0fecaba70278718ec83fd80276c57e0308f3a5bfc8988ad973ef8500f0495a1c02932153268423777d703cd4665db1c11d34691085498aab671d500f9c4d30a6d1c92d0fce03ab09ee439ffc10fdb99c42c804611d4e7967026958bb3f91ff6fc3d1114959997f06380bd7cb1e627235867bc520c89e2112b06d1acab1bcaef9f184a218afa16730549afcab93197f4301ee4126bb9d5c0464802431c34108d0718c59004e088cef04d07b49b5e1f179ff36a8fdafe9ea498143f32fabff9a2cb0f86fdb0e5015e7615e1d81fe85a3198b86d80bfd6df3765ca181cd4af76e2f2d20979701761a83e92ea950a7d102abd41e6e60112b6d50d6ffb48a9b4b6828f033fd362b0a41d074e46c29295c05e99858b37f45aebe82d9179464979fe45a4e366ea95cbb274c0722b49eda5d7c917c3c2a66d447ac8a18c67dca5b9c438a0ef21e176b1654e7a9b64ac41ee7192059611ba221a32666c15bcd3d7bc16c760b68cb3760dae1b3a3d51b958c0d80000ebb976090f8a44988cbece40f42e094f4c07c5279bdc487f7a420ac4bc752349f8bc7be8ad288fdd9d9235f9859c208e7c0b171cb034de6aff5c05540c558ff32b7ae0c93ef9c97beb098211a25282289ef882d5fccd0967a7726e0515172f5e1e796654d421f95adfb495744de5e3881d2741bd073826e237b76cd8faa821e87157864fe4b5e731ce631f44a31a291ef0849713c46c964b13418ac585f1d05c8e185672e1cd978c738f96545b6d455e618635859304144a22fc7f138f8d6f37c8564fbc28ac9c5219c2ae8ae8e6cacf37bba08756a40b594b960803df020c51d0a420cc7fa40f4a0bdc7d77ab885290d05081e2a9321fe96996e4402f9d46569a12893cfebb465a328d61bded6199293301ecdf4b46011c9c5904331b1140dc95de1019bf4593ba557a3bce97c7e240dcc8b85b225dc674179d5444d51e614d0fc31cec0346a404ff8b10ff740352cc053f0f79602f5c4a3867bb6938c5aaeae5f1050bb80ef80f39531d89d005b747a94004616a47264309aa6dc70c4216026c3092fb93c77f6ee47ad3a1e988b03aad015c66d7b3a6353983fe7d64bab91d88805f96b26904ab8b453b49be28bde0e28bc93b743f43ad6d4cae7eaf8c06fdcce1450c65cb6adf623fd02e8a7280424042c7671dd1eb2e3caecc2b9a13a40cb51dbdb23e2cb17a55943fbcb961921091a306d1719cac5d90cd6e13370a22d71c0745dccd9160b162b0df5e3f74422abd84a755ef737bb8867c7b0694b7785cebd96f315a13e88e8378ffbef854b230fe7755c27f0ebf2e1e01bc2a402acc795196ead28e89cadc31ea74105b9d7e18dac2392a9b1f80e155b9e4d0d874043e867c481e04a5c8e90807a7b0984215f7f2aa19a0e8008d72524418dafef34eaf032428b189fa25c4d53fa3f3642dd0920d844c422f71327fcbeacfe0f7787bdbb48ecb9b5fa12e913ebb95a1cfe7e358150b555c63bbd1ab1df94b5161ee87dc5948df9e5c6d9a236103c0fb64921424240d9f4d448cada196cf17cbd7ab5af199c691ab1d0502ba915cf37046c43195914c30821fd477c4bcdf59c5ae8abe2028e716e79e08281fec2622ca817c68835e528dd9e0e2db83ade2c46fecafac0a810d40d0028cc5947b340663ed5f86af188b61c6d5656d34248c7bdec104a582d41e44d4668e58cb0b9c7868b392bb9dcad3799405ad733472152ba4aea2f4192a63ff38e5e179b36fb677d232719e3740725b946506c164420d3ac3c2d91eaad502c4d8e57bbae2ed8e13afa1e1332a77bc7f4b0f506e3c6129847812c57adf562a705089d375320adcea43e34945811ac3082ccabcec67f8f925ce667ad1c84a1b160e6a5ccb0bff3b821c571836301c5da949e683b0a4cdcfcacd3d7a948154b6083214c3fb921c6a70015387e608f3f62d695ec33a3b3e90d9582a00e1ba15f1e2e3eb2380020af72918ed6c6aa0abf2238a27e2b6966b9aa5d15687793465a35ef3a54ac23ec27e104ee16cf1ec4c48745ea1eeba0243485fa177926c3bcdd53e9ff286e0c2c86349354053143626daefb57112ece9997ab0b072d66ad8a410af4725655ed6e452746b18f0cdb19ed1b9efab609aff30eabd0b89aace8911afa3b5a74d9445dc42cb331774091c212bc544e7a5a9d9e4aab853da6e5b85c1628f0ed4d92c9f27d63adf1591dd54a290540c7009b4caebeeacc2b8e888cbfd63e20cd193a5f56ea0aabe107b71c37363bbff0ff8cf1e4f1715810fa5c73a54450f33430b4786e370c22efa0e0da205a1f937a44642c67cec4a6779cf629a96be918d0a8c5478f7d332a93f0d59f6c56b4d469ebccf9efc56498a077448c4e98a9080f8c20517992c960a636bab9e4205f1a27f52ec580dda49e7fa3c5e8bb3def39163a4a84c5f37b8a565a827fd88fd575d746a4b9ca12228f8bffe743d1e3cc28ebe9932d910bb44312cdb5ac82a32e9902901e90bb8a9c1611ac4fb4ebedea1bb7b71f51534364eab6b105ae7157375781b1481b8d158218c38bdf7dd3b66002cd23f71b4755d126ce6950b25593af695bb480e9fb5527ae9820aaa08b8a1c839ede9bd248162c0de34561fc83e59f7481293f7e802a9646c982e2647c6383ca17ac9dabcac62c7b76243d03ff6d4901e83b247a9b067e9d4f475ed63cc76f2820b19784da2672f2eb1bf507d5e9eea5c49f7f34c721da1982410d6a312dc7ab8a26ac7cfd97f72a0a23da4642193d47603a866d3e664f9d484f8ed00554b3706667ae508c27edb9d6fe1445181e14751549de0e6dd388fe3a546623dee6be14381f56d5694ca3b15642a9f203041c6ea7074309d74b58d9bb9a50fbf6c88258edaeb3fab8ac9f8a3ce0bb14896323d43a93574395e93d7c53dd74b27bc541268fffcd74a1b1a8e61e04df41db82a1b713ebf290b2f260d8542516db03609811bfb1a1ef3f229be93d94fbb48d97191749987e9ed0e3e6e4a8903e03078e10f9e96a6d8d42acedc7be0a14a48738b7c234724a3bf6765b6a225bec992a186e265f8b0516f80eb46ff65d1ca8ff42082628cbfe4643b4f29e7163a8a4ee041aabcefefec62ec1ddcb11495d44a07cddb89b0718817e7ef0082466a77f9aa31c618824b2f4944a993f4e2929af2a14e83dc4ca84162f50de5546cd27bdb10126e52dea816d8ba0fe2cef0fe3d28a93bb18000519369acdd54428aacee88abc1c1beac768bcaca0abff106654452c55e2ba4e1c6444d85d3b1f2e02c9765268ac4a1e85282d37016393c6e65d5d42514b187d24b99786c44124e60558b125a7bb9d90b719839c6735839609c1a98e22099ab1de426d69cb48ad858d59d79277b2d0ce68f9d1d245dead95ae4eaf6a3ee5a2bb3175faa2d4c5b1439d77f86ae73b74f63b8d9191c7ad19d3730e422cd971b9ead064f06c2fbd4c90910d98231bd596f4b4ae465c6fc2e5e3d3503c8a7d789bd4fe7d7ef0b508974df3bdd9b82446e55538b2e347aaea663c617a96ece3a504acacaf4dfb02e7e8769cff6666993d18ef5c5f5e4c9243b9714bd4fda79fa6fb749d2f589f65ba806dfc7a24f0423f454eac8206de81f7ef7802f11101c7f38c5671249722ec3de44e9f465999dfd64911fc6cf07cb607120d3257e18466ddb193fc9395f0cfff9df83d1a3c33f0657337c3fa12e43a75a77780075bb5420662a4d3b0f0dee540e11df705c872007af74975d8fb0a0945858e40a1d34ac64bfd7425bc8fbb0fc2227b1a60ca74ab6565a278a627bc5bcae3b622ef538b0c9e4f60e8cc3083f29ff14efa5e01a2c4fb317b8cbfa412f808ead18c558b3f4c331f3f73538f2a43446b8611d667baab7761f6427bc02bde7cc6a162a835026ff67b57af64a969a3050cc218fa94af5b0a048fa1b3974caf72de459345fea87ecf55e4eda293134f30c51d19e0b301b24b65ea73634e2a6d30cbd9cb411aa1ce0aca4c572df075de9a1c461f828bb41e297ba10975b8e1cc1b8c1d784e707e820d9b1396128c414b1b5ddf24f008e2bb4bfbac155a2f36feecdeaddc0f94cfff186578410a94d0b98eae4236788207c16df12a0d905d917ae45157723c221e54bac903bdbaa1583518738857b7043be7106a829c52f3811ea39918d867a32bbfc3e29a5c103cebfd80a0e91ed414fb36aa3ef68a7c58a7b976360b0093dc33ac6fad0fbdea296f6ba58e782b63f802f22cf188294525c508e0ea19d4c130a6a05e22a37c3d1ea4f19fc064296b031c4de4ecb6e530f66106bce88fd06b276e2114f4d4f4a22fb709ec037f433b791a7e05c41a83240f02d63514a87d467b308a4e205467f253f332f47ecf8794f94ee8b36ff30f4a759b6044d67db0a67f7f6912c628404760cbc9a492290cdeb509bb9aece772f46f1e95049c99b42297a889b6c098cb7df994f17f4adb2800ffe6ff345711fa47e926d8a906b143477a59fb5db4725ea4c339df6f32f09ddbc5f1e49dccc570ae37675f4715b5e0394b6b19a8a457262243b370bc9bc62304aba39132fbb6946ef47", &(0x7f0000000040)}, 0x18) ioctl$sock_inet_SIOCSIFNETMASK(r3, 0x891c, &(0x7f0000000040)={'veth1_to_team\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}}) accept$nfc_llcp(r3, 0x0, &(0x7f0000001100)) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000001140)=0x2) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000001240)={0x0, @in6={{0xa, 0x4e23, 0x3, @remote, 0xfffffffffffffffa}}, 0x9, 0x1f, 0x0, 0x4, 0x1}, &(0x7f0000001300)=0x98) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000001400)={0x81, 0x4, 0x1, 0x1, 0x4, [{0x7, 0x6, 0x3, 0x0, 0x0, 0x2}, {0x546, 0xfffffffffffffffb, 0xe06, 0x0, 0x0, 0x800}, {0x200, 0xfffffffffffffffb, 0x7f, 0x0, 0x0, 0x1100}, {0x7, 0x3, 0xfffffffffffffbc3, 0x0, 0x0, 0x2000}]}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000001340)={r4, 0xeb7, 0x8}, &(0x7f0000001380)=0x8) 13:36:44 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000004000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:44 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000001a00000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 978.696445] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 978.711831] FAT-fs (loop3): Filesystem has been set read-only [ 978.720250] device nr0 entered promiscuous mode [ 978.725024] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 978.732943] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 978.742773] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) 13:36:44 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000060000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 978.794343] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 978.830801] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 978.866467] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 978.879516] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 978.907152] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 978.915380] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 978.923445] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 978.931717] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) 13:36:44 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x88a8ffff00000000, 0x12) 13:36:44 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000003000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:44 executing program 0: socket(0x1000100000010, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x100000000000003d, 0x0) ioctl$BLKRRPART(r0, 0x125f, 0x0) 13:36:44 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000050000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:44 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x100000002000e) 13:36:44 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="850066f7566853623f54fcf6385de088f59f2d72c78383372c3d5d6ed0b33747e8324af2be46d0d4eba0abd460de3617daeb6349a5b07ddae2e49b61c44ad219032cc731e394e8007a96e271488ec5d7f6004e363e862fcc4e60f75dfe6e57d376a90472612de9bbeef1cdcd7cd2992e7e01952005ff982cfaffe16427fc82015bd76644dbb7558d0b386c244dc36589ac7029c2ac2159ee133f09a08679640a0d20105b10220000"], &(0x7f0000000000)="504c20004cf7d12af11ce92537b5e3191e66de5d4ec18e4c2df01484a86d77842f624946eae310794c8c96ff1466232e25951139bda5d2990e523f8ec3080ffc1224d8dc4c84a9c8e8ab31576806715523fa749e8615c61049b8b1be6aa7740702cc5add", 0x5, 0x487, &(0x7f000000cf3d)=""/195}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x0, 0xe, 0x9e, &(0x7f0000000380)="263abd030e98ff4dc870bd6688a8", &(0x7f00000001c0)=""/158, 0x1200}, 0x28) 13:36:44 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f00000001c0)="1f0000001e0007f1fff5ff020000000c001000005307a33d6c390836be381b24f256e8c83d75733216b8ff7cf8ba164ca9fb0affecd1fc2406dcf4c8ad8e54e121af", 0x42) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x0, 0x80000) write$cgroup_int(r1, &(0x7f0000000040)=0x3ff, 0x12) 13:36:44 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='sched\x00') ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000040)=[0x0, 0xffffffff]) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') clock_gettime(0x6, &(0x7f0000000080)) 13:36:44 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c00000000000000003f000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:44 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x44800, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r1, 0xc0505510, &(0x7f00000002c0)={0x8, 0x7, 0x787936fb, 0x8, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}]}) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000040)) sendfile(r0, r0, 0x0, 0x93e) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000000)={0x4}, 0x4) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:36:44 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000003400002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:44 executing program 2: r0 = pkey_alloc(0x0, 0x3) pkey_free(r0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000680)='/dev/sequencer2\x00', 0x141003, 0x0) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f00000006c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = gettid() ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000500)={{0x0, 0x1, 0x20, 0x46, '\x00', 0x1}, 0x0, 0x30, 0x9, r3, 0x8, 0x2, 'syz1\x00', &(0x7f0000000440)=['/proc/sys/net/ipv4/vs/snat_reroute\x00', ']\x00', '^lowlan0vboxnet0\x00', 'selinux@\x00', 'bdev\x00', '\x00', 'ip6gre0\x00', ')procproc/[\x00'], 0x59, [], [0x3, 0x0, 0x530, 0x101]}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000700)={{{@in=@remote, @in6}}, {{@in6=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000800)=0xe8) bind$inet(r1, &(0x7f0000000040)={0x2, 0x2004e21, @local}, 0x10) r4 = socket$nl_generic(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r4, 0x89f2, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000980)=ANY=[@ANYBLOB="00309a4eee000050fdf57a388c8cf6c648002000000000004bd10000000000000000fbdb3723e1ef08000000752969fbe13300864c69203fe4f00fcd0ba370aff0a8fdd46840931c9898ecfe6a7c547c0dc20edd80ba41e06904519fe4f28c4dda9ef8b94b42d1df1067c182e5e09dd90a5aa79a18855bb3aca0a017dcb75ecf7f43a59308888d5bc0530598a2b902d0a59c50c3f773c7e64bd7e887341f9602cc65ff9d9c0ef34b882b9753dbd646007997239ef628e37603413817c3910fa9d70304e5da52b06d12f1c07d3ac486168fd0f9f858e1766fd152a5a2b98cb40ad50d17f632037ebec19af50edb948949ca7e932044ab3cddbc13e27a562e618ee89aff6a634a266143569deb16b3ed6a4eebbe8009d78ca11f31487b1d098053d9c82afbcc02c715c23e6dcd62ea29d8348343"]}) getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f00000004c0)={@remote, 0x0}, &(0x7f0000000340)=0x14) r6 = dup2(r2, r2) setsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000400)={r5, @loopback, @rand_addr=0x1cb}, 0xc) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/udp\x00') connect$inet6(r6, &(0x7f0000000640)={0xa, 0x4e24, 0x595e, @local, 0x2d3}, 0x1c) fcntl$notify(r4, 0x402, 0x804) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f00000000c0), &(0x7f00000003c0)=0xfffffffffffffefb) exit(0xfffffffffffffffe) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x58c7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000380)='/dev/nullb0\x00', 0x200000, 0x0) close(r4) r8 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e20, 0x1ff, @local, 0x1}}, 0x9, 0x7, 0x100000000000008, 0x10002, 0x4}, &(0x7f0000000100)=0x417) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000140)={r9, 0x4693af02}, 0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x9, 0x20}, &(0x7f00000000c0)=0xc) sendto$inet(r2, &(0x7f0000fa0fff), 0x0, 0x20020006, &(0x7f0000385ff0)={0x2, 0x4e21, @loopback}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r7, 0x891c, &(0x7f0000000000)={'lo\x00', {0x2, 0x4e1d, @multicast1}}) [ 979.460878] device nr0 entered promiscuous mode [ 979.467807] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 979.485043] FAT-fs (loop3): Filesystem has been set read-only [ 979.504187] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 979.515997] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 979.544103] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 979.593184] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000ff0) [ 979.605237] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000202) [ 979.645734] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 979.661715] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) 13:36:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={"6e72300100", 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) accept$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000000)=0x4305000000000000, 0x12) 13:36:45 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x1f, 0x8800) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000000040)={0x2, 0x20, 0x2}) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000140)=""/223) ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f00000000c0)=""/80) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:36:45 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000030000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:45 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000020000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:45 executing program 3: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0xffff}) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141046, 0x0) write$FUSE_ENTRY(r1, &(0x7f0000000440)={0x90}, 0x90) sendfile(r1, r1, &(0x7f0000000040), 0x8080fffffffe) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020600) 13:36:45 executing program 0: r0 = socket(0x1, 0x3, 0x84df) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) 13:36:45 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000010000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:45 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000200000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) 13:36:45 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x113, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000040)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) [ 980.025640] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 980.047851] FAT-fs (loop3): Filesystem has been set read-only [ 980.065543] FAT-fs (loop3): error, invalid access to FAT (entry 0x000006c9) [ 980.091257] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 980.099888] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000020) [ 980.121667] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 980.125473] device nr0 entered promiscuous mode [ 980.131845] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 980.158315] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 980.169349] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 980.170482] kobject: 'tx-3' (0000000093c0be24): kobject_add_internal: parent: 'queues', set: 'queues' [ 980.177360] PGD 1c7e35067 P4D 1c7e35067 PUD 1c22aa067 PMD 0 [ 980.177392] Oops: 0010 [#1] PREEMPT SMP KASAN [ 980.177405] CPU: 1 PID: 5804 Comm: syz-executor1 Not tainted 4.19.0-rc7+ #275 [ 980.177430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 980.177439] RIP: 0010: (null) [ 980.177457] Code: Bad RIP value. [ 980.177465] RSP: 0018:ffff8801daf07868 EFLAGS: 00010246 [ 980.177478] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff860ad93f [ 980.177487] RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8801baf6c5d8 [ 980.177495] RBP: ffff8801daf07df8 R08: ffff8801d32d2080 R09: 0000000000000000 [ 980.177513] R10: fffffbfff145fa09 R11: 0000000000000001 R12: 0000000000000001 [ 980.191155] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 16) [ 980.192667] R13: dffffc0000000000 R14: ffff8801daf07dd0 R15: ffff8801baf6c5d8 [ 980.192680] FS: 00007f25096a8700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 [ 980.192689] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 980.192704] CR2: ffffffffffffffd6 CR3: 00000001bafa3000 CR4: 00000000001426e0 [ 980.200278] kobject: 'tx-3' (0000000093c0be24): kobject_uevent_env [ 980.204462] Call Trace: [ 980.204469] [ 980.204489] ? net_rx_action+0x7c5/0x1950 [ 980.204509] ? perf_trace_lock+0x7a0/0x7a0 [ 980.204533] ? napi_complete_done+0x6d0/0x6d0 [ 980.221516] kobject: 'tx-3' (0000000093c0be24): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/tx-3' [ 980.226489] ? check_preemption_disabled+0x48/0x200 [ 980.226506] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 980.226526] ? debug_smp_processor_id+0x1c/0x20 [ 980.226541] ? debug_smp_processor_id+0x1c/0x20 [ 980.226555] ? perf_trace_lock_acquire+0x15b/0x800 [ 980.226571] ? zap_class+0x640/0x640 [ 980.226585] ? perf_trace_lock+0x7a0/0x7a0 [ 980.226604] ? __hrtimer_run_queues+0x488/0x10d0 [ 980.226626] ? check_preemption_disabled+0x48/0x200 [ 980.235469] kobject: 'rx-3' (0000000000a2fd15): kobject_add_internal: parent: 'queues', set: 'queues' [ 980.241200] ? debug_smp_processor_id+0x1c/0x20 [ 980.241215] ? perf_trace_lock+0x14d/0x7a0 [ 980.241237] ? trace_hardirqs_on+0x310/0x310 [ 980.293045] kobject: 'rx-3' (0000000000a2fd15): kobject_uevent_env [ 980.298547] ? zap_class+0x640/0x640 [ 980.298566] ? clockevents_program_event+0x158/0x370 [ 980.298580] ? lock_downgrade+0x900/0x900 [ 980.298602] ? pvclock_read_flags+0x160/0x160 [ 980.298616] ? trace_hardirqs_on+0x310/0x310 [ 980.298638] ? kvm_clock_read+0x18/0x30 [ 980.298653] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 980.298666] ? ktime_get+0x2e1/0x440 [ 980.298686] ? pvclock_read_flags+0x160/0x160 [ 980.320891] kobject: 'rx-3' (0000000000a2fd15): fill_kobj_path: path = '/devices/virtual/net/nr0/queues/rx-3' [ 980.326867] ? kasan_check_read+0x11/0x20 [ 980.326885] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 980.326901] ? rcu_bh_qs+0xc0/0xc0 [ 980.326921] ? trace_hardirqs_on+0xbd/0x310 [ 980.326943] ? kvm_sched_clock_read+0x9/0x20 [ 980.326956] ? do_softirq_own_stack+0x2a/0x40 [ 980.326969] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 980.326984] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 980.327007] ? check_preemption_disabled+0x48/0x200 [ 980.405761] kobject: 'loop5' (00000000b9cfdca0): kobject_uevent_env [ 980.408336] __do_softirq+0x30b/0xad8 [ 980.408361] ? __irqentry_text_end+0x1f9618/0x1f9618 [ 980.412539] kobject: 'loop5' (00000000b9cfdca0): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 980.417014] ? irq_exit+0xbd/0x1c0 [ 980.417032] ? smp_apic_timer_interrupt+0x1cb/0x760 [ 980.417044] ? smp_reschedule_interrupt+0x109/0x650 [ 980.417058] ? smp_call_function_single_interrupt+0x650/0x650 [ 980.417070] ? ret_from_intr+0xb/0x1e [ 980.417086] ? trace_hardirqs_off_caller+0xbb/0x310 [ 980.417107] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 980.439780] kobject: 'loop3' (000000001e77bdd0): kobject_uevent_env 13:36:45 executing program 0: r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff020000000c000000005307a33d6c390836be381b", 0x1f) sendto(r0, &(0x7f00000000c0)="96901e81e2ce394f127e12762b6f12a6ee57b0eb8b5c141a19795a55ebbaa19d001a0180af146b52b73908d5fc158a04252010d4623050961bc4fe4a7376d3987e59437b210799e3c77245bb9d72524f497741d96ab8442d0c84069634cb1fdc9009c0a25dcbc3f1d928d52d3e8766dfb5e04018301fb3121bb748c69559f2048436be00b19bd46dce74e5c054c06e508691be57b8c83b5321859d9eeb0f0a2419b929ed6e381f3ea235ba667a2117fd480544da37d0b09b43f548ce6842979c353a641c5fdc2a4df12d8333bae4ba557ffe07cffc2a5a8ed487fa2b7cd512dfca41e719b1e92610faf810a4aad2722fe5444cd32c0728f7637bcc90a7c71724237c3cfa7eac17ac8a94d261504cb76b5477543ff5b8dcbbaf6517e5375b59a334cc8df1147b2c6e9502fa9f957e1fa16ab6ce4a4dbac5c36c6e4e259efba1e36705e987ff5efb837c6779983e63cc61cc8198bbc3b9a7db6425a10c2de2e6c50991e83647118c1e48685c80773845cd813c28734a85561edd161907b896d00be13b500d2bd781efd9f63ee018b46f56f2478d12aaafbdc6bb8efa2a93d511bd668d97cc3c531554e8646ecea9710ce9dfc56f7854e2c89c5464c075b9c6dc17dc62c379f524c6bc94de56d7911cfa6a3796ca995e9d34f4ba370dd5c86958b8614f1e18a86ca38240da5031921d4dde76b36cd97614dc01ca756e67033f1c08c2b496d00e40c952a09aa60a0988266a96cfaa52b82a42a06f572ad15fc54aa99f3da4f05db6769591e88c052edaaf275837c5779b2cba0d3290b1c212d79267c93706e1aa968febaedb661237e2846fc7d1b520f5afb1225ff98d55b0f1ce63f2ea027a89fd09ba59769ccd7c3f89d51cb97c74935b2ca597a2bd483b19d646e882bcd888b5d70e57e6ec151c429bf62bf110b23d7b6d9db4d741b157ec4cedaf35c2af1a439385390149989de6255a35a8670184818122d8eefba399c84d9df3a068cd4318d3a1c42991fefc20a592f81d7af398a837e273dca5eb3183217fa0f6977b35320a0268a0f8629536b9df4a1fa7d6e0e3bfc508de793b419c426698a0a0da1296527f3784dbe9881a3d650e068ecea0bfdc0d48e9690e4da1255ca5faeb092ee27734cef28be4b5191ac9a8a70ca01bb8444a1d8c1409da41ba7a6940517761c13db50543345b95840778ac160a32e8d38df2677a6b0dda4e07a8ec04cb33cd0d5b3bb7325adea2675c22da462af83365b8b820715cd328d5e3bda2a9aa91efbfc9c1a8924252c65aba40fcb6cd09934d78437ca60b8b10be2602fb15780f1138ffea042d708015234d196e48f08668c11ff8aada0d767a83ab2eec1edeae1310a0c98a356f72dcdf96cfd91c13b2529a36b1b8dd314994cd2b87cd482aa5ca1a9810d9b1bdbe9fa0d914c62e08412af3f9c69063ca8b37a6f4206de1ebe32af637a72976ac22ac4d85212c0718f5bdda33a6e3f7fa95af64321ac7d17f84f2667b70eb9ec1fa2b480b5cf36f9449a663d6326bdbc7534e0ed27b19c6bfb40cbe3a85256dbea627281f302dd51ac78b3ec3082b74aa379bb28dc92c43e61872b1252e8d0e85759501b99d779656845d10adca92e203baa3ec11fb5f7e3688aea9fb4aa1ac768aaed8fc3cf5672146beaacdfc525955542a58c284770297779f2238261fe2b9426e942eeed4b0366dbec25b5fe391832071e3863f0471c37a83717c786f46a78ab60459c7e76893720a3fb6376c477daa8bb2257e5295f49b672aa88e97a5f34e8c30c35779ddfb682138b74de81a6315aaec8d894989dd2285be7832c7d9fb67725c012ac8d5e36f65ab180f95241946ebfaea78c195d55b0d917cf7d075f5f6b655f62a3741c5182d2949ef4c9189f27e4dc7ab528aeac97cb1653ed2643d5d8a08ee1c9bc09da097cb8343649ea9ff43698fb7d0cdb02c5edebdfa8d065d3352d8179bd0bb1186d74ebf6e17f61cd317ba5d5e98629f8566d5447cbc1dc7b9d4beb5b9a36c1e5241f3f418d6b5b651cc6852657d46df8208fc5fd33f86b4ead931d16f9a8234804a2d15a0a18bef9390753c1af2a0e4037a19fd12913e6f2588ce0661862f69f6e03c2a9ceacb1ad05f99c1fb7192fa8331d4015ecaae99430446f322351f9f88e8e06d2534a231030cb332be6cf2ec0ca12023bb7b589b7839f806fcd13a0f46e4a4b6220dd45075eb1d8aed49a784f7800575a2450597f52582cac495d54727f6434235d501bf89c3e1dcc47362e79032c63922a10a4f299258618ed95bcc15bd7577f5a29def75047f285bfe86a4c796ce73adba10c0564dc88bbcbfe9c36d079185a0f1879c0d9884f3df6d504004ed53beab0cd8f1481b221750cd2cac46e83d08af58847115c7a739ce8062202b107b781986945cde79eb98803b970e6ac0cb058a47eabe4f9d67fbfdb3809aa731705ba3ae270185954913b3b14924421328e490f495f9131199c966dfbdb718a0db86cb496156c8a85cd6b76392d9b92effd053b71f03c39cc7cb6b24cd973faa21078d07ede49f983ba1076fa360aacffc7f074dfe790d5cc0380a6d94b493b8601d2669b55e067a45e57256dc198e37363de2e9c2af23a84b011c598a71af519fd2d9dac84f4bba863955a26eca08c8e913223d0420fa1620e1aa18b77d52d435a83ecf9d0462d106aaf131e2f60973afde09d1d456ac5038414d519445d0fe83895615e67e52628faf2b2132696d2d36420b3c96cb7095e3cd6adbb7f628f84d7cda1395e2fc1eb6c3d48f1d03b8f794bfdcb72f949f4708a3694eebc46d497ec59291a51d1128b503cbb8c40772f6f1de739acbfa1840f2a7ab1651ce8b1858a5a1adbc4eced1c7536cd2fd0ff80b94f45c81ffb22230fbc153fe4215e1b58dd310da6c0addf56d3766ed594de16cc0c2a918f7817514d45694a854a6dac4cc0f1145bd2301db6221be39d78b94cfe2fc08f18485bea03b40560550604b62399507908306b46a9b6d363cf9125a90bfc4077c0ccc5cffed45a6488e7a6c29eba58f7bd87d59f21c1db2e427fd61f68a58b6132013f07f5cf3f498b5da760ee851230e69c97c2e1afcd62298bc3b1441b85f58d47041343f53228d09c29b346758e3168cc05dc8f672a7c5a7cdb49e6f431e77030be77b4611c25b33e49a866a4279ed7885e168d3c463531159cbfece1eb71a2eb2b6961b94701cf8c8f4c5b59ceb4b8b13163a574375d8c297b7c92007fd261fd116750b95d3cff228207484ad7af1dede2b0ec97bfdea0dacd6acba181bfa99bba744f06beae787017f52c76371d0197c17be278807ddcc97ba03a95d04a63fd0349aa5c8007cf1ef2b6f55ae4669474c2e1a76f3a4e8df0a8e4a338d4d279446a37b35069104d338bd7c974cccf561ab6497a1f4b549a8394969a8f2f38df4e6da1a2b278a4799bbb5c114b1c16b72268d3565cf49d0b14311ad4cca3be6be8c72c72f37566194480ddbe61a9328a8202ac86d94f59058118b85488996e83686d77ea9a18a5e42f9a1e947ae13bb7c66dced263742a5513c57496574144d4424d619aa2015f898e1584e8824349d988114454546b6a38566f62b08c1d88216fca9f908c11e2ccfeb8f0545fb1b93081bf0cc39df25f0d3aa1fb5346164aa857d2634b233c9e9af7af654724daac018aae45c48bc23aeeefaf770303afd3cca31bc0a66d39f58ac58af12a84a0ac0f50da2fbee129bfe8be9fabf64b230461b697d2adccaf2e6fec0bf1c1d4368b931713c10b29cf3eb51b5a47d3e4064c477d6bf39ee359c09f083fe1678ba38b0b0f5c13c3be96062d22d8a98be1ca245f130c7c976bbd59931fda64b43535bbeed72f60e3466734f73eed8cc9fee979ff40420170e14dc840bc43b762bd7056f659079f49b5c86b25ca3f02c42fdc233ce6de539e01ad0f77fc84b409b89827d17c052f1158143aeb4d4f59907e77d090edab5539968d4bf66219a5d84ecd7644274c4a06caf86c6fa838aff4963721f9ef09736defb3a58d56d318af7ad4edc3067e6f9f81586db427a79c4732968d973ce40fff1b9d81c77e3bfad0c1c868950e06b144ddbab62ef6421d01aa57029920b83ad91c1e28d27ac5e7f6ddfa30e24467847a5d9b50093d46d7a35393d0175d9b52c7c9d837becd1076ce1af107d408e95e7c2f51369a1aa86a7737c607881e59067053c665151fe9de0460485ea92204b3ebd1ba4b4a3bf48d9d8907bef0590ee2c15c66a4687306a6f186ce3f84a599cc10cc35d85bd552de4691e65f9553faba41b26a31f6d116505dd0469345a5ca34b0829eb823b9176980bd670400a8a8782296be2d8f7c1afdcb49b0f252a39a323e88ef82cd1f1a6e3e71ad50eeb1af36e41f60ec9c09b6dd1ad5c1fef857addbd6e21a08c952db697fe0bfb92010780901a0e0e1fbc9ac901e9a7c7015a88148646a75c5e826e0ec86ee49e9d86f9da73d56c087a4d7f6966cb3638794582d8bc8cb6b2b538476192e0d289298c4a7b2a7a6fc2647a8928dfc8dff955ac5936fde89f4c7275e44137a7dfecdbaefd98fcba614dc0c150bd2ff17e3d558523e17e79a03af13b4cbe0192774ba0530f4a2808af01a27463db651c404aac6041a1a1c908b1bbfc2caea9b07c305bcf0a938af7a8cd4d08bc6ba69ea2cf16ef177ce68e7b89764df8aa24217f4a5a6522251a06ddc31c7fe2dcb9ec66945eb30198bce89cbb55c6cf8e4fca4b3a03294a50b138c51303f10c68d1baed893a9f650e8ecac8a96b6db1c7afce7090ee5d6bb3bed83f192054e16e52208188135354f896115ebdc2f3b233d0e966b1d6db10dbadee1a67c37f1dcc93b54549e1124a9a46235c3302fed87fb2ca3e56d769dcb9b6b7c70f87226ad158402eafba907243733f014a05dff44e9b0930b96c24ec5927b7c1bcc35535914e532e693cbb1a12e6d866c33d24e321d8d562a8cf6108d073405b2e619d99cb2be136856fe7cc56f002bdaf9576e1de109e5a42bf86166e1d3e4c849e8d03998f58c1fa71e964f2557f0b126ff88e63df23fe1a51fb807e8222f4cdda74ead9f129a769dc7bb160e235aa9167dbc7bbb44a67569aefa12dad8352e34286313fa6bbae43855dc60b5d75954ad1591ff0d2f01fe6de7a4a0a29b56ee8177cd2b6a4b338a4eb4a00b6bce8c3c155b1ca79792891c2939ddbd62202f336b484a28ee86bf88bdc0f7f34c43ce64738b42600b4ad8a5435fb05b8dc3d3226f49e6ba92d0fea2ddb51479928d85853a4b5d901d0633bc1b0c110025e824d2007a0a8f63743d13114f438729fcf13203f3264feff33f2cbef36968ee853e0e111bc8e4aec0e0edced523ac55d29f21067a9ff2cacfd6b5f12b962f6d15fc5222a1f9ec1a7f098b0ee18bc1456bd8abefa82ce3b416f459ca96f8261adb7cdcbd4bfb6be555e6054a074ddfef7235de6082732ec6b687448bdecc5d96992374c06cbb72dd8f59414b7db9043f6b6340edf6f34daef23ec091290f051020643e3538dc4c68e74bf36d6f5f73198a53ee4350f27f7d824fd930a0d6f1abd99acdf41378d8465e0bdef75943597bebebd49fc8312f25933a6fcb52660316d8a4fea38441df8bba136c5f39a099483a4e79d93a5651a789da0d88b4705067167f179a885232b2251ec4f1404baa714bc3f1013b9d479df9ef4a70d25d0e561b936d6a05cfef7b3457cd3dd39d1dcb14587e3dfe93c41142a64e545c90bf07d25397a33d17a576cdaac25ef84fdd635d2aaca011e6d39cbd7aa05d4db72e4cb187a4e", 0x1000, 0x20000005, &(0x7f00000010c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x3, 0x1, 0x3, 0x2, {0xa, 0x4e23, 0x6, @remote, 0x7fffffff00000}}}, 0x80) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000040)=@add_del={0x2, &(0x7f0000000000)='veth0_to_bridge\x00', 0x38000000000000}) 13:36:45 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000002000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a00002000100000000000000000200000000030005000000000002000000e00004000000000000000000"], 0x60}}, 0x0) [ 980.448842] ? trace_hardirqs_on_caller+0x310/0x310 [ 980.448858] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 980.448875] ? check_preemption_disabled+0x48/0x200 [ 980.448889] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 980.448910] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 980.463133] kobject: 'loop3' (000000001e77bdd0): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 980.466188] ? tun_get_user+0x1bf5/0x4250 [ 980.466206] do_softirq_own_stack+0x2a/0x40 [ 980.466213] [ 980.466228] do_softirq.part.13+0x126/0x160 [ 980.466243] __local_bh_enable_ip+0x21d/0x260 [ 980.466255] tun_get_user+0x1c0b/0x4250 [ 980.466272] ? perf_trace_lock+0x14d/0x7a0 [ 980.466301] ? tun_build_skb.isra.51+0x2230/0x2230 [ 980.626725] ? lock_downgrade+0x900/0x900 [ 980.630889] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 980.636702] ? lock_downgrade+0x900/0x900 [ 980.641479] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 980.647295] ? zap_class+0x640/0x640 [ 980.651025] ? tun_get+0x206/0x370 [ 980.654580] ? lock_downgrade+0x900/0x900 [ 980.658743] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 980.664571] ? tun_get+0x22d/0x370 [ 980.668117] ? tun_chr_close+0x180/0x180 [ 980.672193] ? trace_hardirqs_on+0x310/0x310 [ 980.676620] tun_chr_write_iter+0xb9/0x154 [ 980.680868] __vfs_write+0x6b8/0x9f0 [ 980.684595] ? kernel_read+0x120/0x120 [ 980.688504] ? apparmor_path_rmdir+0x30/0x30 [ 980.692943] ? apparmor_file_permission+0x24/0x30 [ 980.697810] ? rw_verify_area+0x118/0x360 [ 980.701972] vfs_write+0x1fc/0x560 [ 980.705534] ksys_write+0x101/0x260 [ 980.709175] ? __ia32_sys_read+0xb0/0xb0 [ 980.713259] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 980.718726] __x64_sys_write+0x73/0xb0 [ 980.722629] do_syscall_64+0x1b9/0x820 [ 980.726531] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 980.731906] ? syscall_return_slowpath+0x5e0/0x5e0 [ 980.736861] ? trace_hardirqs_on_caller+0x310/0x310 [ 980.741893] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 980.746930] ? recalc_sigpending_tsk+0x180/0x180 [ 980.752138] ? kasan_check_write+0x14/0x20 [ 980.756392] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 980.761263] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 980.766461] RIP: 0033:0x457579 [ 980.769838] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 980.790225] RSP: 002b:00007f25096a7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 980.797958] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 980.805236] RDX: 0000000000000012 RSI: 0000000020000000 RDI: 0000000000000009 [ 980.812508] RBP: 000000000072c0e0 R08: 0000000000000000 R09: 0000000000000000 [ 980.819781] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f25096a86d4 [ 980.827056] R13: 00000000004c5574 R14: 00000000004d8e98 R15: 00000000ffffffff [ 980.834346] Modules linked in: [ 980.837551] CR2: 0000000000000000 [ 980.841015] ---[ end trace e163547d7be2b4ae ]--- [ 980.845772] RIP: 0010: (null) [ 980.849666] Code: Bad RIP value. [ 980.853037] RSP: 0018:ffff8801daf07868 EFLAGS: 00010246 [ 980.858407] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff860ad93f [ 980.865696] RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8801baf6c5d8 [ 980.872970] RBP: ffff8801daf07df8 R08: ffff8801d32d2080 R09: 0000000000000000 [ 980.880244] R10: fffffbfff145fa09 R11: 0000000000000001 R12: 0000000000000001 [ 980.887519] R13: dffffc0000000000 R14: ffff8801daf07dd0 R15: ffff8801baf6c5d8 [ 980.894799] FS: 00007f25096a8700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 [ 980.903032] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 980.908917] CR2: ffffffffffffffd6 CR3: 00000001bafa3000 CR4: 00000000001426e0 [ 980.916373] Kernel panic - not syncing: Fatal exception in interrupt [ 980.925548] Kernel Offset: disabled [ 980.929179] Rebooting in 86400 seconds..